nowadays most of the LAN networks use NAT to link all the computers to the internet using only one External IP address. what if have only one computer and i want it to use that external ip address directly on it's interface without using NAT, PAT and PortForwarding as it's nowadays done for global IPV6 adddresses ??? how it can be technically done ??? is there additional devices that should be present to implement this solution or should the router be replaced by another equipment ???
Nat – how to implement a network that communicates with the internet without NAT
lannat;
Related Solutions
There is a general misconception between NAT (Network address translation) and PAT (Port Address Translation), which is what we mostly use in our home routers.
NAT
Let's assume we have a network with the following topology:
Private_Network <-------> Router <-------> The_Internet
The interface of the Router that is connected to the Private_Network has a private IP address, i.e. one that is not unique in The_Internet. On the other hand, in the case of NAT, Router has multiple interfaces connected to The_Internet. Each interface has a unique IP address in The_Internet. Now let's assume that Host_A and Host_B are in the Private_Network and they both want to access Website_X in The_Internet at the same time. The IPs and the ports of Host_A's packet will be:
Source IP: Host_A's private IP
Source Port: A port on Host_A
Destination IP: Website_X's public/unique IP
Destination Port: A port where Website_X's server is listening to
and in the same way for a packet coming from Host_B.
If the Source IP is left unchanged, then Website_X will reply to an IP address that is private, i.e. not unique, and therefore the packet will never be able to find it's way back. In order to solve that problem, the Router checks whether one of his unique IP addresses connected to The_Internet is not used. If that is the case, it does the following mapping:
Host_A's private IP ======= Router's_unique_IP_K
and now the packet that started from Host_A going to Website_X and is now leaving the interface of the Router connected to The_Internet will have the form:
Source IP: Router's_unique_IP_K
Source Port: A port on Host_A
Destination IP: Website_X's public/unique IP
Destination Port: A port where Website_X's server is listening to
Thus you can understand that there is an one-to-one association from private IPs to public IPs. Therefore when a packet arrives from Website_X to the Router, this association is checked and the destination IP address is changed back to the private one and delivered successfully to the right host.
As you can see, this method is quite simple, but it has one big disadvantage: each private host has to have a unique IP address reserved, which is expensive, thus we select to have fewer unique IP addresses than hosts in the private network. Therefore if all the private hosts attempt to access The_Internet at the same time, only a subset of them, equal to the number of the available public IP addresses that the Router has, will have access and the rest will be denied.
In order to counter that we created PAT.
PAT
PAT is what the vast majority of our home routers is using. The basic limitation is that the Router has a single unique IP address with which it connects to The_Internet, but we still want to allow multiple hosts from the private network to access The_Internet at the same time.
The way we do that is "similar" to the way NAT does it with a key difference: instead of the Router holding a pool of IP address, it holds a pool of port numbers. More precisely, a packet arriving at the Router from Host_A in the Private_Network destined to Website_X in The_Internet will have the following format:
Source IP: Host_A's private IP
Source Port: A port on Host_A
Destination IP: Website_X's public/unique IP
Destination Port: A port where Website_X's server is listening to
Now the Router will do two tasks:
- It will change the Source IP to the Router's unique public IP AND
- It will change the Source Port to a port from a pool that the Router is maintaining and is not already used, e.g. Port_Z
and now the packet that started from Host_A going to Website_X and is now leaving the interface of the Router connected to The_Internet will have the form:
Source IP: Router's_unique_IP_K
Source Port: Port_Z
Destination IP: Website_X's public/unique IP
Destination Port: A port where Website_X's server is listening to
and the Router will keep the following mapping:
Host_A's private IP AND a port on Host_A ======= Port_Z
Why does this work?
Now when a packet comes back, the Router simply checks the destination port number and changes the destination IP address and the destination port number according to the pre-mentioned mapping and the packet gets delivered successfully.
What if I run multiple applications on the same Host?
Different applications will have different ports, by definition, thus they will mapped to a different port from the Router.
What if multiple Hosts attempt to access The_Internet at the same time and they all use the same application?
Different Hosts will have different private IP addresses, by definition, thus they will mapped to a different port from the Router.
PAT is dangerously balancing in a grey space of cross-layer. Port numbers are part of the Transport Protocol while Routers are allowed to operate up to the Internet Protocol. So technically speaking is something that is not allowed by the protocols. Therefore there are, at least theoretically, potential dangers: the port pool is limited. Therefore if my private network consists of 1000 Hosts and each one is running port_pool/10 applications, the mapping table at the router will run out of available entries and access to applications will be denied.
This answer greatly exceeded my intended length, but I hope it was helpful.
Private IPv4 addresses are defined by RFC1918, in which you will find:
Because private addresses have no global meaning, routing information about private networks shall not be propagated on inter-enterprise links, and packets with private source or destination addresses should not be forwarded across such links. Routers in networks not using private address space, especially those of Internet service providers, are expected to be configured to reject (filter out) routing information about private networks. If such a router receives such information the rejection shall not be treated as a routing protocol error.
Without NAT/PAT, the ICMP packet will be dropped by your ISP router. Most of the time, it will be silently drop, but you may have some ICMP message back, depending of the configuration your ISP made.
To have a successful ping reply from an Internet host to a echo request originated by a private IP address there's no other option than NAT/PAT.
Best Answer
IPv4 or IPv6 doesn't matter, except for the availability of addresses. These are examples using IPv4.
Topology A is what most people do. Topology B is what Mike Pennington said. Topology C is what you can do if you get a few addresses from your ISP.