Nat; Nat Ip Address Translation - D-Link NetDefend DFL-210 User Manual

7.2. NAT

7.2. NAT
Dynamic Network Address Translation (NAT) provides a mechanism for translating original source
IP addresses to a different address. Outgoing packets then appear to come from a different IP
address and incoming packets back to that address have their IP address translated back to the
original IP address.
NAT can have two important benefits:
• The IP addresses of individual clients and hosts can be "hidden" behind the firewall's IP address.
• Only the firewall needs a public IP address for public Internet access. Hosts and networks
behind the firewall can be allocated private IP addresses but can still have access to the public
Internet through the public IP address.
NAT Provides many-to-one IP Address Translation
NAT provides many-to-one translation. This means that each NAT rule in the IP rule set will
translate between several source IP addresses and a single source IP address.
To maintain session state information, each connection from dynamically translated addresses uses a
unique port number and IP address combination as its sender. NetDefendOS performs automatic
translation of the source port number as well as the IP address. In other words, the source IP
addresses for connections are all translated to the same IP address and the connections are
distinguished from one another by the allocation of a unique port number to each connection.
The diagram below illustrates the concept of NAT.
Figure 7.1. NAT IP Address Translation
In the illustration above, three connections from IP addresses A, B and C are NATed through a
single single source IP address N. The original port numbers are also changed.
The next source port number allocated for a new NAT connection will be the first free port found by
NetDefendOS (which is not necessarily the next free port).
There is a limitation of a maximum of 65,536 (64K) simultaneous NAT connections between any
one, unique IP pair. The term IP pair means one IP address on a NetDefendOS interface and the IP
address of some external host to which a connection is being made. If two different IP addresses on
an external host are being connected to from the same address on the firewall then this will
constitute two, unique IP pairs.
298
Chapter 7. Address Translation