Network Address Translation (NAT) Reading: Chapter 21 Fall 2004 FSU CIS 5930 Internet Protocols

FSU CIS 5930 Internet Protocols Concepts NAT Translation between IP addresses (and port numbers) Basic NAT Only involving IP address translation Network address and port translation Involving both IP address and port number Fall 2004 FSU CIS 5930 Internet Protocols

FSU CIS 5930 Internet Protocols LAN 192.168.1.* NAT-Router Endsystem A 192.168.1.1 Endsystem B 192.168.1.2 WWW-Server 100.1.1.1 192.168.1.254 199.10.42.1 Fall 2004 FSU CIS 5930 Internet Protocols

Some application specific problems FTP PORT command contains IP/port May need to change content Fragmentation Only the first fragment has TCP/UDP header May need to do assembly first Fall 2004 FSU CIS 5930 Internet Protocols

NAT implementation in Linux Incoming packets Connection Tracking Higher layers Local processes NF_IP_LOCAL_IN NF_IP_LOCAL_OUT NAT Forwarded packets Routing NF_IP_FORWARD Routing NAT NAT NF_IP_PRE_ROUTING Connection Tracking NF_IP_POST_ROUTING CRC check Consistency checks Device driver (input) Device driver (output) Ausgehende Pakete Fall 2004 FSU CIS 5930 Internet Protocols

Initialization and uninitialization Done by init() and fini() They call init_or_cleanup() init_or_cleanup() Initialization Initializing some netfilter tables Initializing some protocol specific stuffs Link (register) netfilter hooks ip_nat_fn(), ip_nat_local_fn(), ip_nat_out() Uninitializing Reversing the process Fall 2004 FSU CIS 5930 Internet Protocols

FSU CIS 5930 Internet Protocols How packet flows in NAT Incoming packets NF_IP_PRE_ROUTING ip_nat_fn() Locally generated packets NF_IP_LOCAL_OUT ip_nat_local_fn() for unfragmented packets Passing on other packets Outgoing packets NF_IP_POST_ROUTING ip_nat_out() Reassembly packets, passing on to ip_nat_fn() Fall 2004 FSU CIS 5930 Internet Protocols

FSU CIS 5930 Internet Protocols ip_nat_fn() Determining what NAT needs to be used (src or dst) Determining associated flow of the packet Handling the packet depending on state Expected connection (IP_CT_RELATED) New connection (IP_CT_NEW) Others Doing real binding (translation) Do_bindings() Fall 2004 FSU CIS 5930 Internet Protocols

Initializing address-binding process Netfilter registered branch destinations ipt_snat_target(), ipt_dnat_target() Finding associated flow/connection entry Calling ip_nat_setup_info() to do new binding Fall 2004 FSU CIS 5930 Internet Protocols

Actual address translation do_bindings() Searching associated bindings Calling manip_pkt() to do address translation manip_pkt() Translating ip address Updating checksum Calling prot->manip_pkt() to handle protocol specific translation Fall 2004 FSU CIS 5930 Internet Protocols