NAT Types

NAT Versus PAT

I have a little bit of a confession. I've been using the term network address translation, or NAT, quite a bit, but I've been a little misleading. The reason is that a lot of people call it NAT when we're actually using PAT, port address translation, which is something a little bit different. So let's talk about the difference between NAT and PAT, and the different types of NAT and PAT there are.

The reason we just kind of lump it all into one — network address translation — is that's what the industry goes with. A lot of people just refer to NAT as being kind of the all-encompassing term, even though technically speaking a lot of us are really doing port address translation instead.

So let's just briefly hit what the differences are before we get a little more in depth into this. First of all, we have static versus dynamic. Static just means that we predefine it: we're going to define what address is being translated to what address. Dynamic means that we have a pool of addresses, and when something exits, the router is just going to pick up, or translate to, one of those addresses that are within the pool. Then we have NAT versus PAT. NAT is network address translation, which happens at layer 3, versus PAT, which also includes a layer 4 component to it, being the port — port address translation.

Static NAT

Here's an example of static NAT within our router, Router 2. We've already defined that our 10.2.0.80 — and this is just a representative, this is our server network over here, and it's the 10.2. range, and I'm just saying that maybe there's a web server that's over here and its address is dot 80 — so what we're doing is we're translating 184.191.63.4 back and forth to this 10.2.0.80. And 10.2.0.81 is directly translated to 184.191.63.5. These translations are set up directly on Router 2.

Typically where we would see this is in the case of our web servers, or other servers that are within our server network. We need the outside world to be able to get to these devices, so dynamic is not going to work — they can't be constantly changing their IP addresses. So we create this static translation that's here, so when somebody goes to 184.191.63.4 this router then translates that to 10.2.0.80, and then it makes it to this web server, and then the web server responds. That's typically where we use static NAT: in cases like a demilitarized zone, or where we have different servers that are running. That's where we use static NAT.

Static PAT

So what is the difference with PAT? Well, PAT includes the ports, and you can see the ports that are included in each one of these. What I have here is a web server that's 10.2.0.80, and it has port 80 and 443 up and running on it, and I want people to be able to get to those ports specifically. I don't need to open up everything to this one server, but I do need to open up port 80 and 443. So I've got a translation from this address 184.191.63.4 going to port 80 and 443 to go to that same server. But I can also still use that same IP address to go to port 5530, and maybe I translate that to port 22.

So you can see that I can reuse these IP addresses. I could have a different IP address, I can have different ports — that doesn't have to be a direct port-to-port correlation here. I can do really a lot of different setups with this.

One of the advantages to this is, let's say the 2.2 is SSH. This server right here, maybe I want to be able to SSH into this from the outside world. If I had port 22 open to the outside world, port 22 constantly gets pegged with a lot of traffic — people are constantly looking for port 22 to see if it's open. Not as many people are looking for port 5530 to see if that's open, so this server right here is actually going to get hit a lot less by having this non-standard port that's out here. So this is an example of port address translation.

NAT Versus PAT, Compared

So what is the difference between NAT and PAT? Well, this maps it out here. One of them is that NAT is a one-to-one IP relationship, so you have an IP address that's translating to an IP address wherever. Versus PAT, where I can have many different addresses that are translated to one address, or I can have some sort of many-to-many. There's a lot of different combinations within here that it can do with port address translation, because I include the port on this.

NAT operates on the layer 3 translation — it's IP to IP — and PAT is a layer 3 and 4, so it's IP import to IPM port. NAT tends to use more global addresses, because you have a certain amount of these global addresses and each one of those addresses is going to be taken up by some sort of inside resource. Versus this, which uses less global addresses, because I can use a single IP for a lot of different inside machines for this port address translation.

Dynamic NAT

I also have dynamic NAT, and this is really one reason why RFC 1918 works. The thing here is I've defined a pool of addresses that are on my outside interface here, and when a device wants to get to the outside world — so let's say this laptop is getting to the outside world — at that point in time is when it's going to be assigned that address right there. So 10.1.10.34 will be assigned there, it'll go out to the outside world, get the information it needs, and then once that communication is taken down, then it will free up this spot for somebody else. And then this demo Pi will then reach out, and then it will fill the slot right here, 10.1.10.21.

It's similar to how we have phone systems. A lot of phone systems are built where you have maybe 24 ports even though you have maybe hundreds of phones in your network. It's unlikely that you're going to have all 100 being used at the same time, and so you need less of those phone connections on the outside world. Well, the same thing with dynamic NAT: we just need less IP addresses, because it's unlikely that all of your machines are going to need to have access to the outside world at one given point.

Now, that's changed a little bit, right? Because we have a lot more machines that are actively going to the outside world all the time, and constantly making these little connections to all these different services. So in this scenario with dynamic NAT, you would see that you would eat up the IP addresses a lot.

