Questions tagged [nat]

For questions about Network Address Translation (NAT), a method of modifying network address information in IPv4 packet headers.

Filter by
Sorted by
Tagged with
65
votes
7answers
19k views

Why are IPv4 addresses running out?

I understand that we are running out (or ran out already?) of IPv4 addresses, but I don't really understand why that is. Right now, every home has its own IPv4 address (dynamically assigned, but still,...
21
votes
3answers
4k views

CEF operations on L3 switch vs router

I understand that L3 switches use CEF for faster packet forwarding. However, CEF will not work for packets that need to undergo NAT. Does this mean CEF isn't used by edge routers and edge L3 switches? ...
17
votes
6answers
25k views

IPv4 Segment 100.64.0.0/10

I recently got to know that IP segment 100.64.0.0/10 has been reserved by IANA for 'Shared Address Space'. My question is: Can I use the IP Segment 100.64.0.0/10 as a private range in my network (...
13
votes
2answers
29k views

Open a range of TCP ports in Cisco IOS NAT

ip nat inside source static 192.168.1.10 10.10.10.9 route-map RANGE ! route-map RANGE permit 100 match ip address 102 ! access-list 102 permit tcp host 192.168.1.10 range 3000 3389 any The ...
12
votes
2answers
4k views

How NAT / PortForwarding / TCP/IP works?

I recently read an article entitled how NAT works. Some things still remain unclear to me. I would be thankful if someone could explain. Below is the part of the article regarding DynamicNAT that is ...
12
votes
4answers
29k views

What layer of the OSI model does NAT work?

Simple question and the answer is layer 3 of course, but can we say that PAT is working on layer 4 also because it deals with port numbers which is a layer 4 function? Or is it only a layer 3 ...
12
votes
2answers
6k views

How does the router know how to route the packets to my terminal?

Suppose I have a network of 2 computers, each having a private network address of 192.168.1.101 and 192.106.1.102. For my public ip address, it is 10.2.10.172. When I make a http request to google....
11
votes
2answers
6k views

Cisco ASA double NAT with DNS translation

I'm trying to set up double Auto NAT with DNS translation on Cisco ASA 9.0(3), and I'm having a few challenges with the DNS portion. I got double NAT working correctly, such that I have a server in ...
10
votes
3answers
8k views

interpreting ping results

I'm pinging yahoo.com and am I'm puzzled by the result. C:\Users\jon>ping -t yahoo.com Pinging yahoo.com [98.138.253.109] with 32 bytes of data: Reply from 98.138.253.109: bytes=32 time=195ms TTL=...
10
votes
4answers
22k views

Using IP addresses from IP pool given by ISP

My ISP says that it can provide an optic fiber connection with a pool of 4 static IP addresses (subnet 255.255.255.248 i think). My question is that if I get that connection, 1 ip will be used for ...
10
votes
1answer
4k views

How does NAT share one public IPv4 address across multiple private IPv4 addresses [closed]

I think it's a very classical question, but, thought I've have some background, I don't have enough vocabulary anymore to search and understand correctly in the Web. Let's say I have a home network ...
10
votes
2answers
3k views

What do these three options in a Cisco Router NAT configuration mean?

In a standard Static PAT configuration, where one IP:Port combination is always mapped to another IP:Port combination, there are three possible combinations of inside/outside/source/destination that ...
9
votes
2answers
2k views

Is there anything stopping me from using Class A addresses on my own network?

I've been reading about IPv4, networking, subnetting and the different classes of addresses. I understand that IP addresses beginning with numbers from 1 to 126 are considered "Class A" addresses. ...
9
votes
3answers
1k views

routing between vlans not working

I need to put a Cisco router behind an ISP router. (The ISP doesn't allow us to use their modem only.) I've called the ISP technical service and they've set up the connection with me. Their router ...
9
votes
1answer
2k views

How does NAT Stitching work?

