>> One of the services that many routers provide is
a service called NAT, network address translation.
NAT works with a very similar service called
PAT, port address translation.
Really the two go hand in hand.
On my internal network,
I have my hosts and I want to keep them protected.
Even though a router's primary job isn't security,
there are ways that you can add security to a router.
The idea is for any device running NAT,
there must be two interfaces.
One internal interface connected to
the internal network and
an external interface connected out to the Internet.
All traffic goes to the NAT device.
The NAT device strips the true source address and
replaces that address with
its own external interface address.
It looks like all traffic going out
>> onto the Internet is coming from
>> that NAT device, it's external address.
>> It's a way of hiding my internal
IP addresses and presenting
a different source address to
all clients on the Internet.
That also makes it very difficult for
those Internet systems to connect
>> to my internal network.
>> With that being said, another function
that NAT can perform using
PAT is to have
many internal IP addresses
with just a single external IP address,
and that uses something called
>> port address translation.
>> I may have 50 internal IP addresses,
all coming through the NAT device
and all traffic looks like it's coming from the
137.186.57.8 IP address in this illustration.
The reason many-to-one mapping or
>> the one-to-many mapping can happen
>> is through the use of ports,
>> and ports are assigned to the source address.
For instance, let's say computer 192.168.0.12,
is sending traffic out to the Internet.
If I have many internal hosts,
when that traffic goes through my router,
my router strips the true source,
replaces it with its own,
and adds arbitrary port number as the source so
that when the server goes out to
the Internet, responds back.
The router says,
this port goes to the address of
192.168.0.12 by appending point numbers
to the source address,
that router or whatever the NAT device is,
is going to be able to keep up with my internal hosts.
The big benefit of NAT is that it hides
internal addresses and also
keeps me from having to pay for
200 individual IP addresses for my ISP.
I pay for the one IP address that's
on my external interface on my router,
then everything else is hidden behind NAT
so they don't have to be registered addresses.
Another benefit with NAT,
are the internal IP addresses.
These follow an RFC called 1918.
RFC 1918 sets aside three ranges
>> of IP addresses just to
>> be used for private internal usage
and they are anything on the 10 network,
the 172.16 through 172.31 network,
and the 192.168 network.
All of those are reserved for
the specific purpose of internal use.
Again, because they're behind
NAT devices, it doesn't matter.
Those aren't the devices that are
going on on the Internet.
Those aren't the IP addresses.
NAT is going to strip those internal addresses and
everything presents from a single external interface
of the NAT device.
Now, if your NAT device fails,
all your traffic is going through that NAT device.
You're going to have to have
that single point of failure.
Keep in mind that NAT really doesn't
provide any other security services.
NAT very simply provides the address transition,
but that's an important service for us.