symmetric NAT and ICMP

symmetric NAT and ICMP

[ratheesh k]

I have two machine , say A ,B connected to lan subnet of  Router R .
Router R is a linux (2.6.18 ) machine with two interface eth0 and eth1
.
eth0 is connected to lan side and eth1 is connected to wan side .

192.168.1.100/24
A ----- |                                                            |    |
         | --------------->  lan (eth0 ) (192.168.1.1/24) | R |
wan(eth1) 10.232.18.100  ----------->
B------ |                                                            |    |
192.168.1.200/24

My understanding is : - NAT on Router R is  symmetric nat . I am able
to browse internet from both machine A  and B .

My question is : Can Router R can support different types of NAT
simultaneously ( full cone nat  ,address restricted nat ....etc ) ?

IF only one type of nat is supported , how "ping  google.com " works
from both machine ? icmp dont have any port information .Still
icmp-reply gets routed to correct machine ?

Thanks,
Ratheesh

Re: symmetric NAT and ICMP

[ratheesh k]

[-- Attachment #1: Type: text/plain, Size: 1146 bytes --]

  Diagram is vague . Please find attached file .



On Wed, May 5, 2010 at 3:59 PM, ratheesh k <ratheesh.ksz@gmail.com> wrote:
> I have two machine , say A ,B connected to lan subnet of  Router R .
> Router R is a linux (2.6.18 ) machine with two interface eth0 and eth1
> .
> eth0 is connected to lan side and eth1 is connected to wan side .
>
> 192.168.1.100/24
> A ----- |                                                            |    |
>         | --------------->  lan (eth0 ) (192.168.1.1/24) | R |
> wan(eth1) 10.232.18.100  ----------->
> B------ |                                                            |    |
> 192.168.1.200/24
>
> My understanding is : - NAT on Router R is  symmetric nat . I am able
> to browse internet from both machine A  and B .
>
> My question is : Can Router R can support different types of NAT
> simultaneously ( full cone nat  ,address restricted nat ....etc ) ?
>
> IF only one type of nat is supported , how "ping  google.com " works
> from both machine ? icmp dont have any port information .Still
> icmp-reply gets routed to correct machine ?
>
> Thanks,
> Ratheesh
>

[-- Attachment #2: icmp_symmetricnat.JPG --]
[-- Type: image/jpeg, Size: 17801 bytes --]

Re: symmetric NAT and ICMP

[Pascal Hambourg]

Hello,

ratheesh k a écrit :
> 
> My understanding is : - NAT on Router R is  symmetric nat . I am able
> to browse internet from both machine A  and B .
> 
> My question is : Can Router R can support different types of NAT
> simultaneously ( full cone nat  ,address restricted nat ....etc ) ?

I don't think so. NAT behaviour is determined by how the connection
tracking works.

> IF only one type of nat is supported , how "ping  google.com " works
> from both machine ? icmp dont have any port information .Still
> icmp-reply gets routed to correct machine ?

ICMP request/reply types (echo, timestamp...) contain an identifier
field that helps matching requests and replies (Cf. RFC 792). Conntrack
uses it, see /proc/net/ip_conntrack or /proc/net/nf_conntrack, e.g. :

icmp     1 27 src=192.168.0.1 dst=192.168.0.2 type=8 code=0 id=62027
[UNREPLIED] src=192.168.0.2 dst=192.168.0.1 type=0 code=0 id=62027 use=2
mark=0
icmp     1 14 src=192.168.0.1 dst=192.168.0.2 type=8 code=0 id=61259
[UNREPLIED] src=192.168.0.2 dst=192.168.0.1 type=0 code=0 id=61259 use=1
mark=0

Two different pings with the same source and destination but different
identifiers create two separate conntrack entries.

Re: symmetric NAT and ICMP

[ratheesh k]

> Two different pings with the same source and destination but different
> identifiers create two separate conntrack entries.

Beautiful . Thanks a ton .



On Wed, May 5, 2010 at 4:59 PM, Pascal Hambourg
<pascal.mail@plouf.fr.eu.org> wrote:
> Hello,
>
> ratheesh k a écrit :
>>
>> My understanding is : - NAT on Router R is  symmetric nat . I am able
>> to browse internet from both machine A  and B .
>>
>> My question is : Can Router R can support different types of NAT
>> simultaneously ( full cone nat  ,address restricted nat ....etc ) ?
>
> I don't think so. NAT behaviour is determined by how the connection
> tracking works.
>
>> IF only one type of nat is supported , how "ping  google.com " works
>> from both machine ? icmp dont have any port information .Still
>> icmp-reply gets routed to correct machine ?
>
> ICMP request/reply types (echo, timestamp...) contain an identifier
> field that helps matching requests and replies (Cf. RFC 792). Conntrack
> uses it, see /proc/net/ip_conntrack or /proc/net/nf_conntrack, e.g. :
>
> icmp     1 27 src=192.168.0.1 dst=192.168.0.2 type=8 code=0 id=62027
> [UNREPLIED] src=192.168.0.2 dst=192.168.0.1 type=0 code=0 id=62027 use=2
> mark=0
> icmp     1 14 src=192.168.0.1 dst=192.168.0.2 type=8 code=0 id=61259
> [UNREPLIED] src=192.168.0.2 dst=192.168.0.1 type=0 code=0 id=61259 use=1
> mark=0
>
> Two different pings with the same source and destination but different
> identifiers create two separate conntrack entries.
>