All language subtitles for 32 - Routing - NAT Concepts-eng

>> This last week my wife and
I were cleaning out the garage,

which we do on probably a quarterly basis when
it gets all cluttered and you move it all out.

So we were moving some stuff, and I kind of,
I had to wiggle the water heater a little bit

to move something behind it,
and you know, continue on.

So later that morning we found this giant
puddle just, you know, all over the floor

in the garage, and my wife
was like, "What's this?"

And I looked up, and sure enough
the water heater is dripping

because by wiggling I had broken
one of the copper lines going to it,

like there was just a pinhole leaking, and it
just kind of sprang out, and I was like, "Oh."

So we turn off the water, and my wife was like,
"What have you got to do," and I was like,

"Well, I'm afraid I'm going
to have to solder that."

Now let me tell you.

Since I've learned to solder, like this was a
year ago a friend of mine was like, "Oh, yeah,

here's how you sweat the line, how you,
you know, put the bead of solder in there,

and like any chance to solder something,
I'm like, "I'm there" [laughter]

because it's awesome, and I came
in and told my wife, I'm like,

"There's not much that makes you feel like
a man than soldering some copper pipe,"

and she laughed at me, but nonetheless, I
soldered the line, and that's what NAT is to me.

When I first learned how NAT, Network Address
Translation, really works behind the scenes,

I was like, "That's awesome," and any
chance I could get, you know, I...

we'd be at a friend's house and setting up a
little link sys device for them or something

to route their Internet connection, I'm
like, "You want to know how that works?"

And they'd, you know, always
kind of look at me like...

and I'd say, "No, let me show you.

I want to show you how this works
because it's amazing," and so NAT is one

of those cool concepts, and through all the
years, it still has not lost its luster.

Now is its time short?

Maybe. Now it may fade away
some day as IPV6 takes hold,

but I will say it is the staple
of every network of the world.

I would challenge you to find me a
network in this world that is connected

to the Internet that is not using NAT.

They're out there, but I mean I
probably could count them on one hand.

So Network Address Translation
is what we're all about.

We're going to talk about how it works.

Next nugget we'll tell you
about how to set it up.

Did you know that you could
build your own Internet?

All you have to do is go to your house and
set up a network and then go to your neighbor

and say, "Hey, you want to join my network?"

And connect a cable to his house, and then tell
him, "You've got to connect at least 5 neighbors

to you," and so they connect their 5 neighbors,

and you kind of start your own little pyramid
Amway scheme or something like that, you know,

all your neighborhood connected, and
before long it keeps exponentially growing,

and poof, worldwide span.

You've got your own Internet because
that's really all the Internet is,

is just a big network.

Instead of houses, it started with some
college universities that are like, "Hey,

let's share some files," and, you know,
4 universities connected together,

and other college campuses were
like, "Hey, let's jump in on that,"

and then a business partnered in, and
they jumped in, and then .com came along,

and someone was like, "We can sell stuff here?

Woo." And then, poof, you
know, Internet explodes.

Everybody needs to be on there, and now it's
one of the staples of every business is you have

to have an Internet connection really
anymore to do business in most locations.

So the problem with that is we've now brought
masses of devices and masses of equipment,

and there's a limited scope
on the IPV4 address space.

There's not enough public IP address spaces or
Internet valid IP addresses that are available.

So management entities were created, and
the government got involved and said,

"Okay we will sell or provision blocks of IP
addresses like, you know, we'll say the...

I'm just throwing one out there...

13.1.0.0/16, like that big block of
IP addresses, 65,000 IP addresses,

we're going to give that
to some service provider."

Let's just say AT&T.

I'm just throwing one out there, right?

So AT&T gets that, an then they
provision it for their customers, and,

you know, somebody signs up for a DSL...

I don't even know if AT&T does
DSL, but we'll go with it.

A DSL connection from AT&T, and AT&T says,
"Okay, you can have one of our IP addresses

for a limited amount of time that you
can use on your different devices."

