Network Address Translation (NAT)
Network Address
Translation (NAT) is the
process where a network device, usually a firewall, assigns a public address to
a computer (or group of computers) inside a private network. The main use of
NAT is to limit the number of public IP addresses an organization or company
must use, for both economy and security purposes.
The most common form of network translation
involves a large private network using addresses in a private range (10.0.0.0
to 10.255.255.255, 172.16.0.0 to 172.31.255.255, or 192.168.0 0 to
192.168.255.255). The private addressing scheme works well for computers that
only have to access resources inside the network, like workstations needing
access to file servers and printers. Routers inside the private network can
route traffic between private addresses with no trouble. However, to access
resources outside the network, like the Internet, these computers have to have
a public address in order for responses to their requests to return to them.
This is where NAT comes into play.
Internet requests that require Network Address
Translation (NAT) are quite complex but happen so rapidly that the end user
rarely knows it has occurred. A workstation inside a network makes a request to
a computer on the Internet. Routers within the network recognize that the
request is not for a resource inside the network, so they send the request to
the firewall. The firewall sees the request from the computer with the internal
IP. It then makes the same request to the Internet using its own public
address, and returns the response from the Internet resource to the computer
inside the private network. From the perspective of the resource on the
Internet, it is sending information to the address of the firewall. From the
perspective of the workstation, it appears that communication is directly with
the site on the Internet. When NAT is used in this way, all users inside the
private network access the Internet have the same public IP address when they
use the Internet. That means only one public addresses is needed for hundreds
or even thousands of users.
Most modern firewalls are stateful - that is,
they are able to set up the connection between the internal workstation and the
Internet resource. They can keep track of the details of the connection, like
ports, packet order, and the IP addresses involved. This is called keeping
track of the state of the connection. In this way, they are able to keep track
of the session composed of communication between the workstation and the
firewall, and the firewall with the Internet. When the session ends, the
firewall discards all of the information about the connection.
There are other uses for Network Address
Translation (NAT) beyond simply allowing workstations with internal IP addresses
to access the Internet. In large networks, some servers may act as Web servers
and require access from the Internet. These servers are assigned public IP
addresses on the firewall, allowing the public to access the servers only
through that IP address. However, as an additional layer of security, the
firewall acts as the intermediary between the outside world and the protected
internal network. Additional rules can be added, including which ports can be
accessed at that IP address. Using NAT in this way allows network engineers to
more efficiently route internal network traffic to the same resources, and
allow access to more ports, while restricting access at the firewall. It also
allows detailed logging of communications between the network and the outside
world.
Additionally, NAT can be used to allow
selective access to the outside of the network, too. Workstations or other
computers requiring special access outside the network can be assigned specific
external IPs using NAT, allowing them to communicate with computers and
applications that require a unique public IP address. Again, the firewall acts
as the intermediary, and can control the session in both directions,
restricting port access and protocols.
NAT is a very important aspect of firewall
security. It conserves the number of public addresses used within an
organization, and it allows for stricter control of access to resources on both
sides of the firewall.
