CS 3700 Networks and Distributed Systems NAT (You Better Forward - - PowerPoint PPT Presentation

▶
cs 3700
SMART_READER_LITE
LIVE PREVIEW

CS 3700 Networks and Distributed Systems NAT (You Better Forward - - PowerPoint PPT Presentation

Oct 02, 2022 480 likes •1.03k views

CS 3700 Networks and Distributed Systems NAT (You Better Forward Those Ports) Revised 10/7/16 The IPv4 Shortage 2 Problem: consumer ISPs typically only give one IP address per-household Additional IPs cost extra More IPs may not

slide-1
SLIDE 1

CS 3700


Networks and Distributed Systems

NAT (You Better Forward Those Ports)

Revised 10/7/16

slide-2
SLIDE 2

The IPv4 Shortage

2

Problem: consumer ISPs typically only give one IP address per-household

Additional IPs cost extra More IPs may not be available

slide-3
SLIDE 3

The IPv4 Shortage

2

Problem: consumer ISPs typically only give one IP address per-household

Additional IPs cost extra More IPs may not be available

Today’s households have more networked devices than ever

Laptops and desktops TV, bluray players, game consoles Tablets, smartphones, eReaders

slide-4
SLIDE 4

The IPv4 Shortage

2

Problem: consumer ISPs typically only give one IP address per-household

Additional IPs cost extra More IPs may not be available

Today’s households have more networked devices than ever

Laptops and desktops TV, bluray players, game consoles Tablets, smartphones, eReaders

How to get all these devices online?

slide-5
SLIDE 5

Private IP Networks

3

Idea: create a range of private IPs that are separate from the rest

  • f the network

Use the private IPs for internal routing Use a special router to bridge the LAN and the WAN

Properties of private IPs

Not globally unique Usually taken from non-routable IP ranges (why?)

Typical private IP ranges

10.0.0.0 – 10.255.255.255 172.16.0.0 – 172.31.255.255 192.168.0.0 – 192.168.255.255

slide-6
SLIDE 6

Private Networks

4

Private Network 192.168.0.1 192.168.0.0 66.31.210.69 192.168.0.2 Internet

slide-7
SLIDE 7

Private Networks

4

Private Network 192.168.0.1 192.168.0.0 66.31.210.69

NAT

192.168.0.2 Internet

slide-8
SLIDE 8

Private Networks

4

Private Network 192.168.0.1 192.168.0.0 66.31.210.69

NAT

192.168.0.2 Private Network 192.168.0.2 192.168.0.1 Internet 192.168.0.0 71.2.33.56

NAT

slide-9
SLIDE 9

Network Address Translation (NAT)

5

NAT allows hosts on a private network to communicate with the Internet

Warning: connectivity is not seamless

Special router at the boundary of a private network

Replaces internal IPs with external IP by modifying packet headers

■ This is “Network Address Translation”

May also replace TCP/UDP port numbers

Maintains a table of active flows

Outgoing packets initialize a table entry Incoming packets are rewritten based on the table

slide-10
SLIDE 10

Basic NAT Operation

6

Private Network Internet 66.31.210.69 74.125.228.67 192.168.0.1

slide-11
SLIDE 11

Basic NAT Operation

6

Private Network Internet

Source: 192.168.0.1:2345 Dest: 74.125.228.67:80

66.31.210.69 74.125.228.67 192.168.0.1

slide-12
SLIDE 12

Basic NAT Operation

6

Private Network Internet

Source: 192.168.0.1:2345 Dest: 74.125.228.67:80

66.31.210.69 74.125.228.67 192.168.0.1

Private Address Public Address 192.168.0.1:2345 74.125.228.67:80

slide-13
SLIDE 13

Basic NAT Operation

6

Private Network Internet

Source: 192.168.0.1:2345 Dest: 74.125.228.67:80 Source: 66.31.210.69:2345 Dest: 74.125.228.67:80

66.31.210.69 74.125.228.67 192.168.0.1

Private Address Public Address 192.168.0.1:2345 74.125.228.67:80

slide-14
SLIDE 14

Basic NAT Operation

6

Private Network Internet

Source: 192.168.0.1:2345 Dest: 74.125.228.67:80 Source: 66.31.210.69:2345 Dest: 74.125.228.67:80

66.31.210.69

Source: 74.125.228.67:80 Dest: 66.31.210.69:2345

74.125.228.67 192.168.0.1

Private Address Public Address 192.168.0.1:2345 74.125.228.67:80

slide-15
SLIDE 15

Basic NAT Operation

6

Private Network Internet

Source: 192.168.0.1:2345 Dest: 74.125.228.67:80 Source: 66.31.210.69:2345 Dest: 74.125.228.67:80

