Introduction to Solaris10NAT configuration

Article title: Introduction to Solaris10NAT configuration. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

I. basic NAT knowledge

　　1. NAT definition

NAT stands for "Network Address Translation" and "Network Address Translation". It is an IETF (Internet Engineering Task Force, Internet Engineering Task Group) standard, allows an entire organization to appear on the Internet with a public IP address (Internet Protocol. As the name suggests, it is a technology that translates an internal private network address (IP address) into a valid network IP address. A simple implementation of NAT is provided.

2. proposal of NAT technology

IP Address depletion facilitates the development of CIDR, but the main purpose of CIDR development is to effectively use the existing internet address. At the same time, NAT developed according to RFC 1631 (IP Network Address Translator) can use the same IP Address in multiple Internet subnets to reduce the use of registered IP addresses. NAT technology allows a private network to connect to the external world through an Internet registered IP address. the NAT router located in the internal network and the external network is responsible for translating the internal IP address into an external legal IP address before sending packets. Hosts on the internal network cannot communicate with the external network at the same time, so only some internal addresses need to be translated.

If a packet contains a destination IP address, once the IP address of the internal Intranet is intercepted, the internal network resources will be exposed and attacks can be carried out on it. To improve the security of the internal network, you can use the network address translation technology. In addition, the IP address is insufficient so that many users use the private EP address to build the network. the IP address in the private network should follow the address allocated for the private network in RFC 1597, and its address range is

10.0.0.0-10.255.255.255, 172.16.0.0 -- 172.16.255.255 192.168.0.0 -- 192.168.255.255

However, private addresses cannot be directly connected to the Internet. In order for such a network to access the Internet, address translation can be used to solve this problem. Network address translation (NAT) converts one (or one group) IP address to another or a group of iP addresses, that is, converting intranet IP addresses or Internet IP addresses. Due to the lack of network addresses and security considerations, many internal networks are established using private IP addresses. when connecting to the internet, they use a vronat or firewall with the NAT function, converts a private IP address to a valid IP address.

　3. how NAT works

The basic principle of NAT is that when an IP packet for communications between a private network host and a public network host passes through the NAT gateway, convert the source IP address or destination IP address in the IP package between the private IP address and the public IP address of the NAT gateway. Replace the source address in the group with the global NAT address in all outbound groups of the NAT router. The destination address (the global address of the NAT router) in the group is changed to the appropriate private address through all inbound groups of the NAT router. 2 shows an example of address conversion.

 

 

NAT schematic

4. implementation and classification of NAT

NAT functions are usually integrated into routers, firewalls, ISDN routers, or individual NAT devices. For example, if the Cisco router has already added this function, the network administrator only needs to set up the NAT function in the router's IOS to shield the internal network ., For example, IP Masquerade in Linux, ipfilter in Solaris, Sygate software in Windows98, and Windows 2000 and 2003 all contain this function. NAT Category:

(1) Source NAT (SNAT): modifies the Source address of a data packet. Source nat changes the source address of the first packet, which is always completed before the packet is sent to the network. packet disguise is an example of SNAT.

(2) Destination NAT (DNAT): modifies the Destination address of a data packet. Destination NAT is the opposite of SNAT. it is the first Destination address to change data, such as load balancing, port forwarding, and transparent proxy.

5. NAT conversion table

How does the NAT router know the destination address of the inbound group from the Internet? There may be hundreds or thousands of dedicated IP addresses, each of which belongs to a specific host. If the NAT router has a conversion table, the problem is solved. The simplest form is that a conversion table has only two columns: private address and external address (the destination address of the group ). When the router converts the source address of the outbound group, it also writes down the destination address --- the place where the group is going. When the response is returned from this destination address, the router uses the source address (as an external address) of this group to find the dedicated address of this group. This concept is given. It should be noted that the changed (converted) address is indicated in gray.

 

NAT translation table

6. Advantages and disadvantages of NAT:

To some extent, the NAT solution slows down the cycle of IP address depletion and the increasing number of route tables. It provides a very convenient way to solve the connection problem between the private network and the Internet.

　NAT advantages:

End users can access the Internet transparently.

NAT can be used to hide the internal network architecture of the external network, and the external network cannot know which host sends or receives data. from another perspective, it is also a disadvantage.

You do not have to modify the IP address of each host and the configurations of the internal router.

* When implementing NAT, you can add some server proxy and packet filtering functions to achieve good security and other performance without increasing management overhead.

Interconnect a large private network with the Internet with very few global addresses.

HoweverThe NAT solution has many negative characteristics, which determines that it can only be a temporary solution, including:

If the network size increases and the number of hosts accessing the Internet increases, the size of the table corresponding to the address will inevitably increase, which will reduce the efficiency.

It increases the possibility of incorrect addressing.

It hides information about the host sending packets, making it difficult for the external network to manage them. for example, if a host in the internal network violates security rules on the Internet, inter-net cannot investigate "culprit ".

Because NAT needs to modify the corresponding IP address, you cannot

TCP packet header checksum) encryption to reduce security.

L high-level applications that use IP addresses will be restricted, unless NAT may modify the IP address information contained in the application. Even so, there are still restrictions on these high-level applications, such as unencrypted applications.

* ICMP, SNMP, DNS, and other protocols used on the network cause address translation problems, which are difficult to be considered comprehensively.

[1] [2] [3] Next page