I am studing about NAT Technology And iam unable to understand how NAT router decides to send the response if two devices in the private network has sent request to same server.
Let D1 and D2 be the devices and both sending the request from port x, how it's going to forward the response as the entries in the NAT table is same.
I have tried by searching over the internet but I didn't find the apropriate answer.
Related
Based on my knowledge , I believe following statements are true.
Router can only redirect packet and can interact upto network(internet layer) only.
NAT maps the private ip to public ip. It uses a NAT table in which source private ip is mapped to public ip and also source port is changed with new source port.
My question is regarding NAT function for port . How NAT , that works in router can change something that relates to transport layer(port)?
i.e when the private system sends the source port , how NAT is able to change it with new port before sending it to internet.
I am missing something or maybe I am wrong somewhere . Would appreciate the help.
Thanks
NATs intercept outgoing IP packets (including UDP and TCP) from nodes on the NAT's internal network and can modify the source IP and source port in the UDP and TCP header in place. It will update other fields in the header as well (i.e. checksum).
Similarly, for incoming packets, the NAT will change the destination IP/port after finding an entry in its port mapping table that was created from a previous outbound packet or connection.
As to "how" - it just does. It literally reconstructs a new UDP/TCP/IP header using the exact same payload of what it received. The NAT is registered as the gateway device on the LAN, so all packets bound for the internet will be sent to the NAT's MAC address - if what you are wondering is how the NAT captures the packets to begin with.
In DHCP protocol we have 4 packets named DORA.
first of all client send a broadcast Discovery packet for detecting DHCP server.
Then server send a Offer packet contain ip, subnet and many options and waiting for client.
If client find Offer packet suitable, send a broadcast Request and get ACK or NAK.
But why ?
Why we can't ignore Request packet and replace this way to sending 3 packets.
Discovery, Offer and ACK.
client -> Discovery
server -> Offer
client -> ACK
Why this way is not secure or suitable ?
When the client broadcasts the Discover packet, it may get Offer packets from multiple DHCP servers. The purpose of the Request packet is to say to one of the servers, "I want to use the IP address that you offered to me". If that wasn't sent:
the server whose offered IP the client is going to use wouldn't know not to offer that IP to a different client, and
the other servers wouldn't know that they can offer their IPs to other clients.
Then the final Acknowledge packet tells the client that the server has gotten the Request, and that the client now has the "lease" on the IP address.
This is intended to ensure that:
IP addresses are not wasted because a server thinks the client is using the Offered IP, when the client is actually using a different server's Offered IP.
The same IP is not accidentally leased to two clients at the same ... which causes chaos.
In the variation that you proposed, suppose that the ACK packet from the client to the server is lost. Now the server won't realize that the client is going to use the Offered IP address. A few minutes later, it could then Offer the same IP address to a different client and ... chaos ensues.
Please don't imagine that the people who design internet protocols are dullards. They have thought these things through carefully before they write the RFCs. And many other (equally smart) people have gone over the pre-approved RFCs carefully looking for problems. So ... if there is something about a standard protocol that you think is wrong ... it is probably you, and not the protocol designer who is mistaken.
This could not be the right place, as it's not about pure programming;
nevertheless, as a simple web developer I find myself quite
ignorant on the subject of networking(Wikipedia usually mix
different subjects on the matter), and I feel as it is a "must" to know.
I sort of have an image of what happens when you write google.com
on your browser, and I don't know the whole process(I have a modem,
a router and a few computers connected to it. let's use my case for an example):
You write characters into chrome ->
there is some character encoding done to translate the address(ASCII or else) ->
DNS does something, not sure ->
your router receives a digital request from a computer's internet cable/WIFI, it saves the internal IPV4 address of
the sender in order to know to which computer to respond back. it sends the digital data to the modem ->
your modem receives digital data, and translates it from digital to analog ->
now your network provider does some work - >
the google server receives a request from an IP address - >
not sure how the google server handles the data, nevertheless it sends back data ->
service provider - > router gets translated digital data from the modem and remembers who sent the request, and sends it to the right person.
in order to optimize a web server or maybe to write a better code which involves networking, perhaps each beginner(such as myself) needs to understand this first? Thank you for your time.
EDIT: I did read wikipedia's OSI model, though it's not quite as helpful as I thought it would.
i will try to explain the idea, although its may be much ,more complicate - it depends on how deep you want to go ...
you write "www.stackoverflow.com"
your OS will try to resolve the www.stackoverflow.com to an IP address
since your OS probably cant, it needs to ask a DNS server
assuming you use an external DNS ( say IP=5.5.5.5 and your IP=10.10.10.10 which is on a different networks ), your OS will check if it knows how to reach 5.5.5.5
a default route 0.0.0.0/0 exists on your PC (this is also known as 'default-gw' which includes ALL internet, it points to your local router
an IP packet will be sent to the router MAC address with the DNS IP address in the destination
your router will probably change your private IP address to its own public IP address and will sends it to the ISP
ISP will route it to the internet until it reaches 5.5.5.5 which is the DNS
DNS will reply back resolving stackoverflow.com to an IP address
your PC now knows how to send packets to stackoverflow.com
packet will be sent to stackoverflow ip address (104.16.36.249) to port 80 (http)
stackoverflow web server listen to requests on port 80
once a packet arrives it will generate a response packet
it will send it back to you exactly in the same way
all that traffic can be seen with a network capture utility like wireshark, u can use those commands (windows) to verify...
ping stackoverflow.com
netstat -rn
ipconfig
nslookup
tracert -d
I'm trying to send UPD packets from node A to node B, both are connected to internet through different routers.