66.31.210.69

Source: 74.125.228.67:80 Dest: 66.31.210.69:2345

74.125.228.67 192.168.0.1

Source: 74.125.228.67:80 Dest: 192.168.0.1:2345

Private Address Public Address 192.168.0.1:2345 74.125.228.67:80

slide-16
SLIDE 16

Advantages of NATs

7

Allow multiple hosts to share a single public IP

slide-17
SLIDE 17

Advantages of NATs

7

Allow multiple hosts to share a single public IP Allow migration between ISPs

Even if the public IP address changes, you don’t need to

reconfigure the machines on the LAN

slide-18
SLIDE 18

Advantages of NATs

7

Allow multiple hosts to share a single public IP Allow migration between ISPs

Even if the public IP address changes, you don’t need to

reconfigure the machines on the LAN

Load balancing

Forward traffic from a single public IP to multiple private

hosts

slide-19
SLIDE 19

Natural Firewall

8

Private Network Internet 66.31.210.69 74.125.228.67 192.168.0.1

Private Address Public Address

slide-20
SLIDE 20

Natural Firewall

8

Private Network Internet 66.31.210.69

Source: 74.125.228.67 Dest: 192.168.0.1

74.125.228.67 192.168.0.1

Private Address Public Address

slide-21
SLIDE 21

Natural Firewall

8

Private Network Internet 66.31.210.69 74.125.228.67 192.168.0.1

Private Address Public Address

slide-22
SLIDE 22

Natural Firewall

8

Private Network Internet 66.31.210.69 74.125.228.67 192.168.0.1

Private Address Public Address

Source: 74.125.228.67 Dest: 66.31.210.69

slide-23
SLIDE 23

Natural Firewall

8

Private Network Internet 66.31.210.69 74.125.228.67 192.168.0.1

Private Address Public Address

Source: 74.125.228.67 Dest: 66.31.210.69

slide-24
SLIDE 24

Natural Firewall

8

Private Network Internet 66.31.210.69 74.125.228.67 192.168.0.1

Private Address Public Address

slide-25
SLIDE 25

Concerns About NAT

9

Performance/scalability issues

Per flow state! Modifying IP and Port numbers means NAT must recompute IP and TCP checksums

slide-26
SLIDE 26

Concerns About NAT

9

Performance/scalability issues

Per flow state! Modifying IP and Port numbers means NAT must recompute IP and TCP checksums

Breaks the layered network abstraction

slide-27
SLIDE 27

Concerns About NAT

9

Performance/scalability issues

Per flow state! Modifying IP and Port numbers means NAT must recompute IP and TCP checksums

Breaks the layered network abstraction Breaks end-to-end Internet connectivity

192.168.*.* addresses are private Cannot be routed to on the Internet Problem is worse when both hosts are behind NATs

slide-28
SLIDE 28

Concerns About NAT

9

Performance/scalability issues

Per flow state! Modifying IP and Port numbers means NAT must recompute IP and TCP checksums

Breaks the layered network abstraction Breaks end-to-end Internet connectivity

192.168.*.* addresses are private Cannot be routed to on the Internet Problem is worse when both hosts are behind NATs

What about IPs embedded in data payloads?

slide-29
SLIDE 29

Port Forwarding

10

Private Network Internet 66.31.210.69 74.125.228.67 192.168.0.1

Private Address Public Address 192.168.0.1:7000 *.*.*.*:*

slide-30
SLIDE 30

Port Forwarding

10

Private Network Internet 66.31.210.69

Source: 74.125.228.67:8679 Dest: 66.31.210.69:7000

74.125.228.67 192.168.0.1

Private Address Public Address 192.168.0.1:7000 *.*.*.*:*

slide-31
SLIDE 31

Port Forwarding

10

Private Network Internet 66.31.210.69

Source: 74.125.228.67:8679 Dest: 66.31.210.69:7000

74.125.228.67 192.168.0.1

Private Address Public Address 192.168.0.1:7000 *.*.*.*:*

slide-32
SLIDE 32

Port Forwarding

10

Private Network Internet 66.31.210.69

Source: 74.125.228.67:8679 Dest: 66.31.210.69:7000

74.125.228.67 192.168.0.1

Source: 74.125.228.67:8679 Dest: 192.168.0.1:7000

Private Address Public Address 192.168.0.1:7000 *.*.*.*:*

slide-33
SLIDE 33

Hole Punching

11

Problem: How to enable connectivity through NATs?

NAT 1

66.31.210.69 192.168.0.1

NAT 2

59.1.72.13 192.168.0.2

slide-34
SLIDE 34

Hole Punching

11

Problem: How to enable connectivity through NATs?

NAT 1

66.31.210.69 192.168.0.1

NAT 2

59.1.72.13 192.168.0.2

slide-35
SLIDE 35

Hole Punching

11

Problem: How to enable connectivity through NATs?

NAT 1

66.31.210.69 192.168.0.1

NAT 2

59.1.72.13 192.168.0.2

slide-36
SLIDE 36

Hole Punching

11

Problem: How to enable connectivity through NATs?

