RE: [NAT] NAT question

I don't know about TCP, but with UDP, "IP Masquerade" (Linux) will
forward the UDP packet to the proper destination, but without
translating the source address.  This means the server reply will go
directly back to the client private IP, rather than through the NAT.  I
guess this is more efficient routing, but would confuse most protocols,
since the reply is coming from the server private IP, rather than the
NAT address it was sent to.  If it does the same thing with TCP, that
would explain the problem.  Not sure if there is any reason why it works
this way, or if it just turned out that way.  It would seem to be more
sensible if the NAT treated all packets addressed to the external
address the same, whether they originate internally or externally.  If
you want more efficient routing, THEN make sure the clients on the
private network use the server's private IP in the first place.

Tim

> -----Original Message-----
> From: Matt Alexander [mailto:m@netpro.to]
> Sent: Wednesday, August 22, 2001 5:15 PM
> To: nat@ietf.org
> Subject: [NAT] NAT question
> 
> 
> I have a question about NAT (IP Masq) that I've wondered about...
> Let's say you have a setup like this:
> 
> 
>      Internet
>      --------
>         |
>         |
>         |
>      |-----|
>      | NAT |
>      |-----|
>         |
>         |
>      |-----|       |------|
>      | HUB |-------| Web  |
>      |-----|       |Server|
>         |          |------|
>         |
>     |--------|
>     | client |
>     |--------|
> 
> 
> The NAT box is also port-forwarding any requests on the 
> external interface
> for port 80 to the Web server.  The web server and the client 
> boxes have
> private IP addresses.  Users connecting from the Internet are able to
> access the Web server without any problems, but if a user 
> sitting on the
> internal network on the client box tries to access the web server, it
> will do a lookup and get the external IP address of the NAT 
> box, and the
> connection to the web server will fail.  In the past I've 
> dealt with this
> situation by either putting the web server's private IP 
> address in all the
> client's hosts files, or I've setup a DNS server on the 
> internal network.
> So my question is, why does NAT fail in this situation?  Why 
> doesn't the
> client's request get redirected back to the web server?  I'm fairly
> comfortable with TCP/IP so feel free to get as detailed as possible.
> Thanks,
> ~M
> 
> 
> _______________________________________________
> nat mailing list
> nat@ietf.org
> http://www1.ietf.org/mailman/listinfo/nat
> 

_______________________________________________
nat mailing list
nat@ietf.org
http://www1.ietf.org/mailman/listinfo/nat