I am able to send (and receive) UDP packets between them when they connected on the same network by giving the local destination ip adddress (192.168..) and port number.
Now I'm finding the dynamic ip address of node B using www.whatismyip.com and consider it as w.x.y.z
When I send the packets from A to this destination, I'm unable to receive them at B. I've also setup port forwarding on both the routers.
This is completely new to me. Is there is something else that needs to be done when I want to send packets to a node connected on another network? Please help!!
I can suggest something to check:
Port Forwarding in both the router are configured for the UDP protocol?
If you ping the remote address w.x.y.z, you receive a response? (check if the routers are configured to do so)
Verify also if there are firewall that block the UDP packet that arrives from the Internet (on the routers or on the target machine).
The thing that you can not receive them at B is because NAT will filter all the messages if you haven't build a connection in the netfilter's table. The way to solve the problem is to use a port mapping like UPNP or NAT-PMP. In this way, the destination node's specific port will receive any message from WLAN and send it to this node. But this needs your router support these protocols, if not, maybe you need to use ICE as a realy server to realize it.
I thought I understood the whole thing about NAT etc but now I came to a problem.
First what I assumed:
Because there are not enough IPv4 addresses available we need another system.
The devices of today at home for connecting to the internet are a combination of:
1) A modem at the physical-level to change the type of signals on the wire.
2) A switch at link-level so you can connect multiple computers to the device
3) A router to connect all the computers to the internet and go beyond your home-subnet etc.
4) A NAT to allow all the internal computers to connect to the outside
5) A portforwarder to let connections from the outside to the internal network
What I call a NAT:
When making a request to the outside: the NAT-part of the device changes the source-port and the source-ip of the request coming from an internal computer. The new source-ip will be your public-ip. The NAT-part will hold a record in a table with this mapping: "original-ip, original-port, new-port".
When a reponse comes back, the NAT will check the destination-port and compare this with the new-ports is in his table. If it finds a match the NAT will replace the destination-ip with original-ip and new-port with original-port. As a consequence the response will be forwarded to the internal computer that made the request.
So, the NAT-part is for when a connection is initialized from the inside. When this request traverses the NAT, 2 things are changed: source-ip and source-port.
Then the portforwarder:
This part of the device will accept connections initialized in the outside-world to your network. It will look at the destination-port of the incoming request and by making a rule for that port-number it may change the destination-port and the destination-ip of the request to an internal ip. With these rules a request from the outside can connect to a computer on your internal network and thus the portforwarder changes 2 things: the destination-ip and the destination-port.
A: Before I ask my question, how is this explanation?
Now my problem is with the response after a request came from the outside through the portforwarder. Assume the right rules are made and a request came through portforwarding on an internal computer. So in the portforwarder the destination-ip was changed to the internal-ip of the computer and the destination-port was changed to the port where the service is running on. If this internal-computer is a webserver it will generate a response. So the destination-ip will be the request's source-ip and the destination-port will be the request's source-port. The source-ip will be the internal-ip of the computer and the source-port will be the port of the service.
Now that response has to go to the outside. So I assume it goes through the NAT to the outside?
So after passing the NAT, the source-ip will be the public-ip and the source-port will be random. Now I tested this with wireshark. I contacted a webserver behind a NAT and I saw the reponse was coming from port 80 ?! How is this possible? This indicates that the response of the forwarded request did not pass the NAT?
I rethought the concept and my new hypothesis is that when a connection is initialized from the outside, it will pass the portforwarder and reach the right computer. This will create a response and when this response reaches our "all-in-one"device, this device can recognize it forwarded the request of the response and will not change the source-port.
B: Is this indeed the case or is it done in another way?
Wikipedia says about portforwarding: "The source address and port are, in this case, left unchanged. When used on machines that are not the default gateway of the network, the source address must be changed to be the address of the translating machine, or packets will bypass the translator and the connection will fail." (http://en.wikipedia.org/wiki/Port_forwarding)
This confirms that the response of a forwarded request MUST go through the portforwarder again and not through the NAT so the source-port wont be changed. The portforwarder will change the source-ip to the public-ip.
Can someone verify this or give me another explanation than mine?
Now I tested this with wireshark. I contacted a webserver behind a NAT
and I saw the reponse was coming from port 80 ?! How is this possible?
This indicates that the response of the forwarded request did not pass
the NAT?
The webserver inside the NAT does not have to be running on port 80. It certainly is set up at the NAT to port forward and respond as if it were at port 80, but that doesn't mean much about the port the web server is actually running on.
Here is some ASCII "art" that may help.
**Internal Network** **NAT Router** **External Computer**
Web Server running at IP 9.9.9.9 port 80 IP 20.20.20.20
IP 192.168.1.7 port 4567
Request web page at 9.9.9.9:80
Forwards port 80 traffic
to 192.168.1.7:4567
Replies with the web page
Puts 9.9.9.9:80 in the
source field and sends
the page on
Gets the page from "9.9.9.9:80"
even though it actually came
from 192.168.1.7:4567