Please Whitelist This Site?

I know everyone hates ads. But please understand that I am providing premium content for free that takes hundreds of hours of time to research and write. I don't want to go to a pay-only model like some sites, but when more and more people block ads, I end up working for free. And I have a family to support, just like you. :)

If you like The TCP/IP Guide, please consider the download version. It's priced very economically and you can read all of it in a convenient format without ads.

If you want to use this site for free, I'd be grateful if you could add the site to the whitelist for Adblock. To do so, just open the Adblock menu and select "Disable on tcpipguide.com". Or go to the Tools menu and select "Adblock Plus Preferences...". Then click "Add Filter..." at the bottom, and add this string: "@@||tcpipguide.com^$document". Then just click OK.

Thanks for your understanding!

Sincerely, Charles Kozierok
Author and Publisher, The TCP/IP Guide


NOTE: Using software to mass-download the site degrades the server and is prohibited.
If you want to read The TCP/IP Guide offline, please consider licensing it. Thank you.

The Book is Here... and Now On Sale!

Enjoy The TCP/IP Guide? Get the complete PDF!
The TCP/IP Guide

Custom Search







Table Of Contents  The TCP/IP Guide
 9  TCP/IP Lower-Layer (Interface, Internet and Transport) Protocols (OSI Layers 2, 3 and 4)
      9  TCP/IP Internet Layer (OSI Network Layer) Protocols
           9  Internet Protocol (IP/IPv4, IPng/IPv6) and IP-Related Protocols (IP NAT, IPSec, Mobile IP)
                9  IP Network Address Translation (NAT) Protocol

Previous Topic/Section
IP NAT Unidirectional (Traditional/Outbound) Operation
Previous Page
Pages in Current Topic/Section
12
3
Next Page
IP NAT Port-Based ("Overloaded") Operation: Network Address Port Translation (NAPT) / Port Address Translation (PAT)
Next Topic/Section

IP NAT Bidirectional (Two-Way/Inbound) Operation
(Page 3 of 3)

Bidirectional NAT Example

Once the inside global address of the device on the inside network is known by the outside device, the transaction can begin. Let's use the same example as in the previous topic, only we reverse it, so that outside device 204.51.16.12 is initiating a request (and is thus now the client) to inside device 10.0.0.207 (which is the server). Let's say that either static mapping or DNS has been used so that the outside device knows the inside global address of 10.0.0.207 is actually 194.54.21.6. Table 75 describes the transaction in detail; it is illustrated in Figure 113 as well.


Table 75: Operation Of Bidirectional (Two-Way/Inbound) NAT

Step #

Description

Datagram Type

Datagram Source Address

Datagram Destination Address

1

Outside Client Generates Request And Sends To NAT Router: Device 204.51.16.12 generates a request to the inside server. It uses the inside global address 194.54.21.6 as the destination. The datagram will be routed to the local router for that address, which is the NAT router that services the inside network where the server is located.

Request (from outside client to inside server)

204.51.16.12
(Outside Global)

194.54.21.6
(Inside Global)

2

NAT Router Translates Destination Address and Sends To Inside Server: The NAT router already has a mapping from the inside global address to the inside local address of the server. It replaces the 194.54.21.6 destination address with 10.0.0.207, and performs checksum recalculations and other work as necessary. The source address is not translated. The router then delivers the modified datagram to the inside server at 10.0.0.207.

204.51.16.12
(Outside Local)

10.0.0.207
(Inside Local)

 

 

 

 

 

3

Inside Server Generates Response And Sends Back To NAT Router: The server at 10.0.0.207 generates a response, which it addresses to 204.51.16.12 since that was the source of the request to it. This is then routed to the server's NAT router.

Response (from inside server to outside client)

10.0.0.207
(Inside Local)

204.51.16.12
(Outside Local)

4

NAT Router Translates Source Address And Routes Datagram To Outside Client: The NAT router sees the private address 10.0.0.207 in the response and replaces it with 194.54.21.6. It then routes this back to the original client on the outside network.

194.54.21.6
(Inside Global)

204.51.16.12
(Outside Global)


As you can see, once the outside device knows the inside device's inside global address, inbound NAT is very similar to outbound NAT. It just does the exact opposite translation. Instead of modifying the source address on the outbound request and the destination on the inbound response, the router changes the destination on the inbound request and the source on the outbound reply.


Figure 113: Operation Of Bidirectional (Two-Way/Inbound) NAT

This figure is very similar to Figure 112, except that the transaction is in reverse, so please start at the upper right and go counter-clockwise. Translated addresses are shown in bold. Table 75 contains a complete explanation of the four steps. Refer to Figure 111 for an explanation of address types.

 


Key Concept: In traditional NAT, a transaction must begin with a request from a client on the local network, but in bidirectional (two-way/inbound) NAT, it is possible for a device on the public Internet to access a local network server. This requires the use of either static mapping or DNS to provide to the outside client the address of the server on the inside network. Then the NAT transaction is pretty much the same as in the unidirectional case, except in reverse: the incoming request has its destination address changed from inside global to inside local; the response has its source changed from inside local to inside global.



Previous Topic/Section
IP NAT Unidirectional (Traditional/Outbound) Operation
Previous Page
Pages in Current Topic/Section
12
3
Next Page
IP NAT Port-Based ("Overloaded") Operation: Network Address Port Translation (NAPT) / Port Address Translation (PAT)
Next Topic/Section

If you find The TCP/IP Guide useful, please consider making a small Paypal donation to help the site, using one of the buttons below. You can also donate a custom amount using the far right button (not less than $1 please, or PayPal gets most/all of your money!) In lieu of a larger donation, you may wish to consider purchasing a download license of The TCP/IP Guide. Thanks for your support!
Donate $2
Donate $5
Donate $10
Donate $20
Donate $30
Donate: $



Home - Table Of Contents - Contact Us

The TCP/IP Guide (http://www.TCPIPGuide.com)
Version 3.0 - Version Date: September 20, 2005

Copyright 2001-2005 Charles M. Kozierok. All Rights Reserved.
Not responsible for any loss resulting from the use of this site.