A whole home network hides behind one public address. The router works out which machine each reply belongs to from the port number — a field meant for naming processes, not hosts.
Words you will meet
- Network address translation network address translation Simple One public address shared by a whole home network. Precise NAT: a router rewrites the source address and port of outgoing datagrams to its own single public address and a chosen port, recording the mapping in a NAT translation table so replies can be reversed. The 16-bit port field allows over 60,000 simultaneous connections. introduced in ch. 4 — open in glossary ( NAT (Network Address Translation) Network Address Translation Letting a whole private network share one public IP address by rewriting addresses and ports. introduced in ch. 4 ) — rewriting addresses and ports so many hosts can share one public address.
- Private address — an address meaningful only inside one network. Reserved by [RFC 1918].
- WAN (Wide Area Network) Wide Area Network The public side of a home or office router — the interface facing the ISP, as opposed to the LAN side facing the home. introduced in ch. 4 side / LAN (Local Area Network) Local Area Network A network covering one building, campus or home. introduced in ch. 1 side — the router’s public interface and its home-facing one.
- NAT translation table — the rows mapping a WAN-side address and port to a LAN-side one.
- SOHO (Small Office, Home Office) Small Office, Home Office The small private network NAT was invented for: a handful of machines behind one router and one public address. introduced in ch. 4 — small office, home office. The setting this was invented for.
- NAT traversal — the tools needed to reach a host that is behind a NAT.
Why this matters
Every IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use. introduced in ch. 1 -capable device needs an address. A home now has phones, tablets, gaming devices, televisions and printers. On the face of it the ISP (Internet Service Provider) Internet Service Provider Connects hosts, and other ISPs, to the rest of the Internet. introduced in ch. 1 would have to allocate a block big enough for all of them, then a bigger block when the household buys something else.
Two problems with that. The ISP may already have allocated the addresses next to yours, so the block cannot grow. And what homeowner wants, or should need, to know how to manage IP addresses at all?
NAT (Network Address Translation) Network Address Translation Letting a whole private network share one public IP address by rewriting addresses and ports. introduced in ch. 4 makes the whole question go away, and it is one of the two reasons the 32-bit address space has lasted three decades past the point it should have run out. Section 4.3.4 is the other.
It also breaks things, and the book is direct about that. This page covers both.
Private addresses
All four interfaces in the home network of Figure 4.25 share the subnet address 10.0.0.0/24. That block sits inside 10.0.0.0/8, one of three ranges [RFC 1918] reserves for private networks.
The three private blocks
The book names only the first. All three are worth knowing, because you will recognise every one of them in the wild:
| Block | Addresses | Where you see it |
|---|---|---|
10.0.0.0/8 | 16,777,216 | large private networks, and the book’s example |
172.16.0.0/12 | 1,048,576 | the one people forget; it is a /12, not a /16 |
192.168.0.0/16 | 65,536 | almost every home router you have ever used |
| the address | 10.0.0.1 | 00001010.00000000.00000000.00000001 |
| the mask | 255.0.0.0 | 11111111.00000000.00000000.00000000 |
| subnet | 10.0.0.0/8 | 00001010.00000000.00000000.00000000 |
| last address | 10.255.255.255 | 00001010.11111111.11111111.11111111 |
The shaded bits are the network prefix — the 8 bits every interface on this subnet shares. The rest identify one interface within it. Two of the 16,777,216 are reserved: 10.0.0.0 names the subnet itself and 10.255.255.255 is its broadcast address, which is why the usable count is 16,777,216 − 2.
Set the prefix to 8 for the whole reserved block, then to 24 for the home network in Figure 4.25. The /8 holds over sixteen million addresses — and every one of them is being used by hundreds of thousands of homes at once.
A realm with private addresses is a network whose addresses have meaning only to devices within it. That is the crucial property, and it is what makes the arithmetic work:
There are hundreds of thousands of home networks, many using the same address space, 10.0.0.0/24.