So, I mean, they had to have ways of
provisioning and allocating these IP addresses

because there are exponentially far more devices
in the world today than there are IP addresses.

Now with this management in place,
we also had to have something

that allowed people to create
their own networks.

Like, you don't want to have to go to
some management entity and go, you know,

to set up your house and say, "Hey, I'd
to use, you know, 5 computers in my house.

Is that okay?"

I mean in the same way, take it this way.

You ever bought a cordless phone?

I mean, now, with cell phones, right?

Everybody's like, well, whatever, but I
mean cordless phone for your house, right?

You don't have to go to the FCC and register
for a broadcasting license for your cordless,

you know, 900 megahertz phone, or
whatever kind of phone you have

because it is part of the unlicensed band.

I mean, you are technically broadcasting.

You're creating a signal that could
interfere with others in the air, but the FCC,

meaning the government entity of the
United States that governs, you know,

so nobody can just run their own radio
station from home or something like that.

They have said that 900 megahertz, 2.4
gigahertz, and 5 gigahertz are unmanaged bands.

That's why you can set up your own
little wireless network in your house.

You don't have to register for that.

So in this same way, with IP addresses,
they said, "We need to let people set

up their own networks without actually going
to the government and saying, 'Can I do this?

Am I allowed?'" So they came up with private
addresses space I said that totally wrong...

private address space, and
you've seen these before, right?

10.0.0.0 through 10.255.255.255.

Once somebody...

this is a weird one...

172.16.0.0 through 172.31.255.255, and
that's a little chunk in the middle there.

This is Class A, this is Class B,
and then Class C, those famous,

do-do-do-do, toot the trumpets, 192.168.

anything is considered private addresses.

So like private, wireless frequencies,

we can just use these addresses wherever
we want because they're unmanaged.

You don't have to have a
license to use them, but...

but, you know, let's say
this is you and your company.

You've created your own little world
on, let's just say, 192.168.1.0/24.

You know, you've got your own little
server back here, your own little client.

You've got your own little
network that's working great,

but the problem is 9 million people
in the world are also using...

probably 9 billion.

Wait a second.

I'm exceeding the population,
but you get the point.

Tons of people are using 192.168.1
in their home because it's unmanaged.

So we have to have a way of hiding your network
from the world and yet still allowing you

to use this public world, and
that's where NAT comes in.

Network Address Translation at
its root translates from a...

well, let me just, you know, the technical
definition, technically translates

from one IP address to another, but
really the big picture is it translates

from private addresses, which work inside
of your house and actually would work

on the Internet if service
providers would let them through,

but it translates from private
addresses to public addresses.

Now let me say one more quick
thing before we move on here.

One of the biggest misnomers that I've
heard, and you may have heard this, too,

I just want to debunk this right now.

A lot of people say, "Oh, yeah.

Those are non-routable IP addresses."

Have you ever that before, where somebody
identifies those private addresses.

"Oh, those are non-routable IP addresses."

Totally not a good way to say it
because they work perfectly fine.

I mean, you can set up...

Oh, I'm flabbergasted...

I'm appalled at that because this entire
series we've been setting up routing.

I mean we went in OSPF and set up, you know,
these routers on 192.168.1 and .2 and .3,

and we said, "Okay, this can reach
this," and we're routing those just fine.

So if you're going to say they're non
routable, I would say they're non routable

but add in there, always
add in, on the Internet.

They're non routable on the Internet.

Now even that, I'm like ew-w-w,
because if they were to somehow get

into the Internet, they would route just fine.

What really happens is to be a service provider,
to be an ISP, you are supposed to block,

these are all considered RFC1918, and if
you ever want to know what is the standard

that specifies private addresses?

RFC1918. It's the only way I can tell you
off the top of my head, but as an ISP,

you are supposed to block, you know,
you've got your customer, we'll say,

over here that is coming in, you are supposed
to block all these addresses from coming in.

There have been mistakes.

