Forty laptops, one public address
A firm has forty laptops and one address from its provider. All forty browse the web at the same time.
The web servers see one address. Yet each reply finds the right laptop.
The router in the middle keeps a table of who asked for what. This lesson opens that table.
By the end of this lesson
Note
I can explain how a private host reaches the internet through NAT.
Key words
| Word | What it means | Example |
|---|---|---|
| Private address | an address that is never routed on the internet | 10.0.0.2 |
| Gateway | the router between an inside network and the outside | |
| NAT | network address translation: rewriting the addresses in a packet | |
| Masquerade | NAT that uses the gateway's own outside address | |
| Translation table | the gateway's memory of which connection belongs to which inside host | |
| Port forward | a rule that sends outside requests for one port to an inside host |
The cells students fill in are left blank in this preview.
Private addresses cannot be routed back
Three blocks are kept for private use. Every home and office reuses them. No internet router carries a route to them.
A request from a private address can reach a server. The reply cannot find its way home.
Worked example: the private blocks
| Block | Addresses | Often used for |
|---|---|---|
| 10.0.0.0/8 | 16 million | Large organisations |
| 172.16.0.0/12 | 1 million | Medium networks |
| 192.168.0.0/16 | 65 thousand | Homes and small offices |
The cells students fill in are left blank in this preview.
Meet the three machines
netlab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask the outside server what it knows
sudo ip netns exec srv ip routeShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Try a request that cannot be answered
sudo ip netns exec lan curl --noproxy '*' -sS -m 3 http://203.0.113.2:8000/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask the same server from the gateway
sudo ip netns exec gw curl --noproxy '*' -sS -m 3 http://203.0.113.2:8000/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Why one request gets no answer
The outside server has one route, for its own cable. It has none for 10.0.0.0/24, so a reply to 10.0.0.2 has nowhere to go.
The curl from lan waits three seconds and prints Connection timed out. The request left, and nothing came back.
The curl from gw is answered at once: outside-server: you are 203.0.113.1. That address is on the server's own cable, so the reply finds its way.
Masquerade rewrites the source
On the way out, the gateway swaps the private source address for its own outside address. It keeps the source port if no other connection uses it, and picks a free one if it must, as in the table below.
It writes the swap in its translation table. When the reply returns, the gateway looks the port up and swaps the address back.
Worked example: one request and its reply
| Step | Source | Destination |
|---|---|---|
| Leaves the laptop | 10.0.0.2:41574 | 198.51.100.7:443 |
| Leaves the gateway | 203.0.113.1:50001 | 198.51.100.7:443 |
| Reply reaches the gateway | 198.51.100.7:443 | 203.0.113.1:50001 |
| Reply reaches the laptop | 198.51.100.7:443 | 10.0.0.2:41574 |
The cells students fill in are left blank in this preview.
Read the gateway's memory
sudo ip netns exec gw conntrack -LShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
What the gateway remembers
Each line is one connection. After the first addresses come the same addresses reversed: the reply the gateway expects.
The request from lan shows SYN_SENT and [UNREPLIED]: it is tracked, and no reply has come. The gateway's own request shows TIME_WAIT and [ASSURED]: it was answered and closed.
Entries last about two minutes, then the command says 0 flow entries. This tracking is what lets a gateway match replies to requests.
A port forward lets the outside in
Masquerade serves requests that start inside. What if the outside must reach a web page that lives inside?
A port forward says: a request for the gateway's outside address on port 8080 goes to one inside host on port 80.
The gateway rewrites the destination, and the table brings the reply back.
Worked example: two forwards
| Outside asks for | Gateway sends it to | Why |
|---|---|---|
| Gateway address, port 8080 | 10.0.0.2, port 80 | The shop's web page |
| Gateway address, port 2222 | 10.0.0.9, port 22 | Remote login to one server |
| Gateway address, port 9999 | Nowhere | No rule: the request is dropped |
The cells students fill in are left blank in this preview.
Read the gateway's rules
sudo ip netns exec gw nft list rulesetShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think NAT is a security feature. NAT only rewrites addresses. The firewall rules decide what is allowed. In the ruleset above, the forward chain with policy drop is what keeps the outside out.
Going further: read a full table
Once your masquerade rule works in the lab, run the curl from lan three times. Then run conntrack -L in gw.
For each entry, write down the inside source port, and the port the reply is sent to in the reversed half. Then say which parts of the entry the gateway needs to send each reply to the right place.