6

NAT works by maintaining a mapping table between (internal IP, internal port) and (external IP, external port). But both UDP and TCP has 16-bit port numbers, which means that the table can have at most 65536*2 entries (suppose there is only one public IP assigned to this private network). Since that each computer makes a lot of connections, a not-very-large private network will soon fill this table, right? How to handle the lack of ports on the external IP then?

  • You are talking about PAT (port address translation), the simplest version of NAT is just (inside local IP) to (outside global IP) and doesn't maintain any port-level tracking. – cpt_fink Oct 13 '14 at 4:47
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 15:49
6

As a rule of thumb, I size my firewalls for 250 tcp sessions per user. That's on the high side right now, but as people start to use more and more cloud services (dropbox, Office365, etc, etc) the number of sessions per user is only going up in the near future, so I prefer to be on the safe side. This means a single public IP is enough to NAT for only 250 users.

If you have more users, you would need to use more public IP addresses for NAT. This is called a NAT Pool. Your firewall will use IPs from the pool to assign IP/port combinations as needed.

In Cisco IOS, you configure a NAT pool thus:

ip nat pool <name> <start-ip> <end-ip> 
 {netmask <netmask> | prefix-length <prefix-length>}
 [type {rotary}]

If you want to know everything about NAT, check out the Cisco documentation. It's an excellent read.

  • Given the exhaustion of IPv4 addresses, won't this approach be unrealistic soon? – Siyuan Ren Oct 19 '14 at 13:03
  • NAT was never meant to save IPv4 for eternity, only to extend its miserable existence. The only long term solution for IP exhaustion at this moment is to move to IPv6. For the next couple of years though, it's still smart to learn about the ins an outs of NAT44. – RobinG Oct 20 '14 at 7:15
  • @SiyuanRen I would assume that what will happen is that more home users will get pushed behind some variable of ISP level NAT so that the IPs can be reallocated to those who are prepared to pay serious money for them. The price of IPv4 addresses will have to go up a long way before using them for corporate NAT pools becomes prohibitively expensive. – Peter Green Dec 16 '15 at 5:31
2

They don't NAT, use multiple WAN IP's for NAT, or use proxies, WAN accelerators or more levels of NAT to reduce the number of outbound connections.

  • 1
    WAN accelerators aren't doing any savings in this regard, and multi level NAT neither. The only thing which helps is either to add public IPs or use higher-layer proxies (NAT is layer 4 proxy basically). – Kveri Oct 11 '14 at 23:44
  • @Kveri: How higher layer proxy works in this case? – Siyuan Ren Oct 19 '14 at 13:02
  • @SiyuanRen: Layer 7 proxies basically terminate layer 4 (eg. TCP) and split the connection to two so-called legs (client leg, server leg). These legs are 2 separate TCP connections (client<->proxy and proxy<->server). Now the proxy can (in theory) open connections to serverA, serverB and serverC from the same IP:port, therefore using only 1 local port for all three connections. Moreover if multiple clients connect to the same server, the proxy can multiplex clients' requests over one connection, also saving ports. Also proxies are caching, so sometime the proxy->server connection is not reqd. – Kveri Oct 24 '14 at 19:53
  • @SiyuanRen: another thing is, that proxies can have stricter timeouts, so they may time out proxy->server connections much faster, therefore freeing ports. – Kveri Oct 24 '14 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.