Devices inside one home can send to each other using those addresses perfectly well. But a packet leaving the home cannot use them as a source or destination, because hundreds of thousands of networks are using the same block. The address would not identify anything.
What the router does
The NAT-enabled router does not look like a router to the outside world. It behaves as a single device with a single IP address.
All traffic leaving the home has source 138.76.29.7. All traffic entering must
have destination 138.76.29.7. The router is hiding the entire home network
behind one address.
Host 10.0.0.1 picks an arbitrary source port, 3345, and sends towards the web server. Its source address is private: it means nothing outside this home, and hundreds of thousands of other homes are using the same one right now.
The book’s own numbered steps. Watch the source line on the way out and the destination line on the way back — those are the only two things NAT ever changes, and it changes both halves of each.
Read all steps as text
- 1 — The host sends, using a private address — Host 10.0.0.1 picks an arbitrary source port, 3345, and sends towards the web server. Its source address is private: it means nothing outside this home, and hundreds of thousands of other homes are using the same one right now.
- 2 — The router rewrites the source and records the mapping — It replaces the source address with its own WAN-side address 138.76.29.7, and the source port 3345 with a new one, 5001 — any port not already in its table. Then it writes the pair into the NAT translation table, because that row is the only way home.
- 3 — The server replies to the only address it ever saw — The web server is blissfully unaware that anything was manipulated. It answers the datagram it received, so its reply is addressed to 138.76.29.7 port 5001. It has never heard of 10.0.0.1 and never will.
- 4 — The router looks up the row and rewrites the destination — Every datagram arriving from the Internet has the same destination address, so the address alone cannot say which host it is for. The router indexes its table by destination address AND destination port, finds 10.0.0.1 and 3345, rewrites both, and forwards. The port number is doing the work.
Why the port number is doing the real work
Every datagram arriving from the Internet has the same destination address — the router’s WAN-side one. So the address cannot possibly say which of the home machines it is for.
The trick is that the translation table is indexed by address and port, and the router hands out a fresh WAN-side port for every connection. When generating one it may choose any port not currently in the table.
Because the port field is 16 bits, a single WAN-side address supports over 60,000 simultaneous connections.
| WAN side | LAN side | What this row is |
|---|---|---|
Cells marked ⓘ have an explanation — click to read it.
Two columns, and the port numbers are what make it work. Without them every row would have the same WAN-side address and the table could not tell the hosts apart.
Look at the second row. Two different hosts both chose source port 3345 — nothing stops them, since inside the home they are told apart by address. Outside, the only thing distinguishing them is the WAN-side port the router assigned. That is why it must assign a new one rather than passing the original through.
Where the addresses come from — all of them
The book asks the obvious question in an aside: where do the home computers get their addresses, and where does the router get its single public one?
Often the answer is the same: DHCP (Dynamic Host Configuration Protocol) Dynamic Host Configuration Protocol Gives a host its IP address and the address of its local DNS server when it joins a network. Built properly in §4.3.2. introduced in ch. 2 .
- The router gets its WAN-side address from the ISP’s DHCP server.
- The router runs a DHCP server itself, handing out
10.0.0.xaddresses to the machines in the home.
So the box in the hall is simultaneously a DHCP client, a DHCP server, a router and a NAT. Section 4.3.2-dhcp’s four-message exchange is happening on both of its interfaces, for different reasons.
What NAT breaks
The book is not neutral about this, and the objections are worth taking seriously.
Objection 1 — port numbers are being used for the wrong thing
Port numbers are meant to address processes, not hosts. NAT uses them to address hosts.
The consequence is concrete. Section 2.7 showed a server process waiting for incoming requests at a well-known port. A peer in a peer-to-peer protocol must do the same when acting as a server.
But an incoming connection to a host behind a NAT has nowhere to go. The translation table has no row for it, because rows are created by outgoing datagrams. So the router does not know which machine the connection is for, and drops it.
