NAT (Network address translation) is a fast way of packing multiple devices behind a single, public IP address.

For the DSL user, NAT is the easiest method of providing internet access to multiple PCs (whether home or office) no matter what the ISP has given them to work with in terms of IP addressing.

Many people use NAT without knowing it: Windows 98SE for example, with its "internet connection sharing" pack, is implementing NAT on the gateway machine, to provide net functions to others on your home network. Much other popular internet share software is NAT under another name.

NAT is the heart of many nifty network share devices, ones with an plug in, and a plug out - put one of these between your DSL line and a hub, and you can have 4, 8 or more computers sharing this one public IP address.

So what is the problem with NAT?

1. NAT and PPPoE

PPP does not sit mix well with NAT. Microsoft Windows 98SE ICS option will not work, and Microsoft recommend another NAT utility, Share the net, instead. Many ether to Ether NAT boxes also break, and have received quick brain surgery to get them back into shape. Boxes such as the Zyxel for example, are now capable of handling PPPoE and NAT in one.

2. NAT and some protocols

Various internet protocols break with a vanilla NAT implementation. FTP for example, will operate in two modes, passive and active. NAT does not support active mode FTP, so clients must be found that will operate in passive mode.

Folks attempting to use IRC servers will find the servers may reject their connection because they cannot find an identd daemon on your "public" IP address to query.

Multiple sessions on one game server may not work - the game server will not understand the difference between the two players, as they both seem to originate from the same address.

Popular programs like ICQ and Dialpad.com also require NAT settings to map ports from the outside to the inside, otherwise they operate in degraded mode or not at all.

Linux users are in the happy situation of being able to install kernel modules that cope with any number of these problems - they recognize the protocol and operate specially on the data to restore full services.

3. NAT and Security

NAT is actually great for security - it functions as a firewall for incoming connection requests: NAT will only pass on traffic on a pre-existing connection, so unless you "speak" to the net, the net is not allowed to "speak" to you. Do not assume NAT is the same as a firewall, however! firewalls allow rules, can inspect packets, and operate on many levels.. NAT is normally very simple, and will do nothing to stop data from inside your domain escaping to the net, or setting up a conversation with something on the net!

4. NAT and Encryption / VPNs

Having built defenses to stop the outside world getting in, or the inside world getting out, (firewalls), the next challenge is to stop the outside world snooping your conversation. This is solved, to some extent, by standard security methods in common use on the net: Everyone who has shopped online, has used secure web connections (when the little padlock icon goes on), and system administrators like to use secure telnet to remotely administer machines. This encryption is of the payload of the data packets, but not the packet addresses (headers) of each layer of protocol.

The next level up of security is end-to-end encryption or IPSEC tunnel. In this more secure system, even the packet addressing details are encrypted (tunnelled) inside packets that are addressed to the other end. By encrypting everything except the minimum required to get each packet to the other end, potential for evesdrop or meddling is dramatically reduced. IPSEC tunnel level protocol is probably the most secure open standard available and in common use on the net today.

5. NAT and IPSEC Tunnel

To work, NAT must re-write the header portion of each packet, to make it appear like it was coming from the public IP address, it must also re-write incoming packet headers, to address them to the machine responsible for the conversation in progress... this is a necessary function of NAT. Can you see the problem yet? IPSEC tunnel method is, by design, hardened against this: by breaking the "seal" on the letter, the whole package is no longer trusted by the recipient, and breaking the seal itself requires knowledge of the keys used to encypt it in the first place!

6. Why do we care about VPNs?

If you need to provide secure access to company resources to employees on the road, you need to give them the best VPN (virtual private network) solution. If NAT devices or firewalls exist at either your corporate gateway, or homes, then IPSEC tunnel is not going to work, at least in standard form! Corporate policy may not allow switching down to the less secure IPSEC transport level security.

7. VPN solutions with NAT

The long term solution is going to be IPv6 - the new IP address space that provides thousands of IPs per square metre of the globe: NAT is not required when everything is uniquely addressable.. (at least the IP shortage problem that drives NAT adoption is no longer there), although firewalls and other reasons to hide private nets may still be. Unfortunately, IPv6 is some way off.
IPSEC software packages, such as the system from NetSeal claim to have worked around the problem by allowing corporate firewalls and internal machines to work together to communicate the nature of the transmission, as well as tag the encrypted transmission itself, thus providing the firewall with enough information to make decisions based on its standard rule-set, without the overhead of decryption and recryption of every byte of data. NetSeal would require comprehensive adoption though.

The ISB2LAN NAT box (see our equipment page) has been tweaked to cope with VPN solutions: simply by recognizing encrypted packets as trustworthy, it points them at a single internal address, so Mum can be using her secure VPN from the office, while the rest of the family fool around on the net using regular NAT.. not a very elegant solution, but for home use, it is quick and effective, and more importantly may be the only solution available under the circumstances.