NAT and Internet access¶

Practical 3.7 nat-and-internet-access-annex.pdf · PDF

Open your phone's Wi-Fi settings and look at your IP address. Probably something like 192.168.1.33. Now open the web page ifconfig.me, which tells you the address the world sees. It is a completely different number. Which one is really "your" IP? And why are there two?

On the Routing page you had to ask another group to add a route back to you. Now think bigger. For a server in California to answer your PC, every router on the Internet would need a route back to 10.3.0.0. And to your neighbour's 10.3.0.0, and to millions of identical home networks. That cannot work. This page is about what the world did instead.

Not enough addresses¶

An IPv4 address has 32 bits. How many different addresses is that?

2³² = 4,294,967,296: about 4.3 billion.

It sounds like a lot until you count. There are more than 8 billion people, and many of them have a phone, a laptop, a console and a smart TV. It never fitted.

The story, with dates:

The "short-term solution" of 1994 is, more than thirty years later, in every home on the planet. The real solution is a bigger address: IPv6, on a later page.

Public and private addresses¶

A public address is unique in the whole world and can be reached across the Internet. A private address can be used by anyone inside their own network, so it is not unique and Internet routers refuse to carry it.

The three private ranges of RFC 1918:

Your group's 10.G.0.0/24, the backbone 172.16.0.0/24 and your home's 192.168.1.0/24 are all private. Thousands of homes use exactly 192.168.1.0/24 at the same time. That is fine inside each home, and it is exactly why nobody outside can send a packet "to 192.168.1.33": which one?

The trick: an office with a reception desk¶

We keep one analogy for the whole page: an office with a reception desk.

Inside the office, people have extension numbers: 101, 102, 103. The same extensions exist in every office in the world, so nobody outside can call "extension 101". The office has one public phone number.

When someone inside calls out, the receptionist makes the call from the office number and writes in a notebook: "line 7 = extension 101, talking to the dentist". When the dentist calls back on line 7, the receptionist checks the notebook and puts the call through to 101.

NAT (Network Address Translation) is the router rewriting the addresses of packets as they cross it. The usual form, masquerade, replaces the private source address of every packet leaving the LAN with the router's own public address.

The port is a number inside every packet that identifies one conversation (more on ports on the next page). It is the "line" in the notebook, and it is how one public address can serve hundreds of PCs at once.

Be the receptionist¶

A router has the LAN address 10.3.0.1 and the WAN address 172.16.0.3. Two PCs open the same web page at the same moment, and by chance both pick port 51000 for their side:

The second row is the clever bit. Both PCs chose the same port, so the router changed one of them to a free port. NAT translates address and port.

• An answer arrives for 172.16.0.3:51001. The notebook says: deliver to 10.3.0.198:51000.
• A packet arrives for 172.16.0.3:40000 that nobody asked for. There is no line in the notebook, so it is dropped.

flowchart LR
    subgraph LAN ["LAN: private extensions"]
        PC1["<b>PC</b><br>10.3.0.199:51000"]
        PC2["<b>PC</b><br>10.3.0.198:51000"]
    end
    R["<b>Router</b><br>the receptionist<br>WAN 172.16.0.3"]
    NB[("<b>Translation table</b><br>the notebook")]
    S["<b>Web server</b><br>1.1.1.1:443"]
    PC1 -->|"source rewritten<br>to :51000"| R
    PC2 -->|"source rewritten<br>to :51001"| R
    R --- NB
    R -->|"both look like<br>172.16.0.3"| S

Two receptionists in a row: CGNAT¶

Run traceroute -n 1.1.1.1 at home. If after your home router you see an address starting with 100., your Internet provider is also using NAT for its customers. That range, 100.64.0.0/10, was reserved in 2012 for exactly this. It is called CGNAT (Carrier-Grade NAT): your home router is a receptionist, and the provider has another one in front of it.

The WAN side of the router¶

The WAN (Wide Area Network) side of a router is the interface that leads out, towards the provider. On the group routers it is ether1. The LAN side is where your PCs are.

A provider gives you the WAN address in one of three ways:

Three things for Internet¶

With a WAN address in place, the router needs three more lines:

/ip route add gateway=172.16.0.254
/ip dns set servers=172.16.0.254
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade

1. A default route: everything unknown goes to the provider's router (here, the teacher's router 172.16.0.254). No dst-address means 0.0.0.0/0.
2. A DNS server to ask, so names like www.debian.org work.
3. The receptionist. chain=srcnat: we change the source. out-interface=ether1: only for packets leaving by the WAN. action=masquerade: use the router's own WAN address, whatever it is. The answers are translated back automatically.

