Skip to main content

Questions tagged [nat]

For questions about Network Address Translation (NAT), a method of modifying network address information in IPv4 packet headers.

Filter by
Sorted by
Tagged with
1 vote
3 answers
102 views

Trace internal equipement from Internet while answering

I would like to know if it's possible to achieve a traceroute of nodes on an internal network from an equipement on the internet answering to a query. Let's say that a client on an internal network ...
S. Brottes's user avatar
0 votes
2 answers
136 views

Is NAT66 a Viable Option to Protect Client?

Due to the addressing scheme of IPv6, each client now is able to get and directly use Globally-Routable Address (GUA) from the ISP. But that poses bigger security threat because attacker can directly ...
maximillian1's user avatar
1 vote
3 answers
414 views

Combining NAT an tunneling

I was reading a text and a doubt came to mind. Suppose there is an interface in a router that implements NAT. That same interface is the extreme of a tunnel. If I was to send a message through said ...
shaymin shaymin's user avatar
1 vote
1 answer
103 views

How to Mitigate DoS by Bindings/Transport Address Exhaustion in NAT64?

Let's say a NAT64 Router only has 1 IPv4 address for bindings, meaning the NAT64 router has a roughly 65535 IPv4 transport addresses. A malicious attacker can then exhaust the entire IPv4 transport ...
maximillian1's user avatar
0 votes
2 answers
350 views

Why cant't IPSec's Transport Mode ESP be used in NAT64 although ESP doesn't sign the new IP header?

In RFC6146 stated: Any protocols that protect IP header are incompatible with NAT64. This implies that end-to-end IPsec verification will fail when the Authentication Header (AH) is used (both ...
maximillian1's user avatar
1 vote
1 answer
451 views

Why does CLAT in 464XLAT architecture use Stateless NAT64 instead of Stateful?

As of my understanding, stateless NAT is using 1:1 translation, meaning it needs one IPv4 address for one IPv6 address vice versa, thus not preserving IPv4. Since the CLAT is supposed to be router/...
maximillian1's user avatar
2 votes
2 answers
3k views

General: What is a dynamic gateway, how does it work, where is it used?

I saw this option in my OPNsense gateway configuration, and was hoping someone could shed light on what it is, exactly: Dynamic gateway policy: [YES/NO] This interface does not require an ...
Avery Freeman's user avatar
2 votes
1 answer
1k views

Is an IPSec connection between 2 devices behind NAT possible?

We have tens of IPSec connections between our office and customer site's. We use an extra router in the customer network (so behind NAT) to initiate the connection to our office where a PFSense router ...
CodeNinja's user avatar
  • 219
0 votes
1 answer
229 views

How to connect to a machine which is sitting behind NAT router?

I have a server that needs to push a message to a client from which it received a request a few days ago. Now request which was received has the IP address of the NAT router behind which the client ...
Atharwa Adawdakar's user avatar
0 votes
2 answers
778 views

Cisco Port forward ip nat inside source static ... Invalid

This is almost the same question as How to setup port forwarding on Cisco Router running Version 15.2(4)M6. The problem is that the command used in the answer is not available: ip nat inside source ...
ahab's user avatar
  • 1
0 votes
1 answer
64 views

Why does my enterprise issue me a public IP address instead of just a private IP address?

Let's say I work for a big enterprise organization. When looking at my IP address, I notice that it is not a private IP address but is instead a public IP address. What are the benefits of ...
Izzo's user avatar
  • 167
0 votes
2 answers
76 views

NATTing a server address

I need help writing NAT rule for this use case: I want to be able to connect to an local IP as though it's the remote server IP. e.g. port forwarding. I don't have access to the firewall on the remote ...
user avatar
0 votes
1 answer
893 views

Cisco NAT - Overload PAT and Static nat from one inside to two outside interfaces

i have following setup Cisco ISR4k Router with one inside LAN interface and two outside Interfaces. ---- WAN1 (NAT outside) LAN (NAT inside) -- ISR4k | ...
Andreas Schaefer's user avatar
1 vote
4 answers
503 views

port address translation

I was reading about different type of NETWORK ADDRESS TRANSLATION (NAT) techniques from a book, and was reading about a special type of NAT that is called port address translation, and it's known that ...
aud098's user avatar
  • 113
0 votes
1 answer
5k views

Destination NAT on Cisco ISR

I know how to perform regular overload PAT in my lab running sh ver Cisco IOS XE Software, Version 16.03.09 Cisco IOS Software [Denali], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.3.9, ...
o8uijoipjasdfjiloasdfjl32's user avatar
0 votes
2 answers
130 views

IPSEC between two offices with SAME local networks. How should I do nat? [duplicate]

I have two spokes with same local networks and want to do IPSEC between them. When I try to ping 172.17.214.111 from 192.168.5.0 (from right side to left side) I see packet on Cisco router and I see ...
Vladimir Fomin's user avatar
1 vote
1 answer
2k views

