(upbeat music)
- NAT allows us to have one set of IP addresses
inside of our network and have those IP addresses
translated into one or more IP addresses
that can be routed on the public internet.
Specifically, with IPv4, there are some specific ranges
of IP addresses that are designated for private use.
That means we can use those addresses
on the inside of our network,
but we cannot use them on the public internet.
However, if we translate those private addresses
into the publicly routable addresses,
not only does that let us use a huge number of IP addresses
on the inside of our networks
and have those IP addresses
translated into one or more publicly routable IP addresses,
it lets us use those same IP addresses
in millions of homes and businesses around the world.
It doesn't matter if your business uses the same IP address
as someone else's office because those private IP addresses
never make it to the public internet.
Let's take a look at an example.
In this instance, we're fortunate enough to have a pool
of publicly routable addresses that we can use
in the range of 192.0.2.101
all the way through 192.0.2.199.
Now those addresses, they can be used
as we send traffic out to the internet.
And to understand NAT's terminology,
we need to identify which portion of this overall network
refers to the inside of the network
and which portion refers to the outside.
In this case, we'll say that everything
off of interface Gig1 on router R1, that's the inside
while everything off of Gig2, that's going to be the outside.
Now let's imagine that client one
wants to communicate with a web server on the internet
that has an IP address of 203.0.113.100.
Notice that client one,
it has a private IP address of 10.1.1.1.
That's not routable on the public internet.
Fortunately router R1, it's configured for NAT.
It's going to be taking client one's private IP address
of 10.1.1.1 and it's going to translate that
into the publicly routable IP address from that pool
which we'll say in this case is 192.0.2.101.
Then when the room return traffic comes back
from the web server,
when router R1 sees that incoming traffic
destined for 192.0.2.101,
it knows that needs to be forwarded
to client one because router R1
maintains a translation table
that has all of the NAT mappings.
Next let's say client two also wants to communicate
with the web server.
Router R1 translates client two's private IP address
of 10.1.1.2 into a publicly routable IP address
of 192.0.2.102 which is different than the IP address
assigned from router R1's pool
of publicly routable IP addresses.
Again, this information is stored
in router R1's NAT translation table.
Notice this table has a column for inside local
and inside global addresses.
Let's define those terms.
Since each of these begin with the word inside,
they're referring to devices
that live on the inside of our network,
specifically client one and client two.
These address names then end in the words local and global.
That identifies if the device's IP address
can only be routed locally or if it can be routed globally
on the public internet.
Let's use client one as an example.
Its inside a local address is 10.1.1.1
because that IP address refers to a device
on the inside of our network, specifically client one
and the IP address can only be routed locally
because it's a private IP address.
However, client one's inside global address,
that's 192.0.2.101.
The word inside indicates we're still referring to a device
on the inside of our network which is still client one.
However, the word global indicates this IP address
can be routed globally.
By the same logic, we can say that the IP address
of the web server is an outside global address
because it refers to a device on the outside of our network
and the IP address of 203.0.113.100, it's globally routable.
This type of NAT is called Dynamic NAT
because we're dynamically translating multiple
inside local addresses
into multiple inside global addresses.
However, many times we don't have that luxury
of having a pool of publicly routable IP addresses.
Instead, we might have only one IP address
that our internet service provider gave us.
Fortunately, there's a type of NAT that can let multiple
inside local addresses share a single inside global address.
It's called port address translation or PAT.
With PAT, our challenge is how do we let
multiple inside local addresses share a single
inside global address?
Specifically, how does the router look
at return traffic from the internet
and know where to forward it on the inside network?
Well, when a client reaches out
to the server on the internet,
not only does it use the well-known port number of 80
to indicate it wants to use web services on that server,
it also dynamically picks a source port number.
This port number is sometimes called a dynamic
or ephemeral or a private port number.
And this range can vary based
on different vendors and operating systems.
Notice in this case, client one sends a packet
to our web server with a source port of 41,025
while client two sends a packet to our web server
with a source port of 41,050.
If our router is configured for PAT,
not only does it keep track of the mapping
between the inside local and inside global addresses,
it also keeps track of the source
and destination port numbers being used by each session.
So in this case, even though both client one and client two
get translated into the same inside global address
of 203.0.113.100,
the router keeps the different sessions separate
by also keeping a record
of the port numbers being used by those clients.
And as an example, when the web server
is sending a packet back into the network,
it's destined for 192.0.113.100.
That's the inside global address being used
by both client one and client two.
But in addition to that,
let's say the packet coming in from that web server
has a destination port number of 41,050.
When router R1 sees that,
it's going to look at its NAT translation table
and realize that packet,
it needs to be forwarded to client two.
And that's a look at how network address translation
can help extend the usefulness of IPv4 addresses
by letting millions of networks around the world
use the same set of private IPv4 addresses
inside of their network and have those addresses translated
into a much smaller number
of publicly routable IPv4 addresses.
(classical music)