In WinBox the masquerade rule is IP → Firewall → NAT → +: Chain srcnat, Out. Interface ether1, Action tab masquerade. You can watch the notebook at IP → Firewall → Connections, or in the CLI:

/ip firewall connection print

Checking it from a PC¶

ping -c 3 1.1.1.1
dig +short www.debian.org
traceroute -n 1.1.1.1
curl -s https://ifconfig.me ; echo

• ping proves the packets get out and the answers come back.
• dig proves DNS works.
• traceroute shows the first hops: 10.3.0.1 (your group router), 172.16.0.254 (the teacher's router), then the school's network.
• curl ifconfig.me asks a web site "which address do you see?". The answer is neither 10.3.0.x nor 172.16.0.3: there are at least three receptionists in a row before the Internet.

Before you add the masquerade rule, try ping -c 3 172.16.0.254 from a PC: it fails, while the same ping from the router works. The teacher's router has no route back to 10.3. After the rule, the PC's packets leave with the router's address 172.16.0.3, which the teacher's router can answer.

A door in: port forwarding¶

The notebook only has lines for conversations started from inside. So a web server running on a PC of your LAN is invisible from outside: a visitor's packet arrives at the router and finds no line.

The fix is a standing order for the receptionist: "whatever arrives at the WAN for TCP port 8080, send it to 10.3.0.199".

Port forwarding (in RouterOS, a dstnat rule with action=dst-nat) rewrites the destination of packets arriving at the WAN, so that one port of the router leads to one machine inside the LAN.

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=8080 \
    action=dst-nat to-addresses=10.3.0.199 to-ports=8080

A quick web server to test it, on the PC:

mkdir -p ~/www && cd ~/www && echo "Hello from group 3" > index.html
python3 -m http.server 8080

Then another group, from outside, runs:

curl http://172.16.0.3:8080      # Hello from group 3
curl -m 3 http://10.3.0.199:8080 # fails: no route to a private network

The second line fails because nobody outside has a route to a private address: that is the whole point. In the server's terminal, each visit prints the visitor's address. It is the partner's router, 172.16.0.4: their PC is hidden behind their own masquerade.

Seeing NAT with your own eyes¶

On the real routers NAT works, but you never see the address change: the far side is the real Internet. In the virtual lab you own both sides. A node called isp plays the Internet with the address 203.0.113.1 (a range reserved for documentation, safe to use as a fake Internet), and it has no route to private networks, just like every real Internet router.

On isp you leave a capture running:

tcpdump -n -i eth1 icmp

Before the masquerade rule, a ping from pc1 gets 100 % loss, yet the capture shows the requests arriving:

IP 10.3.10.11 > 203.0.113.1: ICMP echo request, id 7, seq 1, length 64

The question arrives with a private source. isp cannot answer: it has no route to 10.3.10.11. After the rule, the same ping works and the capture shows IP 203.0.113.2 > 203.0.113.1: same PC, same ping, but the source is now the router's public address. Open a web page from pc1 and pc2, and the web server on isp logs 203.0.113.2 for both. Two PCs, one address.

The Practical 3.7 sheet walks you through both parts: Internet and a door for your group's real router, then the lab. Keep the five configuration lines of the lab router: the next page starts from them.

Key takeaways¶

• IPv4 has only 2³² ≈ 4.3 billion addresses; IANA ran out on 3 February 2011 and RIPE NCC on 25 November 2019.
• Private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) can be reused by anyone and do not cross the Internet; public addresses are unique.
• NAT lets a whole LAN share one public address; masquerade rewrites the source of outgoing packets and the translation table sends each answer to the right PC, by port.
• Internet on RouterOS = a WAN address + a default route + a DNS server + a srcnat masquerade rule.
• Port forwarding (dst-nat) rewrites the destination so someone outside can reach one service inside.
• NAT hides by accident; it is not a firewall. CGNAT means your provider adds a second NAT in front of yours.

Quick check¶

Next: you opened one door on purpose. How many others are open that you never opened? Find out in Ports and firewalls.