Network Address Translation

work address and port translation (NAPT) also change the port number in IP packets, operating at Layers 3 and 4. Typically most NAT also perform NAPT, but are still referred to simply as NAT. The reasons for implementing NAT will be discussed in the following sections, but the main reason has to do with the shortage of IPv4 addresses.

The earliest discussion of NAT in the IETF is RFC 1631 [1], which discusses the pros and cons of using NAT. The need for private IP address spaces resulted in the publication of RFC 1918 [2] in 1996 by the IETF, which reserved three IPv4 address blocks. These addresses are not routable on the public Inter- net—they only have meaning within a private network. RFC 2663 [3] defined NAT for the first time. Recently, serious discussions have started about the standardization of NAT and the architectural implications of NAT been held in the IETF. In 2004, a working group was formed to develop terminology for NAT, define requirements, and define protocols for the testing and probing of NATs. This working group, known obtusely as BEHAVE (Behavioral Engineering for Hindrance Avoidance) [4] has made excellent progress over the past few years and has published a number of documents discussed in this chapter. This chapter will make use of some this new terminology and definitions. The next sections cover the advantages and the problem with NAT as discussed in RFC 2993 [5].

10.2 Advantages of NAT

A number of factors led to the development of NAT, and only a few of them relate to the shortage of IPv4 addresses. Many of them are aspects of management. For example, a network can avoid having to renumber IP addresses when changing internet service providers. The management of IP addresses can be simplified if a network must use a number of small individual address blocks. The use of a single private address range is easier to manage in the end devices, with the complexity of the small address blocks being centralized in the NAT. Networks can also use the basic filtering properties of NAT to provide some firewall security. Any host that does not initiate outbound connections to the Internet is not reachable by a host on the Internet. Hosts that do initiate connections are limited by the filtering rules of the NAT in receiving incoming packets.

For Internet service providers (ISPs), NAT can allow an ISP to conserve the number of IP addresses it needs. The number of IP addresses needed is only the maximum number of concurrent connected users rather than the total number of users. Each user can be assigned a private address and will only be assigned a public address when they connect. NAT also allows an ISP to segment their network for management purposes.

10.3 Disadvantages of NAT

There are many problems with NAT. The biggest problem is that they break the end-to-end model of the Internet. The reachability of any Internet host by any other Internet host was part of the Internet from the beginning, and many assumptions about reachability are included in Internet protocols. NAT also breaks the transitive reachability of hosts (e.g., host A can reach host B, host B can reach host C, but host C cannot reach host A). NAT creates a single point of failure in the Internet where fates are shared. For example, in a connection without NAT between host A and host B, as long as both hosts have Internet connectivity they can exchange packets and communicate. Any of the routers and connections between them can fail and the connection can be maintained, possibly with some lost packets. However, if A and B connect through a NAT, the failure of that NAT will cause the connection to fail with no guarantee that either A or B can re-establish it. For example, many failures experienced during Web browsing are not failures of either the Web browser or the Web server, but of a NAT in between. When the NAT fails, the bindings are lost and the connection stalls. This continues until the user hits the refresh button on the Web browser which closes all the TCP connections and opens new ones, creating new bindings, which allow browsing to continue. The use of NAT also complicates multihoming in a site, since a response must route back through the same NAT that processed the request. NAT also inhibits the implementation of security at the IP layer.

There are cases where NAT will not prevent IP address renumbering. For example, when networks that use the same private address range are combined, the address overlap will require renumbering. NAT with port mapping complicates offering services that use well-known port numbers. For example, Web servers typically use port 80 which can only be allocated once by NAT for a particular public address. If multiple SIP clients are behind the same NAT and share a public IP address, only one of them can be allocated the well-known SIP port of 5060, which can result in routing failures.

NATs that operate at both layer 3 and layer 4 must understand all transport protocols used through it. While this is not a problem for the common TCP and UDP, it is a major problem for newer transport protocols such as the Datagram Congestion Control Protocol (DCCP), Stream Control Transport Protocol (SCCP), and Host Identity Protocol (HIP). As a result NATs are an impediment to new transport protocols.

Unfortunately, NAT usage is widespread on the Internet today. As a result, all protocols must be aware of NAT operation and be able to overcome their limitations. The next section will discuss how NAT works.

10.4 How NAT Works

NAT operates at the IP Layer 3 as shown in Figure 1.1. NAPT operates at both the IP and transport layers 3 and 4. NAT creates mappings between inside and outside addresses and ports. These mappings are sometimes called bindings. Mappings are temporary, and expire either after a TCP connection is closed with a FIN or after inactivity with UDP transport. There are multiple types of NAT depending on the rules used for mapping and filtering. Older NAT terminology classified NAT in terms of full cone, restricted cone, and symmetric. However, in this chapter, we will use more modern terminology developed by the BEHAVE working group. Some major types of NAT are endpoint address independent, endpoint address dependent, and endpoint address and port dependent. There are also several behavioral options as well.

Table 10.1 lists the parts of the IPv4 and UDP/TCP header field that are modified by NAT. When a request is received on the inside of a NAT and forwarded to the outside, the source address and source port are rewritten. If this is the first packet in a flow, a new mapping will be created to be used for routing responses. If this is not the first packet, an existing mapping will be used. The UDP checksum must also be rewritten. When a response packet is received from the outside of the NAT and forwarded to the inside, the destination address and destination port are rewritten to the inside address and port for this mapping. Again, the UDP checksum must be rewritten.

Note that the fact that NAT operates at Layer 4 with TCP does not mean that the resulting TCP session is no longer end-to-end—the TCP connection is still end-to-end. NAT never maintains a transmission control block or maps sequence numbers. NAT also never performs retransmissions or acknowledgements. As a result, TCP still operates with end-to-end flow control and reliability through NAT.

An example of NAT operation is shown in Figure 10.1. In this example, a SIP client on a host sends a SIP request through a NAT, two routers, and an Ethernet switch. The Ethernet switch operates only at the link and physical layer while the routers operate at the IP, link, and physical layers. These devices only forward the packet without making any changes to the packet. The

Table 10.1

Parts of an IPv4 and UDP/TCP Header Field Modified by NAT

IP header checksum

Source address

Destination address

Source port

Desitnation port

UDP checksum