Subject: [NAT] NAT with Windows2000

From: "Raley, Scott" <[email-masked]>
Date: Fri, 10 Aug 2001 14:51:42 -0400

Not sure if this is the right forum...
Are there any documents about setting up a NAT in a windows 2000
environment? I was told by simply putting in two NICS in my server, one with
the external IP and one with an internal IP, thats all I need for a NAT.
Any help is appreciated.

_______________________________________________
nat mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/nat

---

From: Hal F Gottfried <[email-masked]>
Date: Fri, 10 Aug 2001 14:57:03 -0400

That is not entirely correct , you must also enable IP Forwarding so the 
packets can be translated.

>the external IP and one with an internal IP, thats all I need for a NAT.

Thank You,

Hal F. Gottfried
Technical Instructor
ProTech Professional Technical Services Inc.

Office:(800) 373-9188 x176
Fax: (412)810-8861
Direct Line: (877)595-7165 or (412)297-0562

Consulting, Software, and Training for OS/390, UNIX and Internet
Visit us: http://www.protechtraining.com

---

From: "Ian King" <[email-masked]>
Date: Fri, 10 Aug 2001 12:05:30 -0700

That is not an explicit step needed to use NAT on Windows 2000 (where it
is called "Internet Connection Sharing").  It's just a checkbox on a tab
under Properties for the connection you want to share (e.g. the
connection to your ISP).  -- Ian 

-----Original Message-----
From: Hal F Gottfried [mailto:[email-masked]] 
Sent: Friday, August 10, 2001 11:57 AM
To: Raley, Scott; [email-masked]'
Subject: Re: [NAT] NAT with Windows2000

Thank You,

Hal F. Gottfried
Technical Instructor

---

From: Hal F Gottfried <[email-masked]>
Date: Fri, 10 Aug 2001 15:12:26 -0400

That is just connection sharing that is not doing the translations bettween 
private internal IP's and Ext Public IP's which is what NAT does. To that 
he needs IP forwarding

Thank You,

Hal F. Gottfried
Technical Instructor

---

From: "Raley, Scott" <[email-masked]>
Date: Fri, 10 Aug 2001 15:18:29 -0400

I am dealing with Windows 2000 Server, not professional...

-----Original Message-----
From: Hal F Gottfried [mailto:[email-masked]]
Sent: Friday, August 10, 2001 3:12 PM
To: Ian King; Raley, Scott; [email-masked]
Subject: RE: [NAT] NAT with Windows2000

Thank You,

Hal F. Gottfried
Technical Instructor

---

From: Hal F Gottfried <[email-masked]>
Date: Fri, 10 Aug 2001 15:18:30 -0400

Ok, Scott. What are you trying to accomplish ? Are you needing to translate 
IP addresses as well as route them or are you just trying to make your NT 
box into a MULTI-HOMED NT router ?

Hal F. Gottfried

Thank You,

Hal F. Gottfried
Technical Instructor

---

From: "Raley, Scott" <[email-masked]>
Date: Fri, 10 Aug 2001 15:26:31 -0400

Currently we have a multi-homed NT router with a Raptor firewall. There are
two subnets and we are looking at setting up a NAT for one of the subnets.
Need to both translate and route the IP addresses. The NAT is just for the
client/printer subnet.

-----Original Message-----
From: Hal F Gottfried [mailto:[email-masked]]
Sent: Friday, August 10, 2001 3:19 PM
To: Raley, Scott; Ian King; Raley, Scott; [email-masked]
Subject: RE: [NAT] NAT with Windows2000

Hal F. Gottfried

Thank You,

Hal F. Gottfried
Technical Instructor

---

From: Hal F Gottfried <[email-masked]>
Date: Fri, 10 Aug 2001 15:29:59 -0400

Scott,
         Ok, so let me make sure I understand your goals. You are using an 
NT box as your router currently and have two subnets  and you want to set 
up Name Address Translation for one of your subnets.  On this 
subnet  (client/printer) subnet, you are going to be using private 
addresses that need to route publically , for example on the Internet.

         NAT offers all the features that ICS offers, and more. NAT keeps 
track of the address and port translations for outbound connections so that 
the proper clients on the private network receive the packets back from the 
external network.
To provide address translation for the internal clients on a network, NAT 
translates the private IP addresses in the IP headers to a single public 
address. The clients access the Internet transparently without requiring 
additional software. The NAT server acts as a router and can also translate 
TCP or UDP ports for the clients. This approach might sound similar to the 
services that Microsoft Proxy Server offers. The two services have some 
differences, but they offer similar functionality and a NAT server isn't an 
alternative to Proxy Server.

