5.5 NAT and ports

You’ve seen how network address translation at the gateway router allows devices with private addresses to access the internet by systematic swapping of the original private address with the router’s internet address.

But that’s not quite the full story. What happens now if I ask for the same web page, once from my desktop and once from my laptop? The gateway is going to do its network address translation and change the source IP address in both requests to be its own. The web server will get two requests so it will send two replies. That’s fine, but when the replies come back to the gateway, one of these should be sent to my desktop and one to my laptop. Well, how is it going to sort them out?

There is a way to deal with this. I have been taking a liberty by only talking about IP addresses as the source and destination of traffic. But strictly I should also include the IP port number. IP port numbers are used to keep different streams of traffic separate on one computer. So for example, my PC may have one stream open to a website, another open to my email account. Traffic will come back to my IP address and be delivered to my PC, but it still needs to be delivered to the correct application. And it’s the port number that’s used to do that.

By the way, there’s possible confusion here with the network port as meaning the hole in which a cable’s going to be plugged – so here we’re talking about a software thing, not hardware. But the port is similar in the sense that both types of port are ways to keep connections separate.

Now, there are well-known port numbers for some traffic, for example port 80 is used for HTTP, that is web page traffic. So a request for a web page at MegaCorp will be to 77.0.0.2 port :80, while a mail request at MegaCorp might be to 77.0.0.2:23. The two port numbers, 80 and 23, will keep the traffic separate.

So my source address will also have a port number as well as an IP number. What will that be? Even if I’m asking for a web page, it won’t be port 80: the well-known numbers are reserved for server hosts, but there are many others available. My browser is acting as a client, so it will simply ask for a new unused port number from the operating system when it opens a connection to the website – it might get 4321 as the port number, so the full source address would then be 192.168.0.100:port 4321.Audio mistakenly says 192.168.1.100

Now, the gateway, when it replaces my IP address in outgoing packets, can also replace the port number. It will of course keep a record of what translations it’s handling in a table, so when packets come back to the router, it can be used to look up the port number it used, and change the port number and IP address back to, in my case, 192.168.0.100:port 4321.Audio mistakenly says 192.168.100

That means the two requests, one from my laptop and one from my desktop, as they go out can be given different port numbers. When the replies come back with different port numbers, the router can look up the port number in its table to decide which device, desktop or laptop, the request originally came from.

I can have a look at the NAT table in the gateway router. For example, this originated on my desktop 192.168.0.100 with a port number of 4321, which has been translated to 99.0.0.2; in this case it didn’t change the port number. Another request, that was actually going to the same destination web server 77.0.0.2:80, but was coming from my laptop with address 192.168.0.101 and port number of 1027, that’s been translated to 99.0.0.2 with a port number of 1033. So we have two distinct port numbers, 4321 and 1033, both sending requests to the same web server, 77.0.0.2:80. When the replies come back in from 77.0.0.2:80, we can use the port number there, 4321 or 1033, to decide which was the required destination IP address.

So we’ve seen how network address translation with port numbers allows me to browse from my desktop and from my laptop, to the same website, at the same time, without the traffic getting messed up.