CS 3700 Networks and Distributed Systems NAT (You Better Forward - PowerPoint PPT Presentation

CS 3700   Networks and Distributed Systems NAT (You Better Forward Those Ports) Revised 10/7/16

The IPv4 Shortage 2 � Problem: consumer ISPs typically only give one IP address per-household � Additional IPs cost extra � More IPs may not be available

The IPv4 Shortage 2 � Problem: consumer ISPs typically only give one IP address per-household � Additional IPs cost extra � More IPs may not be available � Today’s households have more networked devices than ever � Laptops and desktops � TV, bluray players, game consoles � Tablets, smartphones, eReaders

The IPv4 Shortage 2 � Problem: consumer ISPs typically only give one IP address per-household � Additional IPs cost extra � More IPs may not be available � Today’s households have more networked devices than ever � Laptops and desktops � TV, bluray players, game consoles � Tablets, smartphones, eReaders � How to get all these devices online?

Private IP Networks 3 � Idea: create a range of private IPs that are separate from the rest of the network � Use the private IPs for internal routing � Use a special router to bridge the LAN and the WAN � Properties of private IPs � Not globally unique � Usually taken from non-routable IP ranges (why?) � Typical private IP ranges � 10.0.0.0 – 10.255.255.255 � 172.16.0.0 – 172.31.255.255 � 192.168.0.0 – 192.168.255.255

Private Networks 4 192.168.0.1 Private Network 192.168.0.2 Internet 192.168.0.0 66.31.210.69

Private Networks 4 192.168.0.1 Private Network 192.168.0.2 Internet NAT 192.168.0.0 66.31.210.69

Private Networks 4 192.168.0.1 192.168.0.1 Private Private Network Network 192.168.0.2 192.168.0.2 NAT Internet NAT 192.168.0.0 71.2.33.56 192.168.0.0 66.31.210.69

Network Address Translation (NAT) 5 � NAT allows hosts on a private network to communicate with the Internet � Warning: connectivity is not seamless � Special router at the boundary of a private network � Replaces internal IPs with external IP by modifying packet headers ■ This is “Network Address Translation” � May also replace TCP/UDP port numbers � Maintains a table of active flows � Outgoing packets initialize a table entry � Incoming packets are rewritten based on the table

Basic NAT Operation 6 Private Network Internet 192.168.0.1 66.31.210.69 74.125.228.67

Basic NAT Operation 6 Private Network Internet Source: 192.168.0.1:2345 Dest: 74.125.228.67:80 192.168.0.1 66.31.210.69 74.125.228.67

Basic NAT Operation 6 Private Network Internet Source: 192.168.0.1:2345 Dest: 74.125.228.67:80 Private Address Public Address 192.168.0.1:2345 74.125.228.67:80 192.168.0.1 66.31.210.69 74.125.228.67

Basic NAT Operation 6 Private Network Internet Source: 192.168.0.1:2345 Source: 66.31.210.69:2345 Dest: 74.125.228.67:80 Dest: 74.125.228.67:80 Private Address Public Address 192.168.0.1:2345 74.125.228.67:80 192.168.0.1 66.31.210.69 74.125.228.67

Basic NAT Operation 6 Private Network Internet Source: 192.168.0.1:2345 Source: 66.31.210.69:2345 Dest: 74.125.228.67:80 Dest: 74.125.228.67:80 Private Address Public Address 192.168.0.1:2345 74.125.228.67:80 192.168.0.1 66.31.210.69 74.125.228.67 Source: 74.125.228.67:80 Dest: 66.31.210.69:2345

Basic NAT Operation 6 Private Network Internet Source: 192.168.0.1:2345 Source: 66.31.210.69:2345 Dest: 74.125.228.67:80 Dest: 74.125.228.67:80 Private Address Public Address 192.168.0.1:2345 74.125.228.67:80 192.168.0.1 66.31.210.69 74.125.228.67 Source: 74.125.228.67:80 Source: 74.125.228.67:80 Dest: 192.168.0.1:2345 Dest: 66.31.210.69:2345

Advantages of NATs 7 � Allow multiple hosts to share a single public IP

Advantages of NATs 7 � Allow multiple hosts to share a single public IP � Allow migration between ISPs � Even if the public IP address changes, you don’t need to reconfigure the machines on the LAN

Advantages of NATs 7 � Allow multiple hosts to share a single public IP � Allow migration between ISPs � Even if the public IP address changes, you don’t need to reconfigure the machines on the LAN � Load balancing � Forward traffic from a single public IP to multiple private hosts

Natural Firewall 8 Private Network Internet Private Address Public Address 192.168.0.1 66.31.210.69 74.125.228.67

Natural Firewall 8 Private Network Internet Private Address Public Address 192.168.0.1 66.31.210.69 74.125.228.67 Source: 74.125.228.67 Dest: 192.168.0.1

Natural Firewall 8 Private Network Internet Private Address Public Address 192.168.0.1 66.31.210.69 74.125.228.67 Source: 74.125.228.67 Dest: 66.31.210.69

Concerns About NAT 9 � Performance/scalability issues � Per flow state! � Modifying IP and Port numbers means NAT must recompute IP and TCP checksums

Concerns About NAT 9 � Performance/scalability issues � Per flow state! � Modifying IP and Port numbers means NAT must recompute IP and TCP checksums � Breaks the layered network abstraction

Concerns About NAT 9 � Performance/scalability issues � Per flow state! � Modifying IP and Port numbers means NAT must recompute IP and TCP checksums � Breaks the layered network abstraction � Breaks end-to-end Internet connectivity � 192.168.*.* addresses are private � Cannot be routed to on the Internet � Problem is worse when both hosts are behind NATs

Concerns About NAT 9 � Performance/scalability issues � Per flow state! � Modifying IP and Port numbers means NAT must recompute IP and TCP checksums � Breaks the layered network abstraction � Breaks end-to-end Internet connectivity � 192.168.*.* addresses are private � Cannot be routed to on the Internet � Problem is worse when both hosts are behind NATs � What about IPs embedded in data payloads?