How can one peer connect to another peer that is behind a NAT, with a DHCP-provided address? The answer is a family of NAT traversal tools [RFC 5389, RFC 5128, Ford 2005], and their existence is the clearest evidence that something was broken.
Objection 2 — a layer-3 device is reading layer-4 fields
The architectural complaint. Routers are meant to be network-layer devices and should process packets only up to the network layer.
NAT violates the principle that hosts talk directly to each other, without interfering nodes modifying their IP addresses. Much less their port numbers, which belong to a layer the router has no business inspecting.
Compare it with what section 4.3.1 said about the upper-layer protocol field: it is read only at the final destination, and no router in between needs it. NAT reads and rewrites a field one layer above even that.
Section 4.5 returns to this debate under a broader heading: middleboxes middlebox Simple A box in the path that is not a router. Precise RFC 3234: any intermediary box performing functions apart from the normal, standard functions of an IP router on the data path between a source host and a destination host. Examples are NAT boxes, firewalls, intrusion detection systems, caches and load balancers. introduced in ch. 4 — open in glossary . NAT turns out to be one member of a large family, and the argument has two respectable sides.
The security sidebar: firewalls and intrusion detection
The book places a sidebar here, because a NAT box is usually also the thing inspecting your traffic. Attackers who know your address range can send datagrams into it. They map the network with ping sweeps and port scans, crash hosts with malformed packets, scan for open ports, or carry malware.
A firewall inspects datagram and segment header fields and denies suspicious datagrams entry. It might block all ICMP (Internet Control Message Protocol) Internet Control Message Protocol Carries error and diagnostic messages between hosts and routers. A ping is an ICMP message. Covered in §5.6. introduced in ch. 2 echo requests, which prevents a traditional port scan across your address range. It can block on source and destination addresses and port numbers. It can also track TCP (Transmission Control Protocol) Transmission Control Protocol The Internet transport protocol that delivers data reliably and in order, with flow control and congestion control. introduced in ch. 1 connections, admitting only datagrams belonging to approved ones. Most access routers today have firewall capability.
An intrusion detection system ( IDS (Intrusion Detection System) Intrusion Detection System A middlebox that matches traffic against known attack patterns and filters accordingly. introduced in ch. 4 ) goes further. Sitting at the network boundary, it performs deep packet inspection, examining not only headers but the payload, including application-layer data. It matches what it finds against a database of packet signatures known to belong to attacks. The database updates itself as new attacks are found. An intrusion prevention system ( IPS (Intrusion Prevention System) Intrusion Prevention System Like an intrusion detection system, but it blocks the offending packets as well as raising an alert. introduced in ch. 4 ) is the same thing that also blocks, rather than only alerting.
Can they fully shield a network? Clearly no. Attackers continually find new attacks for which no signature yet exists. Firewalls and signature-based detection are useful against known attacks, which is a real but bounded claim. Chapter 8 returns to all of it.
Check yourself
Check yourself
0 of 7 answered1.predictEvery datagram arriving from the Internet has the same destination address — the router's WAN-side one. So how does the router know which home machine it is for?
2.Which fields does NAT rewrite on an outgoing datagram?
3.predictSomeone on the Internet tries to open a connection to a machine behind a NAT. What happens?
4.Hundreds of thousands of homes use 10.0.0.0/24 at the same time. Why is that not a catastrophe?
5.Where does a home router get its own public address, and where do the home machines get theirs?
6.What is the architectural objection to NAT?
7.The book asks whether firewalls and intrusion detection systems can fully shield a network. What is its answer?
What to remember
- NAT lets a whole network share one public address, which is a large part of why the 32-bit address space has lasted. To the outside world the router is a single device with a single address.
- The translation table is indexed by address and port, because the address alone is the same for every arriving datagram. The router assigns a fresh WAN-side port per connection, and 16 bits allow over 60,000 at once.
- Rows are created by outgoing datagrams. That is why an unsolicited incoming connection has nowhere to go, and why NAT traversal tools exist.