0

Let's say that a packet I sent requesting for a https server successfully reaches my target (NAT) router.

The router receives it and through port-forwarding/triggering policies, it knows it has to send to Server-1 with IP address 192.168.0.100 at port 443. But the packet that it received has a L3-Encapsulation of Source Router Public IP(ME) and Destination Router Public IP(THEM). I know that it encapsulates the packet with a new frame, which is a new Source Mac and Destination Mac to send through the LAN and find the correct device. But I've heard the L3-Encapsulation do not change. Is that true?

Does that mean server-1 receives a packet that will just have the old L3-Encapsulation that has two public IP Address, or does it change to its own private IP which is 192.168.0.100 and the router's private IP of 192.168.0.1?

1
  • 1
    "The router receives it and through port-forwarding/triggering policies, it knows it has to send to Server-1 with IP address 192.168.0.100 at port 443." You should not assume a business web site is using NAT in such a way. Many businesses have blocks of public addresses, which are used for their servers.
    – Ron Maupin
    Jun 11 at 17:53
0

Does that mean server-1 receives a packet that will just have the old L3-Encapsulation that has two public IP Address, or does it change to its own private IP which is 192.168.0.100 and the router's private IP of 192.168.0.1?

In the scenario you described, the target (NAT) router modifies the layer 3 information (IP addresses) according to the NAT policy, in addition to removing and replacing the layer 2 information that is done as part of normal routing.

In a typical static NAT, the packet's destination address is modified to match to address of the real server address. The return packet is modified in the reverse way, so that the real address of the server is replaced by the NAT address.

The result is that both the source device and destination server are unaware that NAT is taking place. The source sends the traffic to the NAT address, and the traffic it receives comes from that same address.

The server receives the packet addressed to it, and is unaware that the router modified the destination address.

As other have pointed out, while this is a very common NAT scenario, there are many other ways of using NAT.

3
  • So layer 3 information IS modified when sending from the NAT router to the real server address, but because it keeps on modifying the value back in reverse from the real server all the way back to the source device, the source device will receive a packet seemingly back from the same layer 3 information? Also what are the other ways of using NAT? So far the resources I read online only mention this scenario so far. Thanks! Jun 11 at 18:34
  • Yes, you've got it. There are many resources for NAT on the web that are better than anything we can discuss here. You can even search this site for more info.
    – Ron Trunk
    Jun 11 at 18:47
  • Understood. Thanks! Jun 11 at 19:41
0

... reaches my target router

I assume you mean your WAN router that uses the address that the packet is addressed for (with IPv4 NAT). Normally, the destination is never a router but a host.

But the packet that it received has a L3-Encapsulation of Source Router Public IP(ME) and Destination Router Public IP(THEM).

No. The packet is only encapsulated by an L2 frame (addressed from the last hop router to your current router, usually by MAC). The IP packet in turn encapsulates a TCP segment (or anything else from a higher-layer protocol). Generally, an IP packet is addressed from the source host to the destination host, period.

Only with IPv4 and NAT do you need translation. In your case, there's destination NAT from public IP space to a private host. The NAT router requires a port-forwarding rule. Since the packet is addressed to the router's own public IP and L4 port (fitting the rule), it translates publicIP:publicPort to privateIP:privatePort on the actual server. Then it forwards the packet.

MAC addresses are only required when the packet needs to cross a MAC-based network like Ethernet. The router ARPs the host IP and uses that MAC address as destination for the encapsulating frame.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.