PAT with multiple VLAN

I've set up a network with 4 VLAN, 3 VLAN configured PAT on it and 1 VLAN configured STATIC NAT. The router is acting as the DHCP server. Outside of my router I have another router acting as "the ...
Wahaz's user avatar
  • 11
0 votes
2 answers
60 views

Two PC on the same LAN, communicating the same Server

Assume that we have 2 pc on the same LAN, local IP of pc1: 192.168.1.5 local IP of pc2: 192.168.1.6 Now suppose that both pc1 and pc2 wants to connect to a server on the internet, we all know that the ...
X Y's user avatar
  • 103
0 votes
1 answer
83 views

Public IP address does not work in internal network [closed]

I have configured port forwarding to my system from the router configuration menu, when I try to access the public IP address in the internal network it does not respond but it is accessible outside ...
Googlian's user avatar
  • 101
0 votes
2 answers
110 views

Possible typo in Tanenbaum's book about NAPT

From what I have understood from multiple sources (web and other books) about the concept of NAPT (also called NAT overload or IP masquerading in Linux environment), if there is a scenario like the ...
Giuseppe's user avatar
2 votes
2 answers
338 views

Static NAT and PAT

I have two private IP addresses, want to make them NAT to 203.0.113.0/2 public IP address. WAY 1 : Static NAT (2 ip addresses NATted to one by manually) WAY 2 : PAT (Router gives port number ...
CoderBoy's user avatar
0 votes
0 answers
115 views

CMTS (DOCSIS 3.0) with CGN (CGNat)

For a new project/building I am working with the CMTS model MA5633-XB10 by Huawei. The usual way is done by implementing two DHCP servers in the same VLAN, from which the CPE gets the private IP ...
vega's user avatar
  • 1
2 votes
2 answers
4k views

What happens when a NAT router reaches its 65,535 connection limit to a specific destination?

If a company of thousands of end points all try to access a specific destination (let's say google.com), then the maximum TCP connections it can have in total is limited to 65535 connections, based on ...
Pineapple29's user avatar
14 votes
3 answers
23k views

Why is symmetric NAT called "symmetric"?

After searching a while, I'm still not able to find a logical explanation on why is it called symmetric NAT. Where lies the link between symmetric NAT and that each request is mapped to a unique ...
marc's user avatar
  • 243
0 votes
2 answers
694 views

Cisco router on a stick with public ip wan (ISP)gateway

I am trying to create a router on a stick with an outside facing sub-interface with a public IP from an ISP. I have tried to configure NAT and routing but I just cant get to ping the internet. I'm ...
Kha Kali's user avatar
0 votes
1 answer
265 views

Issue w/ Cisco router and failed NAT and static default route

I have a cisco router that is using a VRF to support a site to site VPN tunnel. I have added a second network to the router for non-VPN standard internet use. My problem is that my default static ...
Drew Jackson's user avatar
1 vote
2 answers
232 views

How Does Network Address Translation Work Initially at the End Point Router

I have come across a question that I can not seem to get a quality answer to. I understand how NAT works when a reply packet is received and how it is mapped back to an internal IP address from the ...
B. Lowe's user avatar
  • 11
0 votes
1 answer
499 views

Static port forward 1194 to VPN server behind Cisco router

I'm trying to setup a VPN server behind a Cisco router which is my main internet gateway. I've set it up as shown in the attached picture. The problem I'm observing is that zero packets with a ...
dutsnekcirf's user avatar
0 votes
2 answers
110 views

Why doesn't NAT drop packets with spoofed public source IP?

As I read on Section 4.3.8 of this page https://www.manrs.org/isps/guide/antispoofing/, The following code: ip nat inside source list INSIDE pool OUTSIDE overload will translate packets with a ...
Harsh Gondaliya's user avatar
2 votes
1 answer
521 views

Cisco ASA NAT/PAT Multiple WAN IPs

I'm trying to setup a NAT / PAT in ASA 5520, I'm able to do so very well when the Public IP I want translated to Internal host is configured on the Outside. Question is the ISP provided 1.1.1.1/30 ...
rgomez's user avatar
  • 65
0 votes
1 answer
95 views

Why does Network address translation (NAT) need Port Address Translation (PAT) if IPs are different in the internal network?

For example, there are several servers in the local network 192.168.0.1, 192.168.0.2, 192.168.0.3, etc. They are connected to one public IP. Why does NAT also assign ports to each local IPs that are ...
t7e's user avatar
  • 103
0 votes
3 answers
147 views

Do NAT devices need to have private IP addresses?

