NAT Operation
B-3
Network Address Translation
B.1.2 Basic NAT
When sharing a single WAN IP address, the IP address obtained from the ISP
is assigned to the router (the TCP/IP stack in routing mode). Client machines
that are to share the IP address are placed on the home LAN. The router routes
traffic between the LAN and the WAN (internet via the ISP).
As packets traverse from the LAN to the WAN across the router, the source
IP address of the packet (a LAN address) is replaced with the public IP address
of the router. The result is that all packets sent to the WAN appear to have origi-
nated from the router with the public IP address obtained from the ISP.
As packets traverse from the WAN to the LAN across the router, the destination
IP address of the packet (the router’s WAN IP as obtained from the ISP) is re-
placed with the home LAN IP address of the physical client machine to which
the packet is ultimately destined.
In order to perform this translation successfully, some details must be ad-
dressed. First, in order to allow multiple clients to share the public IP address
in a non-ambiguous fashion, there must exist a deterministic method of map-
ping packets from the WAN to their correct destination on the LAN. This is done
be keeping records of LAN IP clients that have initiated IP traffic, and by alter-
ing the TCP/UDP port (or ICMP Id field) as well as the IP address when per-
forming the translation.
Every time a LAN client sends a packet to the WAN, the local IP address, port/
id, and protocol is recorded for reverse mapping, as well as the destination IP
address and port for security. When a packet is received from the WAN, the
destination port/id is checked against the current database of NAT entries to
see if the packet’s destination address and port/id should be translated to a
LAN client.
For example, when accessing the Internet, all communications is normally ini-
tiated by the client. In this case, communications will be initiated by H1 or H2.
Assume that H1 attempts to establish an HTTP connection with the Internet
host (IH). It will send a connection request to the IP address assigned to IH,
and a TCP port value of 80, which is HTTP. The request will be from its own
IP address with an ephemeral port value that is picked from a pool (consider
it random for our purposes – say 1001). So the request will be addressed as
follows:
Packet 1
To
From
Protocol
64.1.1.100 : 80
192.168.0.32 : 1001
TCP