NAT - inside global address

Question

http://packetlife.net/blog/2010/jan/7/understanding-nat-address-types/

Let's say I have a bunch of hosts connected to a typical router (which is in fact a switch + router) that has a public global IP assigned by my ISP.

The hosts use private IPs that are non-routable addresses, and need to be translated using NAT to the public one so that it can talk with the rest of Internet.

Now, my router is connected to a network of my ISP. It has some IP address in that network, but that address is different than what my public IP address is, right? - it follows from the article linked above:

by this command:

ip nat inside source static 192.168.0.10 192.0.2.10

which assigned a public IP (in other words, inside global IP) 192.0.2.10 to the host 192.168.0.10. That's quite weird, because you usually give a public IP to all devices in your network, not to just one host.

If the inside global IP address is indeed my public IP address, can't I just change my public IP? I guess it has to be configured in the NAT of my home router. If it's not possible, is it just because the router firmware doesn't provide a way to change that IP?

---

Basically I've seen two ways of doing NAT:

1. Translating private IP of my host to the public IP of my router with a special port number (that allows the inverse translation back to my private IP to happen when the other host sends a reply).

2. Translating private IP of my host to a public IP that's different from the public IP of my router. The problem is - how does my NAT router know that his public address used for translation isn't already used by some other host on the Internet?

Do these two methods have different names?

Answer 1

The two kinds of NAT your question is referring to can be categorized as destination NAT, and source NAT.

Destination NAT will typically change a connection to your router from the ISP direction to a destination target that's inside your network. It's also commonly referred to as port forwarding. This lets you expose a service that would normally be inaccessible inside your private network.

Source NAT will change a connection through your router from your local network to a source target that is the router itself, allowing multiple hosts to use a single public address.

NAT can perform other translations, but few others are useful except in niche cases. Despite the phrasing in your question, a source NAT that you describe is not helpful. Using a global address that is not functional on the router will have no good effect. No other device or protocol would keep track of that, so all replies will be forwarded to the device that should have that IP, which would know nothing about your setup and promptly drop them. If you want to use a different IP, get it set up and functional on the router first.

Answer 2

We aren't going to discuss home routers because home networking and consumer-grade equipment are specifically off-topic, as are question from ISP end-users.

Now, my router is connected to a network of my ISP. It has some IP address in that network, but that address is different than what my public IP address is, right?

Your router will have an IP address assigned by the ISP which is normally a (your) public IP address unless the ISP is using CGN.

That's quite weird, because you usually give a public IP to all devices in your network, not to just one host.

You may want to expose one device like a web server (or load-balancer for a group of servers).

If the inside global IP address is indeed my public IP address, can't I just change my public IP?

You should never use a public address which doesn't belong to you; you will find yourself cut off from the Internet. You may be assigned a block of public IP addresses, and you can use those in any way you want, but using public IP addresses not assigned to you can cause all sorts of problems, and you won't like the results.

If it's not possible, is it just because the router firmware doesn't provide a way to change that IP?

You can set any valid IP address (public or private) on any router interface, as long as the networks on router interfaces don't overlap or conflict.

Basically I've seen two ways of doing NAT:

Then you haven't really seen much of NAT. See this question, What do these three options in a Cisco Router NAT configuration mean?, for more explanation about NAT.

1. Translating private IP of my host to the public IP of my router with a special port number (that allows the inverse translation back to my private IP to happen when the other host sends a reply).
2. Translating private IP of my host to a public IP that's different from the public IP of my router. The problem is - how does my NAT router know that his public address used for translation isn't already used by some other host on the Internet?

Do these two methods have different names?

Your number 1 could be Inside Source or Inside Destination. You aren't very clear on it.

Your number 2 could be Inside Source using a pool of public IP addresses.

Answer 3

I am going to answer this from iptables nat table point of view.

First method is called MASQUERADING, in which you translate all your private IP addresses with the public IP of outgoing interface (with different source port numbers for reverse translation).

Second method is what you call source nat or SNAT. You have a pool of public addresses and your private IP addresses are translated using these pool of addresses. PAT can also occur in this case, when the number of connections translated is greater than the pool size.

how does my NAT router know that his public address used for translation isn't already used by some other host on the Internet?

You DON'T USE any public address for NAT translation that isn't assigned to you (Otherwise, reply packets for that connection won't reach you).