Port Forwarding 10 Private Network Internet Private Address Public Address 192.168.0.1:7000 *.*.*.*:* 192.168.0.1 66.31.210.69 74.125.228.67

Port Forwarding 10 Private Network Internet Private Address Public Address 192.168.0.1:7000 *.*.*.*:* 192.168.0.1 66.31.210.69 74.125.228.67 Source: 74.125.228.67:8679 Dest: 66.31.210.69:7000

Port Forwarding 10 Private Network Internet Private Address Public Address 192.168.0.1:7000 *.*.*.*:* 192.168.0.1 66.31.210.69 74.125.228.67 Source: 74.125.228.67:8679 Source: 74.125.228.67:8679 Dest: 192.168.0.1:7000 Dest: 66.31.210.69:7000

Hole Punching 11 � Problem: How to enable connectivity through NATs? NAT 1 NAT 2 192.168.0.2 192.168.0.1 59.1.72.13 66.31.210.69

Hole Punching 11 � Problem: How to enable connectivity through NATs? NAT 1 NAT 2 192.168.0.2 192.168.0.1 59.1.72.13 66.31.210.69 � Two application-level protocols for hole punching � STUN � TURN

STUN 12 � S ession T raversal U tilities for N AT � Use a third-party to echo your global IP address � Also used to probe for symmetric NATs/firewalls ■ i.e. are external ports open or closed? 192.168.0.1 STUN Server 66.31.210.69

STUN 12 � S ession T raversal U tilities for N AT � Use a third-party to echo your global IP address � Also used to probe for symmetric NATs/firewalls ■ i.e. are external ports open or closed? What is my global IP address? 192.168.0.1 STUN Server 66.31.210.69

STUN 12 � S ession T raversal U tilities for N AT � Use a third-party to echo your global IP address � Also used to probe for symmetric NATs/firewalls ■ i.e. are external ports open or closed? What is my global IP address? Please echo my IP address 192.168.0.1 STUN Server 66.31.210.69

CS 3700 Networks and Distributed Systems NAT (You Better Forward - PowerPoint PPT Presentation

CS 3700 Networks and Distributed Systems NAT (You Better Forward Those Ports) Revised 10/7/16 The IPv4 Shortage 2 Problem: consumer ISPs typically only give one IP address per-household Additional IPs cost extra More IPs may not

CS 3700 Networks and Distributed Systems Logistics (a.k.a. The boring slides) Revised

CS 3700 Networks and Distributed Systems Bridging (From Hub to Switch by Way of Tree)

CS 3700 Networks and Distributed Systems Overlay Networks (P2P DHT via KBR FTW) Revised

CS 3700 Networks and Distributed Systems Internet Architecture (Layer cake and an hourglass)

H1 / Q2-FY19 Earnings Presentation At a Glance 2 One of the largest content houses with 3700+

CS 3700 Networks and Distributed Systems P2P and BitTorrent (Why is Lars Ulrich So Angry?)

Laurie Adelhardt | ag@owlcreek.net | 410.705.3700 Susanne Zilberfarb | susanne@hammondmedia.com |

ANALYSIS OF CREDIT PORTFOLIO FCERA May 2014 SEATTLE | 206.622.3700 LOS ANGELES | 310.297.1777

REAL EST REAL ESTATE TE Over Rs.100,000 CR. Rs. 3700 cr. Sales recorded Estimated revenue

Community Arts Advisory Committee Meeting #1 July 15, 2019 | 6:30 8:30 p.m. 3700 South Four

Community Arts Advisory Committee Meeting #3 August 29, 2019 | 6:30 8:30 p.m. 3700 South

CS 3700 Networks and Distributed Systems Inter Domain Routing (Its all about the Money)

CS 3700 Networks and Distributed Systems Intro to Distributed Systems Revised 10/01/15

Real Assets Outlook Table of contents VERUSINVESTMENTS.COM SEATTLE 206-622-3700 LOS ANGELES

The Cottages-3700 Cedar Hill Road Dawson Heights Housing Ltd. Neighbourhood Association Meeting-

Community Arts Advisory Committee Meeting #2 August 8, 2019 | 6:30 8:30 p.m. 3700 South

CS 3700 Networks and Distributed Systems Crash Course in C Sockets (Prepare yourself for

How we treat Cruise Ship` Diamond Princess` with 3700 passengers Ichiro Takeuchi Chief Professor

CS 3700 Networks and Distributed Systems Data Link (The Etherknot Notwork) Revised 9/14/16

CS 3700 Networks and Distributed Systems Network Layer (Putting the Net in Internet) Revised

CS 3700 Networks and Distributed Systems Time and Logical Clocks Revised 3/24/16 Global

CS 3700 Networks and Distributed Systems Physical Layer (The layer for EE majors) Revised

CS 3700 Networks and Distributed Systems A Brief History of the Internet (Hint: Al Gore is

The Photometric Performance of NICMOS L. Colina 1 Space Telescope Science Institute, 3700 San