ELSA Lancom DSL/10 Office, Руководство пользователя

Страница: 39 / 106

Operating modes and functions
ELSA LANCOM DSL/10 Office
31
IP masquerading (NAT, PAT)
One continually growing problem for the Internet is the limited number of generally valid
IP addresses available. In addition to this, the allocation of fixed IP addresses for the
Internet by the Network Information Center (NIC) is an expensive process. What is more
obvious than having several computers share one IP address?
This particular solution is called IP masquerading. This is a procedure whereby only one
LAN router appears on the Internet with an IP address. This IP address is allocated to the
router either permanently by the NIC or temporarily by an Internet provider. All the other
computers on the network then “conceal“ themselves behind this one IP address. Aside
from the welcome savings, IP masquerading has the added benefit of guarding very
effectively against attacks on the local network from the Internet.
How does IP masquerading work?
Masquerading makes use of a characteristic of TCP/IP data transmission, which is to use
port numbers for destination and source as well as the source and destination addresses.
When the router receives a data packet for transfer it now notes the IP address and the
sender's port in an internal table. It also enters this port on the table and forwards the
packet with the new information.
The entry in the internal table allows the router to assign this response to the original
sender again.
You can view these tables in detail in the router statistics (see also 'Status' in the
reference section of the manual).
Simple and inverse masquerading
If, on the other hand, a computer sends a packet from the Internet to, for example, an
FTP server on the LAN, from the point of view of this computer the router appears to be
the FTP server. The router reads the IP address of the FTP server in the LAN from the entry
in the service table (in
ELSA LANconfig in the 'TCP/IP' configuration section on the
'Masq.' tab or in the
Setup/IP Router-module/Masquerading/Service
Table
menu). The packet is forwarded to this computer. All packets that come from
the FTP server in the local network (answers from the server) are hidden behind the
IP address of the router.
The only small difference is that:
K
When accessing the Internet from the LAN, on the other hand, the router itself
makes the entry in the port and IP address information table.
The table concerned can hold up to 2048 entries, that is it allows 2048
simultaneous transmissions between the masked and the unmasked network.
After a specified period of time, the router, however, assumes that the entry is no
longer required and deletes it automatically from the table.