4

http://packetlife.net/blog/2010/jan/7/understanding-nat-address-types/

Let's say I have a bunch of hosts connected to a typical router (which is in fact a switch + router) that has a public global IP assigned by my ISP.

The hosts use private IPs that are non-routable addresses, and need to be translated using NAT to the public one so that it can talk with the rest of Internet.

Now, my router is connected to a network of my ISP. It has some IP address in that network, but that address is different than what my public IP address is, right? - it follows from the article linked above:

by this command:

ip nat inside source static 192.168.0.10 192.0.2.10

which assigned a public IP (in other words, inside global IP) 192.0.2.10 to the host 192.168.0.10. That's quite weird, because you usually give a public IP to all devices in your network, not to just one host.

If the inside global IP address is indeed my public IP address, can't I just change my public IP? I guess it has to be configured in the NAT of my home router. If it's not possible, is it just because the router firmware doesn't provide a way to change that IP?


Basically I've seen two ways of doing NAT:

  1. Translating private IP of my host to the public IP of my router with a special port number (that allows the inverse translation back to my private IP to happen when the other host sends a reply).

  2. Translating private IP of my host to a public IP that's different from the public IP of my router. The problem is - how does my NAT router know that his public address used for translation isn't already used by some other host on the Internet?

Do these two methods have different names?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 7 '17 at 13:43
  • Hi, there are actually 4 types of translations that exist. They all go by different names, but I outline them each here. – Eddie Jun 6 at 17:40
3

The two kinds of NAT your question is referring to can be categorized as destination NAT, and source NAT.

Destination NAT will typically change a connection to your router from the ISP direction to a destination target that's inside your network. It's also commonly referred to as port forwarding. This lets you expose a service that would normally be inaccessible inside your private network.

Source NAT will change a connection through your router from your local network to a source target that is the router itself, allowing multiple hosts to use a single public address.

NAT can perform other translations, but few others are useful except in niche cases. Despite the phrasing in your question, a source NAT that you describe is not helpful. Using a global address that is not functional on the router will have no good effect. No other device or protocol would keep track of that, so all replies will be forwarded to the device that should have that IP, which would know nothing about your setup and promptly drop them. If you want to use a different IP, get it set up and functional on the router first.

  • I've done some more searching and it looks like the 2st method is NAT, but the 1st method is actually PAT (port address translation). See here. – user4205580 Dec 6 '15 at 15:36
  • @user4205580 Not really. PAT is a common function within NAT, port numbers are regularly changed by NAT to avoid conflicts for TCP/UDP in it's translation table, usually on a many-to-one translations like SNAT. DNAT as a largely one-to-one translation actually has the least chance to change a port number unless it's explicit, but setup of DNAT tends to focus people's attention on the necessary port numbers to properly run a service, (thus "port forwarding", since forwarding all ports is network & security hell). Either that or a vendor picked a misleading name at some point. – Radhil Dec 6 '15 at 15:59
  • Umm, that's weird. Watch the part at 17:34 of that video about NAT, and then the PAT example at around 20:00. It turns out I meant PAT in my 1st example (the router doesn't change the source IP address, instead it assigns a special port number to it to distinguish the hosts in my network in case a reply from the Internet arrives). NAT is what I meant in the 2nd example - it takes the source private IP of a packet and changes it to a public IP. It's a problem because we would have to map our internal private host IPs to public IPs, what a waste... – user4205580 Dec 6 '15 at 16:12
3

We aren't going to discuss home routers because home networking and consumer-grade equipment are specifically off-topic, as are question from ISP end-users.

Now, my router is connected to a network of my ISP. It has some IP address in that network, but that address is different than what my public IP address is, right?

Your router will have an IP address assigned by the ISP which is normally a (your) public IP address unless the ISP is using CGN.

That's quite weird, because you usually give a public IP to all devices in your network, not to just one host.

You may want to expose one device like a web server (or load-balancer for a group of servers).

If the inside global IP address is indeed my public IP address, can't I just change my public IP?

You should never use a public address which doesn't belong to you; you will find yourself cut off from the Internet. You may be assigned a block of public IP addresses, and you can use those in any way you want, but using public IP addresses not assigned to you can cause all sorts of problems, and you won't like the results.

If it's not possible, is it just because the router firmware doesn't provide a way to change that IP?

You can set any valid IP address (public or private) on any router interface, as long as the networks on router interfaces don't overlap or conflict.

Basically I've seen two ways of doing NAT:

Then you haven't really seen much of NAT. See this question, What do these three options in a Cisco Router NAT configuration mean?, for more explanation about NAT.

  1. Translating private IP of my host to the public IP of my router with a special port number (that allows the inverse translation back to my private IP to happen when the other host sends a reply).
  2. Translating private IP of my host to a public IP that's different from the public IP of my router. The problem is - how does my NAT router know that his public address used for translation isn't already used by some other host on the Internet?

Do these two methods have different names?

Your number 1 could be Inside Source or Inside Destination. You aren't very clear on it.

Your number 2 could be Inside Source using a pool of public IP addresses.

  • In both cases I meant translation of source address (inside source). Isn't it true that 1. is called PAT (Port Address Translation), whereas 2. is NAT? This is what I've figured out some time later. – user4205580 Dec 6 '15 at 20:46
  • @user4205580, in the Cisco world, PAT is triggered by the overload keyword. That means you have more addresses to translate than you have addresses to which you can translate. Number 2 can also be PAT because you can have a pool which is smaller than the number of inside addresses which get translated. NAT/PAT is a very large subject with a bunch of different configurations depending on the problem you are trying to solve. – Ron Maupin Dec 6 '15 at 21:10
2

I am going to answer this from iptables nat table point of view.

First method is called MASQUERADING, in which you translate all your private IP addresses with the public IP of outgoing interface (with different source port numbers for reverse translation).

Second method is what you call source nat or SNAT. You have a pool of public addresses and your private IP addresses are translated using these pool of addresses. PAT can also occur in this case, when the number of connections translated is greater than the pool size.

how does my NAT router know that his public address used for translation isn't already used by some other host on the Internet?

You DON'T USE any public address for NAT translation that isn't assigned to you (Otherwise, reply packets for that connection won't reach you).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.