Page 24 / 141
DTUS065 rev A.7 – June 27, 2014
V.1.3.4
NAT (network addresses translation) routers
When a global network is composed of several networks managed by
independent administrators and connected together, the same IP addresses
could potentially be assigned inside the subnetworks. This is customarily
seen in the Internet which serves as a backbone to connect together the
private networks of many companies. This could be used also when many
identical subnetworks must be set up and connected to a root backbone.
In this kind of setup, each subnetwork has a router which is the gateway to
and from the subnetwork. The routers are interconnected by the backbone.
To avoid IP addresses duplicates, the routers convert the subnetwork IP
addresses to backbone IP addresses, hence the name “NAT”.
A NAT router thus splits the network in two “
zones
”: the
public zone
which
is materialized by the backbone, and where a central administration gives
out “public” IP addresses; and the
private zone
where the administrator can
assign IP addresses without the knowledge of IP addresses outside.
Then the NAT router changes all outgoing (from private to public) IP
datagrams to masquerade the source private IP address into its own unique,
public IP address. It also changes the incoming (from public to private) IP
datagrams replacing the destination address, which is the router’s public
address, to the private IP address of some device in the private network. In
order to keep offering a wide address space as seen from the public side, the
NAT router uses port numbers as extensions to the IP addresses. Hence, the
NAT mainly works with UDP and TCP; it cannot handle generic ICMP
routing, but only towards one private device at most.
The NAT router must manage incoming connection calls as well as outgoing
connection calls. It uses two main conversion tables:
•
A configurable table which assigns a private destination IP
to selected destination ports in the incoming calls
•
An internal conversion table which tracks which ports are
assigned to which (private IP, private port) couple for
outgoing datagrams.
Due to the various processing involved, the performance of a NAT router is
lower than the performance of a regular router, which is lower than the
performance of a simple software bridge.
Private subnet 2
192.168.1.0/24
“public” backbone
10.0.0.0/8
Private subnet 1
192.168.1.0/24
NAT router
NAT router
common server
10.200.11.22
10.100.0.1
10.100.0.2
Same address
space
