NAT

Stands for: Network Address Translation

Rewriting IP addresses, and usually ports, as packets cross between address realms, so many private hosts can share one public address.

Network Address Translation (RFC 2663, RFC 3022) is why a home or office sits behind one public IPv4 address. Its common form, NAPT, rewrites ports as well; source and destination NAT, port forwarding and carrier-grade NAT are variations, and anything carrying addresses in its payload notices.

A NAT keeps state per session. The first packet of a flow creates the mapping and later packets only look it up; the NAT rewrites the address and port and corrects the IP checksum and the TCP or UDP checksum, which covers the addresses through its pseudo header. ICMP errors carry a copy of the original headers, which must be translated too. Above port 1023 one external address offers 64,512 ports per protocol.

RFC 4787 separates two behaviours that are easily confused. Mapping decides whether an inside address and port keep the same outside pair for every destination, and endpoint-independent mapping is a MUST because traversal tools such as STUN rely on it. Filtering decides which inbound packets are let through, and only filtering bears on security. Timers matter as much: a UDP mapping must last at least two minutes, and an established TCP one at least 2 hours 4 minutes.

NAT is not a firewall. It blocks unsolicited inbound traffic only because no mapping exists; a static mapping exposes a host as if no NAT were there, and RFC 2993 warns that NAT can lower security by creating the illusion of a barrier. Its costs fall on protocols with addresses in their payloads, which need ALGs, on IPsec AH, on asymmetric paths and on attribution. RFC 2993 calls it a diversion to sustain IPv4, and IPv6 was designed to make it unnecessary.

Also known as: nat, pat, masquerade, source nat, snat, dnat, napt, network address port translation

Sources

← All glossary entries