NAT (Network Address Translation)

NAT (Network Address Translation)
Introduction
NAT (Network Address Translation) is a method of mapping one or
more IP addresses and/or IP service ports into different specified values.
Two functions of NAT are as below:
It allows the internal IP addresses of many computers on a LAN to be
translated to the public ISP by only one or a few addresses, saving
users cost.
It can play a security feature by obscuring the true addresses of important machines from potential hackers on the Internet.
NAT Setup
Usually you will use the router as a NAT-enabled router. NAT stands for
Network Address Translation. It means the router gets one (in Single ISP,
PPPoE, PPTP) or two (in Dual ISP mode) globally re-routeable IP addresses
from the ISP. Local hosts will use private network IP addresses defined by
RFC-1918 to communiate with the router. The router translates the private network addresses to a globally routeable IP address, which is then used to access the Internet. The following explains NAT features for specific applications.
Click NAT Setup to open the setup page. On the page you will see the
private IP address definitions defined in RFC-1918. Usually we use the
192.168.1.0/24 subnet for the router.
1
Exposing Internal Servers to the Public Domain
The Port Redirection Table may be used to expose internal servers to
the public domain or open a specific port number to internal hosts. Internet
hosts can use the WAN IP address to access internal network services, such as
FTP, WWW, etc.
The following example shows how an internal FTP server is exposed
to the public domain. The internal FTP server is running on the local host addressed as 192.168.1.10.
As shown above, the Port Redirection Table provides10 port-mapping entries for internal hosts.
Service Name: Specifies the name for the specific network service.
Protocol: Specifies the transport layer protocol (TCP or UDP).
Public Port: Specifies which port should be redirected to the internal host.
Private IP: Specifies the private IP address of the internal host offering the
service.
Private Port: Specifies the private port number of the service offered by
the internal host.
Active: Check here to activate the port-mapping entry.
Click OK
Note that port forwarding can only be applied to external users only - i.e incoming traffic. The
internet users behind your LAN can not access your external public IP address and come back in;
the internal users shall access the server on its local private IP address, or you can set upan alias
in a Windows hosts file. Please only redirect the ports you know you have to forward rather than
forward all ports. Otherwise, the intrinsic firewall type security of NAT facility will be influenced.
2
DMZ Host Setup
Click DMZ Host Setup to open the setup page. The DMZ Host settings allow a defined internal user to be exposed to the Internet to use some
special-purpose applications such as Netmeeting or Internet Games etc.
DMZ Enable: Check to enable the DMZ Host function.
DMZ Host IP: Enter the IP address of the DMZ host.
Open Port Setup
The Vigor router can support three variants of port mapping methods as below:
Port Redirection: The packet is forwarded to a specific local PC if the port
number matches that defined. An user can also translate the port to another
port locally.
Open Ports: As Port Redirection (above) but enables you to define a range of
ports.
DMZ host: This opens up a single PC completely. All inward packets will be
forwarded to the PC with the local IP address you designate. The only exceptions are packets received in response to outgoing requests from other local
computers or incoming packets which match rules in the other two methods.
While you are using combinations of these three systems, there is a priority
structure; i.e. if a rule in one method co-incides with a rule in another method,
then there is strict precidence, so that the result should be predictable. The
precidence is as follows :
Port Redirection > Open Ports > DMZ
e.g. The packet will be forwarded to the local address designated in Port
Redirection if the port umer of an incoming packet matches a rule in both
Port Redirection and Open Ports.
3
4
Well-known Port Number List
This page provides some well-known port numbers for your reference.
Mutli-NAT Setup
If you have a group of static IPs then you can use the Multi-NAT features to set
up multiple DMZ hosts or multiple open ports hosts in Vigor router. The following session will show you how to setup Multi-NAT feature.
5
When you click the WAN IP Alias button, it will open a window for you to input
your public IPs.
The Join NAT IP Pool check box means that the local user can use this IP to
connect to the Internet.
If you do not check this check box, then the local user will not use this IP.
After you set up the WAN IP Alias, then you can setup multiple DMZ and/or
multiple open ports as follows:
6
7