User manual MAXTOR NAT2

[. . . ] We can classify IP addresses in two kinds: local (private) and global (public). Local IP addresses can not be used on the Internet and are mostly used on Local AreaNetworks (LANs). Public addresses are valid on the Internet and must be properly registered so information can be sent to them. [. . . ] The PAT will perform a mapping between local port addresses and global port addresses from a pool of availble port addresses. The advantage of this scheme, in addition to those mentioned above, is cost savings; only one ISP account and IP address is required. In addition, the PAT scheme provides privacy since the internal LAN is unavailable to hosts on the Internet; all they can see is the single IP address interface provided by the PAT device. © Matrox Networks 1999 TechNote #2 - NAT How Does It Work? Page 2 of 3 When a host on the LAN makes a request to the Internet an entry is added to a NAT table in the Matrox iSwitch. This table entry contains two important pieces of information. The first piece of information is the translation from the local to the global IP address that is necessary to allow the request to go on to the Internet. The second piece of information is the translation from the port number assigned by the host to a port number randomly assigned by the iSwitch. The port modification allows the iSwitch to send the reply it receives to the correct host on the LAN (remember that all host requests have been mapped into a common IP address). Another benefit of having table entries and randomly assigned port numbers is that data coming from the Internet can be checked to ensure that it is in response to a specific request from a host on the LAN. Supported Applications: The Matrox iSwitch NAT will support most "well-behaved" applications. An application that is not "well-behaved" is one that uses IP address and port information directly. A NAT modifies IP address and port information so that any application that makes use of this information will not function correctly unless explicit support is provided. Another way in which an application is not "well-behaved" is when it attempts to open a new port rather than using the original port. This will be problematic because there is no entry in the NAT translation table for that IP address and port. Consequently, the Matrox iSwitch assumes that this is a hacker and discards the packet. The File Transfer Protocol (FTP) is a good example of an application that is not "well-behaved" since it does both. First, FTP contains the IP address in its application data but the Matrox iSwitch NAT explicitly modifies the FTP application data to be aware of the address modifications that were made. [. . . ] Disabling NAT: Disabling the NAT feature is NOT recommended since it also involves bypassing all other firewall features (packet filtering, user and site control, and so on). © Matrox Networks 1999 TechNote #2 - NAT 5. Pre-defined Packet Filter Rules: Page 3 of 3 In some cases, data that is not in response to a request from the LAN must enter either the Matrox iSwitch or the LAN. In such cases, pre-defined packet filter rules (or holes) are added to the NAT table. [. . . ]