1. Network Address Translation (NAT)
Reading: Chapter 21
Fall 2004
FSU CIS 5930 Internet Protocols

2. FSU CIS 5930 Internet Protocols
Concepts
NAT
Translation between IP addresses (and port numbers)
Basic NAT
Only involving IP address translation
Network address and port translation
Involving both IP address and port number
Fall 2004
FSU CIS 5930 Internet Protocols

3. FSU CIS 5930 Internet Protocols
LAN *
NAT-Router
Endsystem A
Endsystem B
WWW-Server
Fall 2004
FSU CIS 5930 Internet Protocols

4. Some application specific problems
FTP
PORT command contains IP/port
May need to change content
Fragmentation
Only the first fragment has TCP/UDP header
May need to do assembly first
Fall 2004
FSU CIS 5930 Internet Protocols

5. NAT implementation in Linux
Incoming packets
Connection Tracking
Higher layers
Local processes
NF_IP_LOCAL_IN
NF_IP_LOCAL_OUT
NAT
Forwarded packets
Routing
NF_IP_FORWARD
Routing
NAT
NAT
NF_IP_PRE_ROUTING
Connection Tracking
NF_IP_POST_ROUTING
CRC check
Consistency checks
Device driver
(input)
Device driver
(output)
Ausgehende Pakete
Fall 2004
FSU CIS 5930 Internet Protocols

6. Initialization and uninitialization
Done by init() and fini()
They call init_or_cleanup()
init_or_cleanup()
Initialization
Initializing some netfilter tables
Initializing some protocol specific stuffs
Link (register) netfilter hooks
ip_nat_fn(), ip_nat_local_fn(), ip_nat_out()
Uninitializing
Reversing the process
Fall 2004
FSU CIS 5930 Internet Protocols

7. FSU CIS 5930 Internet Protocols
How packet flows in NAT
Incoming packets
NF_IP_PRE_ROUTING
ip_nat_fn()
Locally generated packets
NF_IP_LOCAL_OUT
ip_nat_local_fn() for unfragmented packets
Passing on other packets
Outgoing packets
NF_IP_POST_ROUTING
ip_nat_out()
Reassembly packets, passing on to ip_nat_fn()
Fall 2004
FSU CIS 5930 Internet Protocols

8. FSU CIS 5930 Internet Protocols
ip_nat_fn()
Determining what NAT needs to be used (src or dst)
Determining associated flow of the packet
Handling the packet depending on state
Expected connection (IP_CT_RELATED)
New connection (IP_CT_NEW)
Others
Doing real binding (translation)
Do_bindings()
Fall 2004
FSU CIS 5930 Internet Protocols

9. Initializing address-binding process
Netfilter registered branch destinations
ipt_snat_target(), ipt_dnat_target()
Finding associated flow/connection entry
Calling ip_nat_setup_info() to do new binding
Fall 2004
FSU CIS 5930 Internet Protocols

10. Actual address translation
do_bindings()
Searching associated bindings
Calling manip_pkt() to do address translation
manip_pkt()
Translating ip address
Updating checksum
Calling prot->manip_pkt() to handle protocol specific translation
Fall 2004
FSU CIS 5930 Internet Protocols