Network Address Translation (NAT) Gateway

Another piece of equipment which is very similar to a firewall is a NAT gateway. In fact, most of the time the NAT gateway is our firewall. We'll discuss that, but let's talk about this NAT gateway and how it adds an element of security.

Network address translation translates our private addresses to our public addresses. So let's just take a look at what that looks like.

Let's say this is my internal network. Most internal networks that I've seen are using some sort of private addressing. In fact, almost all, except for when I worked at the school systems. When I work in schools, I do see that they use public addresses, but most of the time it's a private address. Private addresses overlap. So maybe this is a 192.168.0.0 network, /24. Well, there are literally millions of those networks that are out there, and so to route that on the internet would be impossible. It's like two people having the same address, the same house address. You can't then send mail to them because they have the same exact address. So they need different addresses. So somehow we need to translate that to a public address. So as it goes out of, in this case right here, the firewall, then what it's going to do is it's going to translate that to a public address which can be routed on the internet, and then it comes back to our network and then it gets re-translated into that private address.

Why We Have Private Addressing

We did this because we are running out of IP version 4 addresses. There are a lot of things that we changed throughout the years to make sure that we had enough IP version 4 addresses. We did things like set up classes. We set up subnets. We did variable length subnet masking. And then here in 1996, we set up private addressing. We also know this as RFC 1918.

Essentially what this did is it set aside many different networks for private addressing. We have one class A network, we have 16 class B networks, and we have 256 class C networks that we can work with. Now essentially anybody can use these private addresses, and then if you want to get out to the internet, then you'd have to translate that to that public address. Here are the different ranges that we could assign internally. We could do whatever we wanted with it from an internal perspective.

And the way this saves these different public addresses out there, how it saves IP version 4 addresses since we are running out of them, is that we would just have a single IP address on the outside that would connect to our internet service provider. And so we would have that single IP address. What would happen is that a device, as it goes out to the outside world, it would then translate it to that external public address. So we're only taking up one public address even though we have many IP addresses internally. We have many machines internally, many devices that are going and reaching out to the outside world at any given time.

Now technically what I just described is port address translation, or PAT, and we usually call it NAT though. So NAT is something that's a little different than PAT. There are variations with it. I don't want to get into that right now, but just know when I say NAT, I'm actually talking about PAT most of the time.

How the Translation Works

How does this do this? Well, let's say we have a machine here which is a 192.168.0.26 internally, and maybe we have another one over here which is a 52, but maybe it's making a few different connections to the outside world. It's connecting to a few different servers, and so one of them is a 52.348.4 45 address right here, and it's maybe accessing the website, so port 80.

So what's going to happen is that as it tries to reach out to that device, what it will do is it's going to log what is the IP address that is internal, and then it will add what is it trying to go to. And with that piece of information right there, we have now a socket that we're communicating along. And then it says, okay, now what we're going to do is we're going to translate it to this external IP address on the outside. And so it assigns this IP address, and it actually changes that information inside the IP header. So that way as it goes out, then it's going to go to our server that we're trying to access. And then as information comes back, then those source and destination fields are flipped. The source and destination IP addresses are flipped because now it's coming back. And what it associates it with is this entry, and says, oh well, now what we want to do is we want to move it back and turn it into a private address to send it and get it into its internal network location. So then it sends it to the computer and now you have your information.

Security Ramifications of NAT

What's essentially happening is, as this machine reaches out to another machine, it records a state. It records a, hey, this is what's happening and we're translating from this IP address to this public address out there. And now information can come back in that's associated with this entry right there. But now instead, let's say just a random machine, an adversary, a hacker, is trying to reach in from the outside and get into your network. There is no entry for it to come back in. So essentially what we've created by doing that is we're doing a stateful firewall, that traffic can go out and then can reach back into our network, but otherwise it can't come back into our network. So by creating some sort of NAT, essentially we've created a stateful firewall. Now it might not be exactly the same here, but essentially there's an element of security when we're talking about, or when we're implementing, NAT.

The NAT Gateway

Let's talk about what a network address translation gateway is. This is a specialized piece of equipment that we would set up on our network that does network address translation for our network. Now, typically you do NAT on a firewall, and in fact I have set up a specific gateway for network address translations. That's really all that it was set up for. And guess what I used? I used a firewall to do that. And so a lot of times this network address translation gateway is just a firewall that's purpose-driven just for doing this NAT translation.

In fact, I will actually show you what that looked like. So I had a router that connected to our internet service provider. I had an ACL on that router that did some real basic security. We blocked some IP blocks just so they would never hit our internal systems, certain countries or certain known adversaries with that. And then we had this network here that's interconnected, and so we had this kind of this layer here of security with all of these firewalls. And what we had is we had a NAT gateway. In fact, these were firewalls that were in duel. So there's six firewalls as part of this and two routers that were part of this.

But this was a NAT gateway for all of our staff members. This was at a university. This was the NAT gateway for all of our students, so they had a separate NAT gateway. And then this one was for all of our servers so we could serve out things. So this was just a flat out firewall here, versus these were NAT gateways here, but they were all the same firewall box. They were Cisco ASA firewalls.

So I'm not saying that all network address translation gateways are firewalls. I know that that's what I've used in the past, but really it's just whatever device that you're putting out there as the gateway to do your network address translation.