NAT Operation
B-8
In order to make the servers on H1 and H2 public, the following NAT port map-
ping entries are installed on HR:
NAT Entry Table
Foreign IP
Foreign
Port
Local IP
Local
Port
Mapped
Port
IP Protocol
TCP State
Timeout
wild
wild
192.168.0.33
23
23
TCP
–
STATIC
wild
wild
192.168.0.32
80
80
TCP
–
STATIC
With these mappings, the externally available HTTP server and Telnet server
publicly accessible on the WAN IP (128.1.2.12) are actually executing on H1
and H2. However HR can have its own HTTP and Telnet servers and make
them available to hosts on the LAN.
Also note that regardless of how hosts on the LAN access HR (either through
192.168.0.1 or 128.1.2.12), their packets are not processed via NAT. Thus
they are never altered. The following are some connection examples:
Client
Protocol Used
Target Address
Resulting Server Connection
IH
HTTP
128.1.2.12
HTTP on H1
H2
HTTP
128.1.2.12
HTTP on HR
H2
HTTP
192.168.0.1
HTTP on HR
H2
HTTP
192.168.0.32
HTTP on H1
IH
Telnet
128.1.2.12
Telnet on H2
H1
Telnet
128.1.2.12
Telnet on HR
H1
Telnet
192.168.0.1
Telnet on HR
H1
Telnet
192.168.0.33
Telnet on H2
B.1.4 NAT Proxy Filters
B.1.4.1 Problem Synopsis
Translating the IP destination address of a packet via NAT guarantees that all
packets can be redirected to their correct physical destination, but it does not
guarantee that the information will be understood by the recipient. Since one
side of the connection always believes they are actually connected to a differ-
ent IP address than their physical peer, there is a possibility that the application
using the information will become confused. The confusion arises when there
is information in the packet payload that is dependent on the IP address/port
of the peer connection.