Network Address Translation
Network Address Translation (NAT) is the process where a
network device, usually a firewall, assigns a public address to a
computer (or group of computers) inside a private network. The main use
of NAT is to limit the number of public IP addresses an organization or
company must use, for both economy and security purposes.
The most common form of network translation involves a large private
network using addresses in a private range (10.0.0.0 to 10.255.255.255,
172.16.0.0 to 172.31.255.255, or 192.168.0 0 to 192.168.255.255). The
private addressing scheme works well for computers that only have to
access resources inside the network, like workstations needing access to
file servers and printers. Routers inside the private network can route
traffic between private addresses with no trouble. However, to access
resources outside the network, like the Internet, these computers have
to have a public address in order for responses to their requests to
return to them. This is where NAT comes into play.
Internet requests that require Network Address Translation (NAT) are
quite complex but happen so rapidly that the end user rarely knows it
has occurred. A workstation inside a network makes a request to a
computer on the Internet. Routers within the network recognize that the
request is not for a resource inside the network, so they send the
request to the firewall. The firewall sees the request from the computer
with the internal IP. It then makes the same request to the Internet
using its own public address, and returns the response from the Internet
resource to the computer inside the private network. From the
perspective of the resource on the Internet, it is sending information
to the address of the firewall. From the perspective of the workstation,
it appears that communication is directly with the site on the
Internet. When NAT is used in this way, all users inside the private
network access the Internet have the same public IP address when they
use the Internet. That means only one public addresses is needed for
hundreds or even thousands of users.
Most modern firewalls are stateful - that is, they are able to set up
the connection between the internal workstation and the Internet
resource. They can keep track of the details of the connection, like
ports, packet order, and the IP addresses involved. This is called
keeping track of the state of the connection. In this way, they are able
to keep track of the session composed of communication between the
workstation and the firewall, and the firewall with the Internet. When
the session ends, the firewall discards all of the information about the
connection.
There are other uses for Network Address Translation (NAT) beyond
simply allowing workstations with internal IP addresses to access the
Internet. In large networks, some servers may act as Web servers and
require access from the Internet. These servers are assigned public IP
addresses on the firewall, allowing the public to access the servers
only through that IP address. However, as an additional layer of
security, the firewall acts as the intermediary between the outside
world and the protected internal network. Additional rules can be added,
including which ports can be accessed at that IP address. Using NAT in
this way allows network engineers to more efficiently route internal
network traffic to the same resources, and allow access to more ports,
while restricting access at the firewall. It also allows detailed
logging of communications between the network and the outside world.
Additionally, NAT can be used to allow selective access to the
outside of the network, too. Workstations or other computers requiring
special access outside the network can be assigned specific external IPs
using NAT, allowing them to communicate with computers and applications
that require a unique public IP address. Again, the firewall acts as
the intermediary, and can control the session in both directions,
restricting port access and protocols.
NAT is a very important aspect of firewall security. It conserves the
number of public addresses used within an organization, and it allows
for stricter control of access to resources on both sides of the
firewall.
source :
http://whatismyipaddress.com/nat
Comments
Post a Comment