2

I have a question about NAT, and this question has answered most of it : How NAT / PortForwarding / TCP/IP works?

What I am left confused on, is in this part of the question:

Why does this work? Now when a packet comes back, the Router simply checks the destination port number and changes the destination IP address and the destination port number according to the pre-mentioned mapping and the packet gets delivered successfully.

My question is the following: What happens if a random computer (computer A) tries to connect on a random port of a computer on a LAN (computer B) behind the router using NAT? For example, what happens if computer A wants to connect via TCP on port 42534 on computer B? The packet sent to the LAN would be the following:

source_address: computer A's public address

source_port: computer A's port

destination_address: the LAN's public address

destination_port: 42534

How will the router know to which computer it should send the packet? Is there a mapping that would allow the router to know to which computer on the LAN to send it to?

Improve this question

1 Answer 1

Reset to default
1

Yes. Typically, devices that are accessible from the public side have a static mapping. So the (public) destination address and port are mapped to a private address behind the NAT device.

If the static mapping is not set up in advance, then the router will not know how to process the packet and will drop it. In other words, unless the administrator configures NAT mapping, no translation will occur.

Depending on the type of NAT configured, all ports will be mapped to a single private address. Or, specific ports can be mapped to separate private addresses and ports.

As an example, you can use a single public IP and map it to different servers. Using the same public IP, mail (tcp 25) can be mapped to one server, SSH (tcp 22) can be mapped to a different server, and web (tcp 80) to a third. But they all appear to the public as a single address.

Improve this answer
2
  • You mention if the static mapping is not set up in advance, it will be dropped. Is there a difference if we use dynamic NAT?
    – Choub890
    Commented Dec 10, 2014 at 2:34
  • 1
    When a device behind the NAT creates an outbound connection, a dynamic NAT entry is created. But for inbound connections, you need a static NAT.
    – Ron Trunk
    Commented Dec 10, 2014 at 2:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.