Network Address Translation

NAT behavior is defined by RFC4787 NAT Mapping

• endpoint independent (SNAT'ed IP and Port are the same)
• address dependent
• address and port dependent

IP Address Pooling

• paired (same external IP for the same internal IP)
• arbitrary

Port Mapping

• no port overloading (2 internal IPs using the same external port)
• ports in range 0-1023 and 1024-65535 are mapped to the same range
• port parity is recommended
  • even ports stay even and odd stays odd

Map Refresh

• must be valid for at least 2 minutes
  • unless destination port is well known then a shorter timer can be used
• recommended at least 5 minutes
• Traffic refresh
  • NAT outbound refresh: must have
  • NAT inbound refresh: maybe

IP Conflicts

• NAT with dynamic external IP must either
  • ensure internal network IP addresses do not conflict with external
  • handle translation/forwarding traffic between internal/external nodes with conflicting IP addresses.

Filtering

• Endpoint-Independent Filtering: any packet from internal to an external IP address will allow any packet back to the internal endpoint
• Address-Dependent Filtering: internal endpoint must first send packets to the specific external IP

Hairpinning

• forwards internal packets destined for an external address, that has an active mapping to an internal address, back to the internal address.
• must use external source IP address and port