While reading about CISCO NetFlow Analysis I came up with a term named NAT Stitching. I understand Flow Stitching which join same type of inbound and outbound connection. But can't find anything ...
9
votes
2answers
8k views

pfSense multi-wan Bridge, NAT, Load balancing and CARP

Context I currently have : 1 pfSense 2.0.2 router (on a Firebox X-Peak X5000) 2 WAN 1 LAN 3 Servers My interfaces WAN1 68.XX.XXX.98 to 69.XX.XXX.102 WAN2 65.XXX.XXX.58 to 66.XXX.XXX.62 LAN 192.168....
9
votes
3answers
3k views

Cisco NAT hairpinning

I have a Cisco router configured NAT (4 static NAT and dynamic NAT). My problem is that I can't access internal servers using public IP addresses from the internal network. I know what the problem ...
8
votes
6answers
4k views

Could IPv6 make NAT / port numbers redundant?

From what I can tell, each process could get its own IP address, with loads of IP's to spare. What would the drawbacks be? Essentially, your host would become a router and each process is a host (in ...
8
votes
2answers
10k views

why STUN doesn't work with symmetric NAT?

I read this line from wikipedia. "STUN does work with three types of NAT: full cone NAT, restricted cone NAT, and port restricted cone NAT. In the cases of restricted cone or port restricted ...
8
votes
1answer
8k views

How `UDP Hole Punching` Works?

Can anyone explain how UDP hole punching works in a simple way? I know how NAT and PAT works, but can't get a clear idea about UDP hole punching.
8
votes
1answer
7k views

About the inside local and outside local and inside global and outside global

I have some concept problem with the NAT. Here is the Cisco definition for the local and Global and the NAT operation. Local address—A local address is any address that appears on the inside ...
8
votes
4answers
4k views

Does IPv6 remove the need for a VPN?

I know that a VPN may be used in lots of different ways for lots of different things, so I'm not suggesting that IPv6 removes the need for a VPN completely. I'm interested in one particular use-case: ...
8
votes
2answers
3k views

How does NAT work with incoming UDP packets from unknown IP

Apologies in advance for the relatively noob question and if this is off topic here ( I am not sure...) The situation is that I have a UDP client and server bound to the same port. My understanding ...
8
votes
2answers
6k views

How to host server in DMZ zone of an ASA

I have an ASA5525-X with 9.1.2. On it are several interfaces, but primarily I'm looking at: (fake subnets) inside 10.0.0.0/24, security level 100 outside 10.0.200.0/24, security level 0 DMZ 10.0.100....
8
votes
1answer
1k views

NAT VLANs with same IP Subnets

I have a VMware environment in which VMs are running a simulation suite. The software used has hardcoded IP addresses, about 10-15 VMs, and we are running multiple instances of this software each in ...
8
votes
2answers
2k views

SNAT vs PBR for Server Load Balancing

In an one-armed SLB configuration, SNAT is used to force return-traffic to pass through the SLB. This has one negative: simply that web logs cannot capture the true client IP unless passed in XFF (X-...
8
votes
4answers
13k views

ASA use of proxy ARP for NAT

I will be performing NAT on the outside interface of an ASA to a web server within a DMZ. I would like to disable proxy-arp on all the interfaces that I can. I know that outside interface will need to ...
8
votes
1answer
2k views

UDP hole punching NAT port

I just read an article about the process of "punching holes" with the UDP protocol. I understand how it's done, but I have one last question to clear up things. We have the rendezvous server and ...
8
votes
2answers
10k views

Source NATing Fortigate typical scenario

I have a small query with respect to NATing in Fortigate.I'm struck in particular by a scenario where the remote network allows users with a specific IP range with a specific port for RDP over a ...
8
votes
5answers
7k views

Cisco Static NAT with route-maps

Update: Seems that route maps only match on IP addresses, not on the ports. Had another situation this week on a different device, model and software version. Ended up changing the NAT statements to: ...
8
votes
2answers
7k views

NAT with VPN Site to Site and Remote LANs with same IP address

I have a ASA5510 to connect clients to my company. I use a site-to-site IPSec VPN with a variety of vendors on the other side (Cisco, Sonicwall, Zyxel, Checkpoint, etc...). For every remote LAN, I ...
7
votes
3answers
4k views

How does NAT decide which connections are inbound, and which are outbound?

