Chapter 5. Network Address Translation (NAT)

最新推荐文章于 2024-11-03 10:03:41 发布

chinasiyu

最新推荐文章于 2024-11-03 10:03:41 发布

阅读量688

点赞数

分类专栏：转《Guide To IP Layer Network Administration With Linux Version 0.4.4》文章标签： translation network protocols documentation networking application

转《Guide To IP Layer Network Administration With Linux Version 0.4.4》专栏收录该内容

48 篇文章

订阅专栏

本文介绍了Linux下两种类型的网络地址转换（NAT）：无状态NAT及目的地NAT（DNAT）。无状态NAT可在2.2及2.4内核版本中使用，而DNAT仅限于2.4内核版本，并且可以通过iptables工具进行配置。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Chapter 5. Network Address Translation (NAT)

Table of Contents

5.1. Rationale for and Introduction to NAT5.2. Application Layer Protocols with Embedded Network Information5.3. Stateless NAT with iproute2

5.3.1. Stateless NAT Packet Capture and Introduction5.3.2. Stateless NAT Practicum5.3.3. Conditional Stateless NAT

5.4. Stateless NAT and Packet Filtering5.5. Destination NAT with netfilter (DNAT)

5.5.1. Port Address Translation with DNAT

5.6. Port Address Translation (PAT) from Userspace5.7. Transparent PAT from Userspace

Network Address Translation (NAT) is a deceptively simple concept. NAT is the technique of rewriting addresses on a packet as it passes through a routing device. There are far reaching ramifications on network design and protocol compatibility wherever NAT is used.

This chapter will introduce two types of NAT available under linux. One, full NAT or stateless NAT, is available under kernel 2.2 and kernel 2.4 via the iproute2 userspace interface. Available only under kernel 2.4, destination NAT (DNAT) is an important derivative of full NAT. DNAT configuration from userspace is accomplished via the iptables utility. The experienced network administrator is probably puzzling about absent references to source NAT (SNAT) and masquerading. These prominent and prevalent uses of NAT are covered in Chapter 6, Masquerading and Source Network Address Translation, although many concepts involved in the special purpose SNAT and masquerading will be introduced in this chapter.

Network address translation is known by a number of names in the networking world: full NAT, one-to-one NAT and inbound NAT. As used in this chapter and throughout this documentation, NAT, when unqualified, will refer to full network address translation or one-to-one NAT. NAT techniques derived from full NAT, such as destination or source NAT, will be described as DNAT (destination NAT) and SNAT (source NAT).

Michael Hasenstein's seminal paper on network address translation is available courtesy of SuSe Linux AG here.