1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

More things that NAT breaks?

Discussion in 'Networking (Hardware & Software)' started by moboking, 2005/01/05.

Thread Status:
Not open for further replies.
  1. 2005/01/05
    moboking

    moboking Inactive Thread Starter

    Joined:
    2004/12/26
    Messages:
    82
    Likes Received:
    0
    Let's say I run a webserver with a secured website that I want only an IP address to have access from. For example, the webserver is at the office and I only want me and me only to have access to it from my house. Both work and home have a static IP.

    However, the webserver at work is behind a NAT router. Because the way NAT works is that it translates one IP to another, how does the webserver behind it know that the incomming request is from me at home? I mean what the webserver sees is the LAN IP of the NAT router and not my real home IP right?

    I know I can use username and password to authenticate myself, but the point here I want in addition to username and password, I also want authentication by the IP of the incomming request from my home. Is there a way to have both of these access restrictions? Basically, a workaround solution for NAT in this context?
     
    moboking,
    #1
  2. 2005/01/05
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,068
    Likes Received:
    396
    First of all, the router does not translate ip addresses. Address translation is done by a DNS server. The router assigns ip addresses to the computers connected to it, and these addresses are not routable, meaning that they cannot be used on the WAN (wide area network such as www). These addreses are usually 192.x.x.x.

    The web server at work is assigned a local ip address by the router. To connect to this server from outside the local work network, e.g. your home, you must open up the web server to the WAN, the www. This is done by configuring the router so that port 80 requests are forwarded to the local ip of the web server. In this case, the router's NAT is bypassed and you should use security measures on the server itself, either a software firewall or an additional hardware device placed between the server and the router. You may also have to configure the router placing the web server in the DMZ.

    To connect to the www server from your home using your web browser you would need to type the actual ip address assigned by an isp to the work internet account.

    To connect to the web server using other applications, such as telnet, secure shell etc., you would have to configure the router to forward port requests to the designated required ports on the server.

    The default www server port is port 80. However, you can configure the web server to listen NOT on port 80 but on port 8080 or some other port, then use the router port forwarding to send requests to port 8080 (or whatever) to the ip address of the web server.

    And then you should use security and authentication scripts on the server itself to control who may connect to it. You would have to use a script or authentication program that rejects ALL requests except your home static ip address. But this method is far from secure in that anybody you send email to from home has your real address, and any web server you vist also has your real ip address. You would be better of setting up the serevr to only allow connections from your static home ip address and also use name and password on a secure socket layer. That would prevent others from direct access to the server using just your ip address.
     
    Last edited: 2005/01/05
    TonyT,
    #2


  3. to hide this advert.

  4. 2005/01/05
    ReggieB

    ReggieB Inactive Alumni

    Joined:
    2004/05/12
    Messages:
    2,786
    Likes Received:
    2
    Tony, you are wrong. NAT stands for "Network Address Translation ". Translating IP addresses is exactly what it does.

    However, I agree that moboking should enable authenication on the server as well as setting up firewall rules.

    When sending a packet of information out of a network NAT will translate the FROM IP address to either another address (proper NAT) or the router's address (port address translation - PAT, NAPT or dynamic NAT). It does not change the TO IP address.

    When receiving a packet from the outside NAT will translate the TO IP address but not the FROM IP address.

    As a result if you are outside network and send a packet to a system inside the network the IP information for the external PC will be unaffected

    Using a PAT example:

    Packet sent from external system
    <TO: Router's IP address> <FROM: external system's IP address>

    {Router's IP address = the external IP address of the NAT router at the web server's site}

    When it gets to the router, NAT determines the right recepient (from the port information) and translates the TO field so that the packet gets forwarded to the right internal system:
    <TO: internal IP> <FROM: external system's IP address>

    Packet sent to external system
    <FROM: internal IP> <TO: external system's IP address>

    When this gets to the router, it translates the FROM field and maps the from port number it uses to the internal IP address so it know where to send the replies.
    <FROM: Router's IP> <TO: external system's IP address>

    Therefore any rules you have on the webserver to block or allow certain external IP address to access the system will be unaffected by NAT running on the local router.

    However, note that if your Home system is connecting via a NAT router, the FROM IP address that arrives at the web server will be the home router's external IP address and not the IP address of the home PC.
     
    Last edited: 2005/01/05
    ReggieB,
    #3
  5. 2005/01/05
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,068
    Likes Received:
    396
    Yeah, I knew all that, I just should have stated my reply more clearly. Apparantly what he wants is to be able to securely connect to the www server at work, which is back of a router. He does not state "how" he wants to connect, e.g. does the server have a real domain name or only an ip address asigned by the router? Therefore I was unsure of the context he was using the word "translate ". (as in a dns server translating the name into an ip number)

    Either way, it the www server is back of a router then he must use the router's port forwarding feature to be able to send requests to the www server from outside the lan. And likely will have to place the www server in the DMZ of the router.

    Also note that if any other computers are on that lan at work behind the router, then that www server must be secured tightly else all other computers on that lan are at risk of being exposed and exploited. It's rather easy to get to root of any shabbily secured server, be it unix or windows so consider the risks of remote access as you had planned.
     