ISP's have forgotten to block customer IP
addresses, and the customer has forgotten

to turn on NAT and to what the public addresses,
and there have been cases, you can look them up,

to where private IP addresses have gotten
into the Internet, and it was actually so bad,

it was over in Europe somewhere, that
I can't quite remember the whole...

This was a long time ago, but essentially there
was one ISP that forgot to block their customer,

and all these other ISP's trusted this ISP.

So they didn't put the block here because
they were like, "Well, why do block private."

They were assuming that, you know, our
ISP friend down there is blocking it.

So we don't need to put those blocks
here, and they actually had a case

where like a whole chunk of
Europe went down on the Internet

because of these private
addresses had leaked in there.

Well, no more.

I'm sure that's taught everybody a big lesson.

So the point is that private
addresses route great.

They just are blocked from
getting in from the Internet.

When you think about NAT, you can think of
it as an umbrella of three different flavors.

You can have static NAT-very common.

You can have dynamic NAT, which is not very
common, and then you can have something

that some people call it NAT overload.

Some people call it PAT.

That's probably the more common word , Port
Address Translation, which is insanely common,

like that's the staple that
just about every business has.

What PAT does...

I'm going to talk about all 3, but I want
to talk about the most popular one first

because almost every business
in the world uses it.

What this one does is stretch an IP address
further than I'm sure the founding fathers

of the Internet ever thought it could go.

So here's...

let me give you the big picture concept of PAT.

So what...

every time you have a connection, and
this, you know, to understand NAT you have

to understand how devices communicate, right?

So let's think back, I mean, go back to
your old nugget number 5 or 6 of the series

where we were starting to talk about, okay,
communication, we've got a source IP address,

let's just say 10.1.1.10, and we've got
a destination IP address 10.1.1.100,

no routers in the middle to garble this all
up, and let's just say this is a web server,

this is a client, and I open my web browser
and try and access that, what happens?

Well that's where we said, okay, the
Windows, you know, Windows or Lenox or OX,

whatever you're using here generates
a source port number dynamically.

It says, "Okay, I'm coming
form the source 1000...

well, let's just do 1892.

It makes those up, and I'm going to a
destination, now if this is a web server,

I'm going to a destination
of port 80, right, and we...

I'm doing a little review here of early topics.

We call that it creating a
socket because this says, "Okay,

I'm coming from the source 10.1.1.10:1892, and
I'm going to the destination of 10.1.1.100:80."

And when this guy communicates back he comes
from the source of 80 and goes to a destination

of 1892, and that's how Windows knows,
oh, you're going to this, you know,

Google Chrome window or whatever
browser we happen to use to browse at.

So that's how it works.

Now you can...

let's think a little bit further.

How many port numbers are there?

I mean, we picked 1892, but
really, how many are there?

Well for TCP and UDP there's 65,535
usable ports that you're able

to work with, you know, outside of...

I mean you can get into well known ports and
blah, blah, blah, but I mean 65,000 ports.

Now is this...

question...

is this computer ever going to tap that out?

No. No. I'm like well...

I always try and find the exceptions, right?

No, it's not because you just
can't open enough applications.

That computer would crash long
before it would max those things out.

So the point is we have all these
port numbers that we can use.

Okay. Okay, we've established a foundation.

Now here's how PAT works.

We have a network.

It could be, you know, 2
clients like we have here.

It could be 100 clients.

It could be 1,000 clients, whatever we
have running inside of our organization,

and we've got a router in place, let's
say 192.168.1.1 is the default gateway

of these guys, and we've got the public IP
address assigned, 200.1.1.1, and this, you know,

this would actually go to a router of the ISP...

whatever ISP you are, and this default
route would point out this way.

So when this guy...

let's go to this guy, and he opens a web
browser, you know, Google Chrome and goes

to a server out on the Internet-we'll
just say it is CBTNUGGETS.com, and...

if I can write.

There we go.

So he goes to CBTNUGGETS.com.

He's going to automatically, just like we saw
over there, generate its own source port number.