NAT 1

66.31.210.69 192.168.0.1

NAT 2

59.1.72.13 192.168.0.2

Two application-level protocols for hole punching

STUN TURN

slide-37
SLIDE 37

STUN

12

Session Traversal Utilities for NAT

Use a third-party to echo your global IP address Also used to probe for symmetric NATs/firewalls

■ i.e. are external ports open or closed?

66.31.210.69 192.168.0.1

STUN Server

slide-38
SLIDE 38

STUN

12

Session Traversal Utilities for NAT

Use a third-party to echo your global IP address Also used to probe for symmetric NATs/firewalls

■ i.e. are external ports open or closed?

66.31.210.69 192.168.0.1

STUN Server

What is my global IP address?

slide-39
SLIDE 39

STUN

12

Session Traversal Utilities for NAT

Use a third-party to echo your global IP address Also used to probe for symmetric NATs/firewalls

■ i.e. are external ports open or closed?

66.31.210.69 192.168.0.1

STUN Server

What is my global IP address?

slide-40
SLIDE 40

STUN

12

Session Traversal Utilities for NAT

Use a third-party to echo your global IP address Also used to probe for symmetric NATs/firewalls

■ i.e. are external ports open or closed?

66.31.210.69 192.168.0.1

STUN Server

What is my global IP address?

Please echo my IP address

slide-41
SLIDE 41

STUN

12

Session Traversal Utilities for NAT

Use a third-party to echo your global IP address Also used to probe for symmetric NATs/firewalls

■ i.e. are external ports open or closed?

66.31.210.69 192.168.0.1

STUN Server

What is my global IP address?

Please echo my IP address

slide-42
SLIDE 42

STUN

12

Session Traversal Utilities for NAT

Use a third-party to echo your global IP address Also used to probe for symmetric NATs/firewalls

■ i.e. are external ports open or closed?

66.31.210.69 192.168.0.1

STUN Server

What is my global IP address?

Your IP is 66.31.210.69

slide-43
SLIDE 43

STUN

12

Session Traversal Utilities for NAT

Use a third-party to echo your global IP address Also used to probe for symmetric NATs/firewalls

■ i.e. are external ports open or closed?

66.31.210.69 192.168.0.1

STUN Server

What is my global IP address?

Your IP is 66.31.210.69

slide-44
SLIDE 44

Problems With STUN

13

Only useful in certain situations

One peer is behind a symmetric NAT Both peers are behind partial NATs

Not useful when both peers are fully behind full NATs

NAT 1

66.31.210.69 192.168.0.1

NAT 2

59.1.72.13 192.168.0.2

slide-45
SLIDE 45

TURN

14

Traversal Using Relays around NAT

NAT 1

66.31.210.69

NAT 2

59.1.72.13

TURN Server

192.168.0.1 192.168.0.2

slide-46
SLIDE 46

TURN

14

Traversal Using Relays around NAT

NAT 1

66.31.210.69

NAT 2

59.1.72.13

TURN Server

192.168.0.1 192.168.0.2

slide-47
SLIDE 47

TURN

14

Traversal Using Relays around NAT

NAT 1

66.31.210.69

NAT 2

59.1.72.13

TURN Server

192.168.0.1 192.168.0.2

slide-48
SLIDE 48

TURN

14

Traversal Using Relays around NAT

NAT 1

66.31.210.69

NAT 2

59.1.72.13

TURN Server

192.168.0.1 192.168.0.2 192.168.0.1:7000

slide-49
SLIDE 49

TURN

14

Traversal Using Relays around NAT

NAT 1

66.31.210.69

NAT 2

59.1.72.13

TURN Server

192.168.0.1 192.168.0.2 192.168.0.1:7000

slide-50
SLIDE 50

TURN

14

Traversal Using Relays around NAT

NAT 1

66.31.210.69

NAT 2

59.1.72.13

TURN Server

192.168.0.1 192.168.0.2 192.168.0.1:7000

Please connect to me on 66.31.210.69:7000

slide-51
SLIDE 51

TURN

14

Traversal Using Relays around NAT

NAT 1

66.31.210.69

NAT 2

59.1.72.13

TURN Server

192.168.0.1 192.168.0.2 192.168.0.1:7000

Please connect to me on 66.31.210.69:7000

slide-52
SLIDE 52

TURN

14

Traversal Using Relays around NAT

NAT 1

66.31.210.69

NAT 2

59.1.72.13

TURN Server

192.168.0.1 192.168.0.2 192.168.0.1:7000 192.168.0.2:7000

slide-53
SLIDE 53

TURN

14

Traversal Using Relays around NAT

NAT 1

66.31.210.69

NAT 2

59.1.72.13

TURN Server

192.168.0.1 192.168.0.2 192.168.0.1:7000 192.168.0.2:7000