I wondering how does ISP open door for incoming answer from a requesting site since the answer doesn't come from the requesting door, and how to achieve my computer IP since it's behind ISP firewall, and it uses a shared IP.
3
-
If you read about Network Address Translation (NAT), I think the answer will become clear to you. There are many resources available that you can search on.– Ron TrunkFeb 9, 2020 at 15:59
-
The ISP doesn't care about what traffic is going in what direction. The ISP simply routes the packets based on the destination IP address. The firewall is your company firewall, not the ISP. You need to ask your company network administrators about the firewall and how it maintain state.– Ron Maupin ♦Feb 9, 2020 at 16:14
-
You accepted an answer about NAT, but NAT is not a firewall. NAT and firewalls are two completely different things, although it may be convenient to NAT on a firewall, they are not the same thing.– Ron Maupin ♦Feb 9, 2020 at 20:32
Add a comment
|
1 Answer
Assuming the ISP is using carrier-grade NAT (CGN) to route between private IP addresses and the public Internet, the NAT router needs to be stateful - it needs to track all transport-layer connections.
It must remember which remote/local IP/port combination on its public interface map to which private IP/port combination.
For instance:
- client sends SYN from private a.b.c.d:TCP34567 (source) to public server w.x.y.z:TCP80 (destination)
- NAT router creates a new entry in its mapping table and replaces the source a.b.c.d:TCP34567 with its own public e.f.g.h:TCP65432 and forwards the packet
- the public server replies with SYN/ACK to e.f.g.h:TCP65432
- NAT router looks up the mapping in its table and replaces the destination with the original a.b.c.d:TCP34567 when forwarding back to client
- client receives SYN from public server
This repeats for each packet sent between client and server. When the socket is finally closed (or times out), the NAT router deletes the entry from its NAT table.