Dynamic PAT

Then we have dynamic PAT. Dynamic PAT gets rid of this issue, because we can use a single IP address for a lot of these machines. So when this laptop right here goes to reach out to the outside world, it's not going to take up this whole IP address, but instead it's going to be translated to 10.1.10.34 and then some sort of port — maybe it's 2514. It's going to take up a port as that gets translated to the outside world. And then next, this demo Pi, 10.1.10.21, reaches out to the outside world and takes up port maybe 2584. It takes up a different port.

So essentially we've got 65,000 connections before we run out of ports and have to use the next IP address, because we can actually still have a pool of IP addresses available for this. But we have these 65,000 connections, because that's how many ports are available to each one of these IP addresses. So it really opens things up a lot, which is why dynamic PAT is usually what we're using out there for most of our networks.

A Closer Look at the PAT Process

Let's take a little deeper dive into this PAT process. Here I have several machines that need to be translated. We take a look at this and they all have different IP addresses, because they're coming from different machines, and they have some sort of ephemeral port that's attached to it. We defined the ephemeral port in a prior class, so I'm not going to really get in depth into the ephemeral port, but essentially that randomly generated this port right here.

What the PAT process will do is try to use that same port. So for this one right here it's going to reuse 2584, and for this one right here it's going to reuse this port 1284. It tries to mimic whatever the requesting is coming in on — it's going to try to mimic that.

Now, the more machines you have, the more chances that you may get a duplicate in this. So in this example right here I've got another 2584. Well, it can't reassign it with this IP address and that port, because then it would get confused with this machine right here. So what it has to do is come up with a different port, and the process that it uses to do that is it just takes whatever it is, and within that same port group it's going to choose the next available one. So in this case right here it's going to be 2585, and then this machine can get out to the rest of the world as well using that same IP address. That's the PAT process.

One thing I snuck in there is I used the term port group. There are port groups, and it wants to use a port in the same port group. So what I mean by that is this 2584 has already been taken within here, so it's going to look at the next available within that port group, and it's going to be in that port group specifically. It's going to look for a port within this port group.

That raises an interesting question: let's say that there's no more available in that port group, then what does it do? Well, your PAT process — you can actually define a pool of addresses that you're going to use. So when the port group is filled up for that specific IP address, then it could take that next available IP address, 184.191.63.5. And since this is a new IP address and all the ports are available, then it can utilize that same port. Now it will go into 2584 and be able to use it.

Exceptions to PAT

With port address translation, what's being translated can be found in both the layer 3 and the layer 4 header. So if we've got a packet that's being sent, we've got this layer 3 header and this layer 4 header right here. The port is found in the layer 4, the IP is found in the layer 3, and so that's what's being translated.

Now, the problem is that not all packets have this same layer 4 header, and not all packets have a port number that's associated with it. An example of that is ICMP. Things like ping do not have a port number associated with them. It is a different protocol and it therefore is set up differently.

Because we run into situations like this, PAT needs some way to be able to handle it, and the way it handles it depends on the protocol being used. As an example, since ICMP doesn't have a port number, it uses a query ID. It has a query ID that attaches to it and uses that to tag that traffic as it goes out, so that when it comes back, it is able to compensate for the lack of those port numbers. So it is a protocol-by-protocol case.

What Enterprise Networks Use

So what do enterprise networks use out there? Well, first of all they're getting some sort of IP address, or an IP address range, that they're allowed to use on their router. And then what's happening is you would set up a dynamic PAT. So most of your enterprise networks are using dynamic PAT, but they also have some sort of static PAT or NAT that's being used for their server network. All of the machines that are trying to get to the outside world are using this dynamic PAT, but for their server network they're using some sort of static PAT to get into certain servers and to translate to those servers.

What Your Home Network Looks Like

So what does your home network look like? Well, for one, you've got this router slash Wi-Fi slash switch slash possibly modem all wrapped into one, and it is using dynamic PAT for that translation. Meaning it gets an IP address through — sometimes it's DHCP, or point-to-point over Ethernet; there's different ways that it gets an IP address, but it gets an IP address, or it's statically assigned. Essentially this IP address comes from the internet service provider. It's a public address that is assigned to it, and then dynamically it sends out and uses this dynamic PAT in order for all of your machines on your network to get to the outside world.

One other thing that I will say is that a lot of your devices will have some sort of port forwarding — or sometimes it's called port mapping — on the machine, where if you have a resource inside your home you can still use this port forwarding or port mapping to be able to translate some sort of port into this inside machine and be able to make a connection from the outside world to the inside machine. So you still have some of those capabilities on your home networks to do this type of translation.

Recap

So there you have it, that's the difference between static and dynamic, and PAT and NAT. Static means that you've specifically said these are the addresses that are going to be translated to these addresses, versus dynamic just means that you have these available, and as a machine goes to the outside world it picks up one of these available addresses. The difference between NAT and PAT is that PAT includes a port and an IP address, where NAT is just the IP address. We talked about some exceptions to PAT, because not all protocols use ports, so there are some exceptions, and those exceptions are dealt with on a case-by-case — or I should say a protocol-by-protocol — basis.