So he's going to say, "Okay, Chrome,
I'm going to generate source port...

I'll use my diagram...

6711." That's my source.

That's where I'm going to, and I'm going
to go to a destination of, let's just say,

CBTNUGGETS.com because it's easy to write.

It's 1.1.1.1.

I'm going to go to a destination
of 80, right there, right?

So that request will come into the
router that is configured to do PAT

or NAT overload is what CISCO config calls it.

So it receives that request and it
goes, "Okay, I'm going to translate you

because I know these private
addresses do not work on the Internet.

If I were to send you out as
192.168.50, the ISP would say [noise]

and block you, and you would die right there.

So I'm going to translate you to 200.1.1.1.

Now the way I'm going to do that is I'm going to
use your source port number to make you unique."

You see what happens.

So it creates a little table inside, and the
table's actually bigger than this, but it says,

okay the inside address, 192.168.1.50,
it's like a spreadsheet inside the router,

it's actually going to go to
the outside address 200.1.1.1,

and it's going to use that
same source port number.

So that way now it comes out as
200.1.1.1 goes to CBTNUGGETS.com.

CBTNUGGETS sees it coming from
the source of 200.1.1.1:6711 and,

you know, sends the webpage back to that.

It's received here on the
router, goes, oh, okay, well,

you're actually going back into this guy.

So that's what allows this guy at the same
time to open up a different web browser, well,

Chrome, or I'm not talking about
like Firefox or anything like that,

but let's just say he opens Firefox or
Chrome or whatever and goes to the same web.

I mean, he could go to CBTNUGGETS.com.

Well, his computer, it randomly grabs a port
from 65,535, and it's going to say, "Okay,

well I picked port 15396, and
I want to go to CBTNUGETS.com."

So he goes out to CBTNUGGETS.com.

Are you following me here?

And I want to make sure you catch me.

So he generated his own source port.

Windows did that for him behind the scenes.

NAT kicked in and said, "Okay, I'm going
to use that source port number so as you go

through that router, I'm going to
translate you to my public address,

but I'm going to put a little
colon 1536," and do you kind

of get why it's called PAT,
Port Address Translation?

It's using the ports to make
all these requests look unique,

and I'm going to send you to CBTNUGGETS.com.

If CBTNUGGETS.com gets a
request from 200.1.1.1:6711

and gets a second request
at the same exact time...

let's just say they did this at the same time
because they both wanted their CBTNUGGETS,

and it sees a request to 1536, it
actually sees these as two unique requests.

It doesn't see them as one IP address.

It's like, "Whoa, this must be the same thing."

No it looks at the port number, and it's
like, "Oh, I've got two unique requests."

So, okay, in theory, in theory...

we're talking theory, we
could use this one IP address

to service 65,535 computers
sitting behind there.

You could share that to 65,535
devices in theory.

Now here, let me now get to...

I know a lot of you are analytical, and
you're like, okay, okay, what if....

Let me see if I can predict a question
rolling around in somebody's mind.

I'm feeling you right now.

You're going what if, 1 in 65,000 chance,
this computer opens a web browser and goes

to CBTNUGGETS and at the same time this computer
opens a web browser and goes to CBTNUGGETS.com,

and they just happened to
pick the same port number.

Did I read your mind?

So both of them picked 65...

6711. Not a big deal.

Yeah, well how's it not a big deal?

What the router does is just say, you
know, let's say this guy got there...

one of them's going to have to get there first.

The packet, the router can't
two packets at the same time.

It has to have one in front of the other.

So whoever gets there first gets the 6711.

When this guy comes in, he's
like, "Oh, I want 6711, too."

The router's like, "Oh, like I don't have that.

That's all right, I'm going to give you 6712."

That's the next free one that I have in
my list or whatever, the next open port.

So these don't have to match.

I mean you figure the router's got the
big Excel spreadsheet thing going, right?

It going to have to like, "Oh, well, oh no.

I'm sorry.

I don't have that available."

