port address translation

Question

I was reading about different type of NETWORK ADDRESS TRANSLATION (NAT) techniques from a book, and was reading about a special type of NAT that is called port address translation, and it's known that whenever an incoming packet comes from a host to a router(NAT) the router changes it's source ip by its own ip address and removes it's original port number(source) by an arbitrary generated port number by the NAT device,now my question is why do we need to change the source port number? can't a nat router keep original source port unchanged and just only change the source ip?

Answer 1

Assuming router is deployed in network and configure for NAT translation traffic , and is configured with a source NAT which translates any IP address on the Inside network to public ip configure on ergress interface of router IP .Assuming local iP range 10.230.10.0/24 to the public IP address 146.56.78.8 .when outbound traffic is intiàted from inside network of any pc packets with souce ip arrives at router before packet goes outside souce ip is get translated with public ip , and router makes note of the attributes of the original and translated packet in the router’s NAT table

For clear understanding assuming PC1 PC2, each send a packet. They each use their own, unique Private IP address as the Source IP address, and they each randomly select a Source Port.

From 65,500 port numbers that can be chosen, and it is entirely feasible for two different PCs to randomly select the same source port

However configuration of the source NAT does not include a port number. Even though the ports are not explicitly set in the Router’s configuration, this translation is still classified as a PAT because the port is dynamically changed by the NAT device, upon receiving packet, the router translates the source IP address of each packet to 146.56.78.8 and randomly selects a new, unique source port number for each packet 6578, 6543, The router translated the port (PAT) and the Router selected the new source port dynamically every souce ip translated randomly selected port mapping is stored in router NAT table for reference for reverse traffic of same session . When reverse traffic of same session arrive on router router again checks in NAT table and send packet to specific PC on this way responce traffic reaches correct PC in internal network..

If souce port is not allocated randomly by router while translating packet . Responce traffic cannot be destined to correct souce ip in inside network from where traffic is intiàted

Answer 2

Usually, NAT routers provide connectivity for multiple (private address) nodes. Since these nodes don't coordinate the source ports they use, they may use the same source port number simultaneously, even to the same destination.

Since that destination would see the same source IP address (the NAT router's) and the same source port (incidentally), all datagrams would be regarded to belong to the same L4 connection (socket). For TCP as the transport layer protocol, the merged sockets would produce a high number of segment errors, likely killing the connections.

Also, the NAT router would be unable to properly separate the incoming traffic to the original nodes, breaking their connections.

So, most NA(P)T routers use a separate source port for each connection they translate. That ensures that connections can work reliably and simplifies NAT connection management.

Answer 3

Let's assume, your private range is 192.168.0.0/24 and you're public IP address is 1.1.1.1. Your router/modem uses 1.1.1.1 to NAT/PAT out your private range IP address. As per your question, If PC-1, 192.168.0.1, wants to go out to a website(HTTP - TCP 80), in that case, your router will use 1.1.1.1:80, then what will router use when PC-2, 192.168.0.2, needs to go out to a website(HTTP - TCP 80)? If it uses the same source port, then how will it identify the return traffic belongs to PC-1 or PC-2?

To resolve the issue, the router/modem tag each device with a unique port number. In my example, the request from PC-1 will be sent out as 1.1.1.1:1111 and the request from PC-2 as 1.1.1.1:2222. Therefore, in the return traffic, the router looks at the destination port and identifies whether it belongs to PC-1 or PC-2.

Note: IP address: Port Number

Answer 4

There is an answer to your question in this post:

https://networkengineering.stackexchange.com/a/47522/3675

I'll paste the relevant content here:

You are likely referring to a Dynamic PAT -- which is a type of translation which allows any number of internal hosts to share one or more public IP addresses:

In the illustration above, notice all three hosts initiate connections to a destination on the Internet. All three hosts (A, B, and C) select their own source ports randomly (2222, 3333, and 3333, respectively). When their packets traverse the translation device, the router selects new source ports (7777, 8888, 9999, respectively).

This is crucial, because the re-writing of the source port is what allows the return traffic to be forwarded back to the correct initiating host:

The Router made note of the mapping between initial source port and post-translation source port, and uses that to correctly return the response traffic to the correct host.

Had the Router NOT re-written the source ports, both Host B and Host C's return packets would have been to the same destination port:

When those packets would make their way back to the Router, there would be no way for the Router to know which packet should have gone to Host B and which packet should have gone to Host C.

Hence, it is crucial for the Dynamic PAT device to also re-write the source port to ensure the return traffic can be successfully returned to the original host.

To learn more about Dynamic PAT's operation, check out the Dynamic PAT Article in the Network Address Translation article Series