    TonyT,
    #4
  6. 2005/01/06
    moboking

    moboking Inactive Thread Starter

    Joined:
    2004/12/26
    Messages:
    82
    Likes Received:
    0
    My point is let's see this from the webserver's point of view. The whole point of NAT is the outside world does not see the private network and the private network does not see the outside Internet at least not directly. When a client behind NAT broadcasts a public IP, it broadcasts that IP to all the other computers within its LAN's subnet and of course, there will be no reply from these clients. However, the gateway does reply and knows that the data needs to escape so it relays this to the outside world. This gateway is the NAT router.

    Now in IIS at my office, I can tell it not to accept any incoming data from any IP except from one, ie my home WAN IP. Unfortunately IIS is behind a NAT router. Therefore, when the incoming request http data stream at port 80 which correctly matches the router's WAN IP hits the router, the router translates this WAN IP to the LAN IP of the webserver and forwards the data to it on port 80. However, from the point of view of the webserver, the incoming data at port 80 comes from 192.168.1.1 (default Linksys NAT router's LAN IP) but IIS is programed to accept only the IP of say... 68.12.12.12 which is my home IP so IIS would block the incoming request "from" the router because 192.168.1.1 is not 68.12.12.12. Basically, IIS is not smart enough to know that this incomming request's source IP has been translated.

    I am not clear on this DMZ business. In my Linksys NAT router, there is an option to put a particular client in the DMZ. What does this mean? Ok, let's say the NAT router's WAN IP is 69.1.1.1 and its LAN IP is 192.168.1.1. If this client is in the DMZ, the router does not translate any IP at all when it assign an IP to this DMZ client? In other words, this DMZ client will get an IP of 69.1.1.1 and not 192.168.1.x?
     
    moboking,
    #5
  7. 2005/01/06
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,068
    Likes Received:
    396
    paragraph by paragraph:

    1. Clients behind the router on the lan cannot and do not broadcast a public ip. They can make requests TO a public ip such as a web server or a mail server. Then the router takes the clients local ip, logs and sends the request. The destination receives the real ip, the ip assigned by the isp. Local ips assigned by the router (192.x.x.x) are non routable and never get seens outside a lan.

    2. From the web server's point of view: If when at home, you open the browser and type in the real ip of the work connection, and the router forwards your request to the web server on the lan, that serevr WILL receive your real ip address. It does know where the request came from. I have a server here at my home network and when I open it up to the wan, I can see all the real ip addresses that have made requests to the server. (it's Apache running on Debian Linux w/php & mysql) It's not open to the wan cause I don't have it secured enough, but occasionally open it up to receive large data files from friends.

    3. DMZ = De-Militarized Zone. This means that a computer put in the DMZ will receive all traffic requests sent to it. The router's NAT is disabled only for that computer in the DMZ. Thus that computer in the DMZ must be hardened against attack by using software security solutions such as a software firewall, intrusion detection systems, etc. If your IIS cannot determine the real ip address making requests, then you would have to put the IIS machine in the DMZ. But it should be able to work without having to use the DMZ.

    Send me a private message here at this forum and I can demonstrate what I mean. I'll set up port forwarding in my Linksys router to forward port 80 (or other port) to my server, then I'll send you the ip address so you can connect to it. I will not have my server in the DMZ either and it will receive your real ip address, not an ip translated by my router. We would do this at an agreed upon time period so I don't keep the server exposed for too long. The address will be something like this:
    68.100.xxx.xxx:80
     
    Last edited: 2005/01/06
    TonyT,
    #6
  8. 2005/01/06
    ReggieB

    ReggieB Inactive Alumni

    Joined:
    2004/05/12
    Messages:
    2,786
    Likes Received:
    2
    Spot on!!!!!
     
    ReggieB,
    #7
  9. 2005/01/06
    ReggieB

    ReggieB Inactive Alumni

    Joined:
    2004/05/12
    Messages:
    2,786
    Likes Received:
    2
    No. How it works is:

    When a PC using TCP/IP wishes to send a message to another computer, it will sends it to the IP of the PC of that computer. It does not broadcast it. (see hub note below). If it doesn't know the address it may send a broadcast to see if any of the local machines have that address cached, but if it can't find the address it won't send the information.

    When sending the information, the PC will compare the IP address with its own IP address using the subnet mask to determine if the IP address is on the same subnet as itself (by doing a logical AND of IP with Mask and comparing the results. If the results are the same the two IPs are on the same subnet).

    If the subnets are the same the PC will first use ARP to get the MAC address of the recipient computer (if it isn't in its cache) and then send the packet out directly to the MAC address of the recipient PC. If IP addresses are on different subnets, the computer sends the packet to the MAC address of the default gateway (your router). The IP "TO" field is still that of the recipient PC, it is the level 2 MAC address that is that of the router.

    Routers block/ignore broadcasts. They do not sit listening for any packets destined for outside the network. They only process packets sent to them directly at the layer 2 level (MAC).

    Hub note, hubs work at layer 1 and cannot destinguish between different MAC addresses. If you are on a hubbed network, you will receive all packets sent out by neighbouring PC. Those broadcast and those sent directly.
     
    ReggieB,
    #8
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...