NAT

本文介绍了网络地址转换(NAT)的基本概念及其两种主要类型:动态NAT和静态NAT。NAT允许本地网络使用一组IP地址进行内部通信,并使用另一组地址连接到外部网络。文章还探讨了NAT的主要作用,包括防火墙功能、内部地址隐藏以及通过整合多个ISDN连接来简化互联网接入。
 What's NAT(network address translation) ?

网络地址转换

NAT is an Internet standard that enables a local-area network (LAN) to use one set of IP addresses for internal traffic and a second set of addresses for external traffic. A NAT box located where the LAN meets the Internet makes all necessary IP address translations.

NAT serves three main purposes:
* Provides a type of firewall by hiding internal IP addresses
* Enables a company to use more internal IP addresses. Since they're used     internally only, there's no possibility of conflict with IP addresses used by other companies and organizations.
* Allows a company to combine multiple ISDN connections into a single Internet connection.

Two types of NAT
  dynamic NAT
A type of NAT in which a private IP address is mapped to a public IP address drawing from a pool of registered (public) IP addresses. Typically, the NAT router in a network will keep a table of registered IP addresses, and when a private IP address requests access to the Internet, the router chooses an IP address from the table that is not at the time being used by another private IP address. Dynamic NAT helps to secure a network as it masks the internal configuration of a private network and makes it difficult for someone outside the network to monitor individual usage patterns. Another advantage of dynamic NAT is that it allows a private network to use private IP addresses that are invalid on the Internet but useful as internal addresses.
  static NAT
A type of NAT in which a private IP address is mapped to a public IP address, where the public address is always the same IP address (i.e., it has a static address). This allows an internal host, such as a Web server, to have an unregistered (private) IP address and still be reachable over the Internet.
10-16
### NAT 网络地址转换原理 NATNetwork Address Translation,网络地址转换)是一种用于将私有网络中的专用IP地址转换为公共网络中合法全球唯一IP地址的技术。其主要目的是解决IPv4地址耗尽问题,并增强网络安全性和灵活性。 #### 原理概述 NAT的核心在于维护一张映射表,记录内部私有IP地址与外部公有IP地址之间的对应关系。根据不同的应用场景和技术需求,NAT分为静态NAT、动态NAT和端口多路复用(PAT)。 - **静态NAT**:一对一地将内部私有IP地址永久映射到一个固定的公有IP地址上[^5]。这种方式适合需要长期对外提供服务的设备,例如Web服务器或邮件服务器。 - **动态NAT**:允许多个内部私有IP地址临时映射到一组公有IP地址池中的某一个地址上[^1]。这种模式下,每次连接都会重新分配一个新的公有IP地址给请求者,直到该地址不再被使用为止。 - **端口多路复用(PAT)**:进一步扩展了动态NAT的功能,允许多个内部主机共享同一个公有IP地址并通过不同端口号区分流量[^5]。这是当前最常用的NAT形式之一,因为它能够显著减少所需的公有IP地址数量。 #### 工作机制 当配置了动态NAT的内部设备尝试访问外部网络时,路由器会自动从预定义好的公有IP地址池里选取未使用的地址来完成此次通信过程;如果所有可用地址都被占用,则新的连接请求会被拒绝[^2]。对于PAT而言,除了简单的IP地址替换外还会涉及TCP/UDP协议层面上的信息修改——具体来说就是调整源端口号以便后续返回的数据包能正确找到目标机器[^3]。 --- ### NAT 配置方法 以下是基于华为设备的一般性指导步骤: #### 创建地址池 首先需定义可用于转换操作的目标范围即所谓的“地址组”。命令如下所示: ```shell [Huawei] nat address-group group-index start-address end-address ``` 其中`group-index`代表自定编号用来标识这个特定集合;而`start-address`至`end-address`则明确了实际可供选用的具体数值区间[^4]。 #### 设置内外接口属性 接着明确指出哪一侧属于局域网部分(`inside`)以及广域网方向(`outside`)。例如: ```shell [Huawei]interface GigabitEthernet 0/0/1 [Huawei-GigabitEthernet0/0/1] ip address inside [Huawei]interface GigabitEthernet 0/0/2 [Huawei-GigabitEthernet0/0/2] ip address outside ``` #### 启动NAT规则 最后一步便是关联之前准备好的各项参数形成完整的策略描述语句。如果是执行标准型态下的简单互换动作可以直接写成这样子的形式即可满足大部分基础用途的要求: ```shell [Huawei] acl number 2000 [Huawei-acl-basic-2000] rule permit source private-network-subnet mask-length [Huawei] nat address-group group-index outbound interface-name ``` 这里需要注意的是ACL列表应当精确匹配希望参与变换流程的所有可能发起方所在位置段落信息[^4]。 而对于更复杂的场景比如涉及到PAT的情况,则需要用到稍微复杂一点的指令结构来进行处理: ```shell Router(config)#ip nat inside source list access-list-number pool name overload ``` 此条目里的关键字overload正是指示启用端口重叠特性从而达成最大化利用单一公网出口的目的[^3]。 --- ### 示例代码展示 下面给出一段综合性的脚本样例供参考学习之用: ```shell # 定义地址池 [Huawei] nat address-group 1 192.168.1.100 192.168.1.150 # 设定内网接口 [Huawei]interface GigabitEthernet 0/0/1 [Huawei-GigabitEthernet0/0/1] ip address 172.16.0.1 255.255.255.0 [Huawei-GigabitEthernet0/0/1] nat inside # 设定外网接口 [Huawei]interface GigabitEthernet 0/0/2 [Huawei-GigabitEthernet0/0/2] ip address 202.100.1.1 255.255.255.0 [Huawei-GigabitEthernet0/0/2] nat outside # 编辑访问控制列表 [Huawei] acl number 2000 [Huawei-acl-basic-2000] rule permit source 172.16.0.0 0.0.255.255 # 应用NAT规则 [Huawei] nat address-group 1 outbound GigabitEthernet 0/0/2 ``` ---
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值