NAT works by maintaining a mapping table between (internal IP, internal port) and (external IP, external port). But both UDP and TCP has 16-bit port numbers, which means that the table can have at most 65536*2 entries (suppose there is only one public IP assigned to this private network). Since that each computer makes a lot of connections, a not-very-large private network will soon fill this table, right? How to handle the lack of ports on the external IP then?
-
You are talking about PAT (port address translation), the simplest version of NAT is just (inside local IP) to (outside global IP) and doesn't maintain any port-level tracking.– cpt_finkOct 13, 2014 at 4:47
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Jan 4, 2021 at 22:54
Add a comment
|
2 Answers
As a rule of thumb, I size my firewalls for 250 tcp sessions per user. That's on the high side right now, but as people start to use more and more cloud services (dropbox, Office365, etc, etc) the number of sessions per user is only going up in the near future, so I prefer to be on the safe side. This means a single public IP is enough to NAT for only 250 users.
If you have more users, you would need to use more public IP addresses for NAT. This is called a NAT Pool. Your firewall will use IPs from the pool to assign IP/port combinations as needed.
In Cisco IOS, you configure a NAT pool thus:
ip nat pool <name> <start-ip> <end-ip>
{netmask <netmask> | prefix-length <prefix-length>}
[type {rotary}]
If you want to know everything about NAT, check out the Cisco documentation. It's an excellent read.
-
Given the exhaustion of IPv4 addresses, won't this approach be unrealistic soon? Oct 19, 2014 at 13:03
-
NAT was never meant to save IPv4 for eternity, only to extend its miserable existence. The only long term solution for IP exhaustion at this moment is to move to IPv6. For the next couple of years though, it's still smart to learn about the ins an outs of NAT44.– RobinGOct 20, 2014 at 7:15
-
@SiyuanRen I would assume that what will happen is that more home users will get pushed behind some variable of ISP level NAT so that the IPs can be reallocated to those who are prepared to pay serious money for them. The price of IPv4 addresses will have to go up a long way before using them for corporate NAT pools becomes prohibitively expensive. Dec 16, 2015 at 5:31
They don't NAT, use multiple WAN IP's for NAT, or use proxies, WAN accelerators or more levels of NAT to reduce the number of outbound connections.
-
1WAN accelerators aren't doing any savings in this regard, and multi level NAT neither. The only thing which helps is either to add public IPs or use higher-layer proxies (NAT is layer 4 proxy basically).– KveriOct 11, 2014 at 23:44
-
-
@SiyuanRen: Layer 7 proxies basically terminate layer 4 (eg. TCP) and split the connection to two so-called legs (client leg, server leg). These legs are 2 separate TCP connections (client<->proxy and proxy<->server). Now the proxy can (in theory) open connections to serverA, serverB and serverC from the same IP:port, therefore using only 1 local port for all three connections. Moreover if multiple clients connect to the same server, the proxy can multiplex clients' requests over one connection, also saving ports. Also proxies are caching, so sometime the proxy->server connection is not reqd.– KveriOct 24, 2014 at 19:53
-
@SiyuanRen: another thing is, that proxies can have stricter timeouts, so they may time out proxy->server connections much faster, therefore freeing ports.– KveriOct 24, 2014 at 19:55
-
@Kveri the problem is unless you want/need to open the can of worms that is https interception, an increasing proportion of connctions are just going to be passed straight through your proxy. Jan 6 at 20:09