I'm building a P2P application that needs to be able to access nodes behind a NAT. This NAT does not allow inbound connections, therefore the nodes outside the network cannot reach out to the nodes ...
7
votes
2answers
18k views

Cisco ASA 8.4(3); NAT multiple ports on public IP to private IP

I have the following configuration on an ASA running 8.4 already; object network SERVER-01 host 192.168.0.1 ! object network SERVER-01 nat (Inside,Outside) static interface service tcp 3389 5001 I ...
7
votes
1answer
701 views

How does UDP NAT Know When To Remove The Rule

So say you are a user behind a NAT/router on an internal network. You begin sending UDP data to an internet-facing server. The packet hits your router, it inserts an entry to allow returning packets ...
7
votes
2answers
2k views

NAT Overlapping

I am trying to do some networking lab. Basically, I have a network like this: So, is it possible to configure NAT router in such way, that PC1 and PC2 can access remote HOST and each other. The ...
7
votes
3answers
161 views

Is IP address Subnet Renumbering needed here?

We have a router with NAT enabled on our edge. The NAT inside is 10.0.0.0/24. Now, we're running out IP blocks and we wish to change this to 10.0.0.0/22. We can do this quickly on the NAT router. But ...
7
votes
4answers
7k views

How to make IPSEC over double NAT?

I need to have a site to site VPN between two sites. Here is the following topology for each site: Site A: One Cisco 1921 WAN port (192.168.3.2) connected to ISP router (192.168.3.66), both the ...
7
votes
1answer
3k views

Problem with VPN tunel from remote location through ISP (PPTP)

I have network situation like this: ISP Router (modem) - device given to us by our ISP - modem & router in one but it is set into transparent mode - ISP say so ;D we have to find it that it is ...
7
votes
2answers
3k views

Cisco ASA: Why does static NAT block access through VPN? [closed]

TL/DR I set up a static nat rule, so that I can use my public internet IP address to directly ssh into a dedicated machine on the inside network. As a result I cannot ssh into the dedicated machine ...
6
votes
3answers
2k views

Does NAT violate end to end argument?

Does NAT violate end to end argument? What does end to end argument means in this context?
6
votes
3answers
2k views

How is NAT a hack?

Forgive me if this sounds a little amateurish, or if this is the wrong stackexchange, but...most of my entirely life I've had ipv4 behind a NAT router. I've been told that this was a hack; simply ...
6
votes
4answers
429 views

60 devices on a /29 network

My company asked me to set up a network with 60 devices (all have MAC addresses and use IPs, but they are not all computers), there is a 3rd party company that will maintain the network. They are ...
6
votes
5answers
7k views

Why does NAT translate a source port?

I’m beginning to learn about nat and I was wondering why does NAT translate a source port? Doesn’t a port represent an application that’s requesting a service? So why must it be translated? Also what ...
6
votes
2answers
2k views

PPPoE with NAT configuration broken

We are trying to replace our existing router with a newly purchased Cisco router: GigabitEthernet0/0: PPPoE GigabitEthernet0/1: 192.168.2.1 The PPPoE is getting established perfectly, and I can ping ...
6
votes
1answer
4k views

Traceroute to an internet address when I'm behind a Dynamic-PAT firewall?

Consider this network diagram: In this scenario, the router is performing "Dynamic PAT" (I'm using Cisco's definition) where all "real" or "inside" addresses are mapped to a single outside address ...
6
votes
2answers
4k views

NEWBIE: How can two computers communicate if they are behind firewalls?

This is something I have wondered for awhile and couldn't find answer of. Apologies for the stupid question, but here it goes: If two computers have static IP's then they can easily send each other ...
6
votes
2answers
736 views

How does NAT work for large private networks?

NAT works by maintaining a mapping table between (internal IP, internal port) and (external IP, external port). But both UDP and TCP has 16-bit port numbers, which means that the table can have at ...
6
votes
1answer
7k views

Cisco ASA 9.0(1) - NAT / PAT

I'm trying to open some ports in my ASA 5505 Firewall with the 9.0(1) software. I've being using another ASA with a lower software version. As you can imagine I'm quite confused and have been reading ...
6
votes
1answer
3k views

HSRP and Static NAT behavior

May I have your opinion on the following matter? Configuration: Two 2911 routers. Doing HSRP on Wan and LAN side with 2 standby groups. Doing static NAT to internal servers. Added redundacy keyword ...
6
votes
3answers
337 views

Network Address Translation fundamentals

Could someone please help me understand the concepts of NAT? I thought I understood how this works, but I'm confused about there being two public addresses, as opposed to just one public internet ...

1
2 3 4 5
12