One internet line for a takeaway
A takeaway has two tills, a card reader and the manager's laptop. Its internet provider gives it one line and one address on the internet.
All four devices go online at the same time, and each gets the right replies.
The takeaway also wants customers to see its menu page from home, and nothing else. The router does both jobs.
By the end of this lesson
Note
I can connect an office to the internet safely.
Key words
| Word | What it means | Example |
|---|---|---|
| Private address | an address used only inside a home or office | 10.0.0.2 |
| Public address | an address that can be reached across the internet | |
| Gateway | the router between the inside network and the internet | |
| NAT | the gateway swapping addresses as traffic passes through | |
| Port forward | a rule that lets the outside reach one inside service | |
| Firewall | rules that decide which traffic may pass |
The cells students fill in are left blank in this preview.
Private addresses cannot be answered
Inside homes and offices, devices use private addresses, such as 10.0.0.2 or 192.168.1.20. Millions of networks reuse the same ones.
So no router on the internet knows where 10.0.0.2 is. A request from a private address can reach a server, but the reply has no way back.
Meet the three machines
netlab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask the outside server what it knows
sudo ip netns exec srv ip routeShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask the server for a page from lan
sudo ip netns exec lan curl --noproxy '*' -sS -m 3 http://203.0.113.2:8000/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask the same server from the gateway
sudo ip netns exec gw curl --noproxy '*' -sS -m 3 http://203.0.113.2:8000/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
One request lost, one answered
lan is the office computer on 10.0.0.2. gw is the gateway. srv is a server out on the internet, on 203.0.113.2.
The server knows one route, for its own cable, 203.0.113.0/24. The request from lan waits three seconds and says Connection timed out, because the reply to 10.0.0.2 had nowhere to go. The gateway's request gets outside-server: you are 203.0.113.1 at once.
NAT swaps the address on the way out
With NAT, the gateway changes each request as it leaves. It swaps the private address for its own public one. It keeps the port number if it is free.
A port is a number that says which conversation a piece of traffic belongs to. The gateway writes each swap in a table. When a reply comes back to that port, it looks the port up and swaps the address back.
Worked example: a till asks a card company
| Step | From | To |
|---|---|---|
| Leaves the till | 10.0.0.2 port 41574 | 198.51.100.7 port 443 |
| Leaves the gateway | 203.0.113.1 port 41574 | 198.51.100.7 port 443 |
| Reply reaches the gateway | 198.51.100.7 port 443 | 203.0.113.1 port 41574 |
| Reply reaches the till | 198.51.100.7 port 443 | 10.0.0.2 port 41574 |
The cells students fill in are left blank in this preview.
Read what the gateway remembers
sudo ip netns exec gw conntrack -LShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The gateway's memory, before NAT
Each line is one conversation. The first half is the request. The second half is the reply the gateway expects.
lan's line says SYN_SENT and [UNREPLIED], and its second half still says dst=10.0.0.2: nothing was swapped. The gateway's own line says [ASSURED], because it was answered. Lines vanish after about two minutes.
Open only what you need
With NAT, inside devices start conversations. The firewall stops anybody outside starting one in, which is what you want for tills.
The menu page is different: customers must reach it. A port forward says that requests to the gateway on one port go to one inside device. A firewall drops everything no rule allows. Safe means one forward for one service, and nothing wider.
Worked example: the takeaway's gateway
| Outside asks the gateway for | Goes to | Why |
|---|---|---|
| Port 8080 | 10.0.0.2, port 80 | The menu page |
| Port 8081 | Nowhere, dropped | The till's own page stays private |
| Port 22 | Nowhere, dropped | Nobody outside may log in |
The cells students fill in are left blank in this preview.
Read the gateway's rules
sudo ip netns exec gw nft list rulesetShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think NAT is what keeps attackers out. NAT only swaps addresses. The firewall rules decide what may pass. In the rules you just read, policy drop is the line that drops anything not allowed.
Saving your rules in the lab
Tip
In the lab you save your rules in /etc/nftables.conf. To load the saved file, run netlab down and then netlab up. Do not use netlab reset after saving: it puts the starting file back over yours.
Going further: watch the swap
Once your NAT rule works in the lab, run the curl from lan again, then conntrack -L in gw.
Compare the line with the one you saw today. Which address does the second half say after dst= now? Write a line for your assignment's table from it.