It's totally fine.

So it will increment that and life is
good, and, you know, this guy, you know,

so it's seen from CBTNUGGETS as
6712, but when it replies back,

it's like, "Oh, well, 6712 is really 6711.

So let me send that back to him."

So that's how it works it all out.

No biggie there.

And, I know I was kind of like stretching it,
making it sound like, oh, you know 1 in 65,000?

Truth is, this happens all the
time, all the time because...

and this is where I go back
to the theory-65,000 devices.

It's a theory because when you
open a device, let me show you.

Let me show you this.

I'm going to open a command prompt, and
I'm just going to open a web browser to...

how is it...

technet right there, right?

So let's go to the biggest waste of time
website on the Internet, and msn.com.

"Dozens injured after ferry hits NY city dock."

So, you know, when I go here,
this isn't just one website.

I think I told you this early
on in the series, right?

I've got a webserver that
gives you this picture.

I've got these fancy looking ladies.

I've got Geico.

I mean, all of this webpage is just an assembly
of, wow, this is creepy, but an assembly of...

You ever see that movie with Will Smith, the...

oh, where they...

the creatures like [noise].

That's what the guy looks like.

So it's an assembly of all
kinds of different webpages.

So when I go to the command prompt and type
in netstat, I actually see all kinds...

now look at this.

Firefox with bing.

That's funny.

So there's all kinds of different servers
that I was actually sent to for this one.

Now look at this.

These are all like my one computer used this
and this and this and this and this and this.

I mean these are all source port
numbers, and it's kind of hanging up.

The reason it's taking a long time is
because it's trying to figure out what...

well, actually because I
clicked on there and it paused.

It's trying to figure out what name each one
of these IP addresses actually resolve to.

So my one computer actually ended up using...

I mean, the list continues to build, right?

Probably, I don't know, 50 different
port numbers just to go to msn.com

and see the scary guy in the scene.

So the truth is, I mean, you...

in theory if every computer only went to one
place and it only used one port number, yes,

we could get the 65,000, but nowadays, I
mean, you're probably with people web surfing,

you could probably stretch this to
maybe 300, maybe, you know, 500.

It depends on your web surfing people, how
many people are wasting life on msn.com

versus doing work and all at
the same time, and, I mean,

these things time out after
a certain amount of time.

So your mileage may vary but you can
add multiple IP addresses to this pool

that when one maxes out on port numbers,
the next one jumps in there and takes over,

but I digress into a lot of the specifics.

I just want to answer a lot
of the questions I know rattle

around people's mind when I bring this up.

At its root, if I could clear
this up, this is how PAT works.

This is how you can use one IP
address for many internal ones is

by sharing it using the magic of port numbers.

Now I have a different slide for static NAT,
but let me talk about dynamic really quick

because it's similar to PAT but not really.

So dynamic, what it allows you to do is
specify a pool of addresses that we could...

we'll just say they are public
and a pool of private addresses.

You know, we'll call it pool-private,
and what you can do

with that is have one-to-one
translations going through it.

So let's just say I say my private
pool is 192.168.1.0 through 250,

and I say my public pool is actually 200.1.1.,

well let's just say 1 to
250 because you can't use 0.

So 1 to 250 over here.

So what will happen is, you
know, the very first one

to go through, will get the first address here.

The second one to go through
will get the second address.

It's just a series of one-to-one links made
between the public and private IP addresses.

Now you don't really get any savings.

It's not like you save IP
addresses when you do this,

which is the reason why it's not used too often.

The main place dynamic NAT is used, and
it's not something we get into here,

is where you have overlapping addresses.

So let me give you a scenario.

Let's say you've got organization A over
here that uses, let's just say 10.1.0.0/16,

and you've got organization B over here
that uses the same address range, right?

And organization A does a hostile
takeover and buys organization B.

So I don't know why I add hostile into there.

It's just part of my nature.

