Nat; Nat Ip Address Translation - D-Link DFL-1660 User Manual

7.2. NAT

7.2. NAT
Dynamic Network Address Translation (NAT) provides a mechanism for translating original source
IP addresses to a different address. Outgoing packets then appear to come from a different IP
address and incoming packets back to that address have their IP address translated back to the
original IP address.
NAT can have two important benefits:
• The IP addresses of individual clients and hosts can be "hidden" behind the firewall's IP address.
• Only the firewall needs a public IPv4 address for public Internet access. Hosts and networks
behind the firewall can be allocated private IPv4 addresses but can still have access to the public
Internet through the public IPv4 address.
NAT Provides many-to-one IP Address Translation
NAT provides many-to-one translation. This means that each NAT rule in the IP rule set will
translate between several source IP addresses and a single source IP address.
To maintain session state information, each connection from dynamically translated addresses uses a
unique port number and IP address combination as its sender. NetDefendOS performs automatic
translation of the source port number as well as the IP address. In other words, the source IP
addresses for connections are all translated to the same IP address and the connections are
distinguished from one another by the allocation of a unique port number to each connection.
The diagram below illustrates the concept of NAT.
In the illustration above, three connections from IP addresses A, B and C are NATed through a
single source IP address N. The original port numbers are also changed.
The next source port number allocated for a new NAT connection will be the first free port selected
randomly by NetDefendOS. Ports are allocated randomly to increase security.
Limitations on the Number of NAT Connections
Approximately 64,500 simultaneous NAT connections are possible if a "connection" is considered
to be a unique pair of IP addresses and different port numbers are not used or the same destination
port is used.
Figure 7.1. NAT IP Address Translation
370
Chapter 7. Address Translation