If a NAT's job is to create mappings between internal ip/port pairs and external ip/port pairs with one Internet-routable IP address, does a NAT need a private IP address for itself? I think one ...
trainsushi's user avatar
3 votes
1 answer
581 views

Cisco ASA static nat one-to-many from interface address to object-group

Syntactically, the following set of statements is valid (at least as of 8.3): interface Ethernet0/0 nameif OUTSIDE ip address 192.0.2.1 255.255.255.0 interface Ethernet0/1 nameif INSIDE ip ...
jimbobmcgee's user avatar
2 votes
1 answer
606 views

Prevent static NAT to respond to ARP requests

We are trying to merge 2 networks with overlapping IP spaces: This is the configuraiton so far: interface Tunnel1 description VPN Port CompanyA ip vrf forwarding LAN ip address 172.18.0.79 255.255....
Mario Jost's user avatar
  • 1,729
1 vote
2 answers
178 views

Segregated network - managed switch or router?

I have 3 pc connected to a switch that is connected to a bigger network. I want those pc to live in their network and don't expose their ips. (in this very moment the scope is accomplished using a pc ...
EisenRm's user avatar
  • 23
1 vote
2 answers
125 views

When a packet is received, how does it know which internal machine to send it to?

I am familiar with ARP and routing, but I think I am failing to put two and two together here. On an IPv4 packet we have the source IP address, which allows any router to send the response back to the ...
J.Doe's user avatar
  • 11
0 votes
2 answers
458 views

Why can some people use public ip address to access a server from an internal network with the client device within the internal network [duplicate]

As the title suggests. I find it mind breaking to think how network architecture can differ to allow/not allow using public IP address to access a server within internal network from within the ...
lpydawa's user avatar
  • 265
0 votes
0 answers
10 views

Ipsec connection and nat only one site [duplicate]

There are two companies and two of them connected to each other with İPsec vpn. Company A has a server and company B want to reach to company A server. Which company need to configure nat on its ...
Serdan's user avatar
  • 1
1 vote
1 answer
215 views

When is NAT Masquerading required?

I'm learning about NAT Masquerading and I'm a bit confused about when you would want to Masquerade. I've seen examples of using an interface for a VPN tunnel and how something like that on a router ...
Chaos's user avatar
  • 113
3 votes
1 answer
173 views

Packets lost with correct TCP sequence number. Is it possible?

I'm analysing some communication issues that we have between a server (SCADA) and remote terminal units (RTU) that we have in the field. The communications are IEC104 protocol which use TCP/IP. The ...
Qlex's user avatar
  • 33
0 votes
0 answers
406 views

NAT overload and access to web resources

I have really bizarre problem in clients network. Clients have access to the internet via NAPT - I'm using several public ip addreses for this purpose. (I'll change ip addresses for obv reasons) ip ...
vudex's user avatar
  • 45
0 votes
3 answers
2k views

Single-homed connection to ISP without NAT feature

Is it possible to connect my private network to the ISP router without a Network Address Translator (NAT) feature enabled on my router? As I understand, in a single-homed scenario connection to ISP, ...
A.A's user avatar
  • 551
0 votes
1 answer
188 views

Is performance worse routing between two vlans on one interface than routing between two NICs with no vlans?

I have a Linux router with one interface that is connected to a switch in port 2. Port 2 on the switch is a member of vlan2(ISP) and vlan3 (office devices). My router is currently routing between ...
Tek's user avatar
  • 125
6 votes
3 answers
4k views

Does NAT violate end to end argument?

Does NAT violate end to end argument? What does end to end argument means in this context?
Rumesh Madhusanka's user avatar
2 votes
0 answers
142 views

How to configure an ACL on ASA when the inside source IP address is translated by NAT? [closed]

I don't know how to configure an ACL when inside source nat is enabled. In my example, I want to realize bidirectional communication with TCP port 30000 between 172.16.100.100(inside) and 10.10.10.10(...
masafumi_from_Japan's user avatar
1 vote
1 answer
3k views

Active Directory and DNS over NAT

I'm planning to apply the network address translation on a router between hosts and AD/DNS server in an organization. It seemed that this scenario is complicated for a private network. The topology ...
user53815's user avatar
  • 123
3 votes
3 answers
844 views

BGP and NAT Not working

I have an odd issue with BGP+NAT. I have 2 separate routers and 2 different ISP's. Topology looks like this: ISP1--BGP--> RTR1 \ \--OSPF-- Palo Alto Firewall-- Internal ...
Network Samurai's user avatar
0 votes
1 answer
399 views

LAN to WAN IPv4 address mapped to LAN server through NAT Rules or other

I need to set a rule that allows me to connect BOTH from OUTSIDE the LAN (from the "internet" to the Internal server at IPv4 address 10.64.0.50 via port 22, by running ssh://1.2.3.4 -p 22; AND From ...
Digiman Brunnell's user avatar
0 votes
1 answer
57 views

NAT on the endpoint

NAT is normally performed on the router to translate addresses from one network's address space to another's. Is there ever a reason to perform NAT directly on the endpoint instead? For example, if ...
Fixee's user avatar
  • 115
2 votes
1 answer
1k views

How does NAT ensure that every machine has a unique public IP?

I am trying to understand the distinction between public and private IP addresses in IPv4 networking. The picture I've been told has some problems with it, so I would like to present it here and ask ...
preferred_anon's user avatar

1 2
3
4 5
14