So what you can do is you can introduce
a router in between that uses dynamic NAT

to where organization A looks like, we'll
just say, 10.2.0.0/16 to organization B,

and organization B may be looks like
10.3.0.0 to organization A. So that way,

you can kind of merge the two and they don't
really know they have overlapping addresses

because NAT is hiding it with this pool.

You create a pool of addresses in 10.2 then
line it up to organization A and create a pool

in 10.3 and line it up to
organization B. So that's

where you see Dynamic NAT used,
and it's only used temporarily.

Obviously that situation doesn't want
to hang around for any amount of time.

So the last form of NAT that I
want to talk about is Static NAT,

and this one is used all the time.

So we've got, you know, PAT, which is just
everywhere, and then we have Static NAT,

which is used all over the place.

A static NAT is a one-to-one mapping from
the inside to outside that doesn't change.

As you saw before with PAT, you
know, these little port number deals

that we're running where, you know, this guy
opens up a web browser and accesses cisco.com,

you know, he uses his port number.

Well as soon as he closes his web browser, that
session dies, and that NAT port ends up back

into the pool where it can be
used by anybody again, right?

But there's times where you want
to create a one-to-one mapping.

Maybe I say this one is always mapped to the
IP address 200.1.1.2, which is, you know,

the ISP believes you have that addresses
because they've given it to you.

So when somebody, you know, this is usually
let's say this one is actually an email server,

right?

So when you're running an email server in an
organization, emails are coming in from all

over the world, and they need
to be able to reach your router.

Now how would they know to come here?

How would all emails know to come right here?

Well, you would go to a DNS server.

Let's say, let's say your organization
NUGGETLAB.com Well what you do is wherever you

registered that domain, you
would go to the DNS control panel

and create a mx record, which
is the mail exchange.

You would say, okay, any time somebody sends
me mail, send it to, you know, 200.1.1.2,

and so that, you know, the mail
servers look up that mx record.

They would end up here, and you create a static
NAT mapping that says 200.1.1.2 really maps

to my email server at 192.168.1.51.

So this is usually used for inbound,
you know it's where things coming in,

but now this time this one goes out,
he will also go out as 200.1.1.2.

He doesn't go into the general pool over here.

Now you can use static NAT
as a one-to-one IP address,

or you can even break it down even further.

You could say 200.1.1.2 on port 25
maps to this email server on port 25.

So, by the way, port 25 is SMTP.

That's what email servers
use when they receive email.

So that allows you to say just that
port maps to that email server.

Why is that good?

Because public IP addresses
are at a premium, you know.

You want to conserve them as much as possible.

So you might be able to, you
know, use that for other things.

You might say, well, 200.1.1.2:80, you
know, HTTP services, those will actually go

to a third server inside of here.

Maybe we've got a server 192.168.1.100, and
that's our web server that we're running.

So if somebody accesses web services it
actually goes to that 192.168.1.100 on port 80,

and I can now kind of split this IP
address into all these different services.

So you say, oh, well, actually I
also want to sent 200.1.1.2:443,

which is HTTPS, to that same destination.

So you can really split this up, you know,
give it the whole IP address per server,

or you can break it down and say, well, these
go to these ports go to these different servers,

and really get the most out of each IP address.

Those are the concepts, and if it's at all fuzzy
right now, and hopefully it's not, but if it is,

it'll get much clearer when we start doing
the configuration in the next nugget.

So let's review.

We have seen what network
address translation is.

We have seen there's many ways to go public
to private, and we saw the static way,

the dynamic way, and then
using PAT as a way to do it.

Almost everybody in the world using PAT, almost
every business in the world using static NAT

to make servers available from the
inside out, and then we saw some,

I'll say some, of the NAT terms and locations.

We saw the inside, the outside addresses,
but when we get to the configuration,

you might remember I said there's actually
more to this where we get to things known

as inside local addresses
and inside global addresses.

You'll start being able to identify where these
different IP addresses are in the grand scheme

of things, but that's in the configuration.

So for now, I hope this has been informative
for you, and I'd like to thank you for viewing.