         To install NAT in Win2K, select Start, Programs, Administrative 
Tools. Open the Routing and Remote Access window, add your server, 
right-click the server name, and select Configure and Enable Routing and 
Remote Access. After you install RRAS, the program prompts you to start the 
service. After you start, go to IP Routing and right-click General. Select 
New Routing Protocol, select Network Address Translation (NAT).

         To configure an external interface from the interface's Properties 
dialog box, select the General tab, choose Public interface connected to 
the Internet, and click OK. To configure an internal interface, select the 
General tab, choose Private interface connected to private network, and 
click OK. These two options are mutually exclusive.

         Now you're ready to configure additional options for NAT. After 
you right-click Network Address Translation (NAT) and select Properties, 
four tabs are available for configuration: General, Translation, Address 
Assignment, and Name Resolution. The General tab has four logging options 
that are fairly self-explanatory. These options provide levels of logging 
to Win2K's Event Viewer. The Translation tab lets you set TCP and UDP 
session timeout values and specifies how long a dynamic mapping for a TCP 
or UDP session remains in the NAT server's internal routing table. The 
default for connection-oriented TCP sessions is 1440 minutes (24 hours), 
and the default for connectionless UDP sessions is 1 minute.

         The Address Assignment tab, which Screen 5 shows, lets you 
automatically assign IP addresses to your internal clients. When you select 
the Automatically assign IP addresses by using DHCP check box, you enable 
the DHCP allocator. Screen 5 shows the NAT server with a static IP address 
of 192.168.0.0 and a subnet mask of 255.255.255.0. To avoid duplicate IP 
addresses on your internal network, you can use the Exclude option to 
exclude a range of IP addresses that are already in use on your private 
network. Microsoft suggests you add the NAT server's IP address (e.g., 
192.168.0.1) to the list of reserved IP addresses. The Address Assignment 
tab gives the impression that you need a DHCP server on your private 
network because the dialog box says that you're configuring this option to 
use DHCP for automatic address assignment. In fact, you don't need a DHCP 
server on the private network. When you select the Automatically assign IP 
addresses by using DHCP check box, you enable a DHCP allocator that 
functions as a limited DHCP server.

         The Name Resolution tab lets you resolve names to addresses for 
either Windows or TCP/IP networking clients. The NAT server can act as a 
DNS or WINS proxy agent for your private clients. The WINS proxy service 
that the NAT server offers isn't the same as the WINS proxy service 
available in Windows NT versions. NAT automatically configures the clients 
with the NAT server IP address as their WINS server. In a SOHO network, the 
WINS server address will be 192.168.0.1. The second difference is that the 
clients merely think that the server is their WINS server. The NAT server 
will query the WINS server set in its IP configuration and return the 
results to the clients. (The client queries the WINS server and doesn't 
register its address with the WINS server.)

         The WINS proxy service in NAT drops clients' name registrations, 
so the records don't stay in the WINS database. Because your clients never 
register with the WINS server on your private network, you might not be 
able to connect to a private client by name (e.g., \\server\sharename). 
Therefore, you must have a method to resolve names on the private network. 
One solution is to use IP addresses instead of names to connect to other 
machines (e.g., \\192.168.0.3\data). Another option is to use the LMHOSTS 
file. I prefer to use DHCP to assign a WINS address to a client.

         The DNS proxy works similarly to a WINS proxy in which the clients 
send DNS queries to the NAT server. To respond to the client queries, the 
NAT server queries the DNS server set in its IP configuration (e.g., an 
ISP's DNS server) and returns the results to the clients. Unless you enable 
this option, the clients on the private network won't be able to resolve 
host names on the Internet (unless you have an alternative method in place 
to provide name resolution). You can make your NAT server a DNS server. In 
case your server can't resolve the DNS queries, you want to configure your 
DNS server to forward requests to another DNS server, such as an ISP's DNS 
server.

Thank You,

Hal F. Gottfried
Technical Instructor

---

From: "Ian King" <[email-masked]>
Date: Fri, 10 Aug 2001 13:36:56 -0700

I beg to differ: Windows Internet Connection Sharing is a NAT
implementation.  The internal LAN defaults to 192.168.0/8.  It also
supports port mapping to individual machines on the LAN.  

This feature is available not only on Windows 2000, but also Windows 98
and Millenium.  

Windows also supports bridging, which of course does not translate
addresses; Internet Connection Sharing translates addresses.  -- Ian 

-----Original Message-----
From: Hal F Gottfried [mailto:[email-masked]] 
Sent: Friday, August 10, 2001 12:12 PM
To: Ian King; Raley, Scott; [email-masked]
Subject: RE: [NAT] NAT with Windows2000

That is just connection sharing that is not doing the translations
bettween 
private internal IP's and Ext Public IP's which is what NAT does. To
that 
he needs IP forwarding

At 12:05 PM 8/10/2001 -0700, Ian King wrote:
> >environment? I was told by simply putting in two NICS in my server,
one
>with

Thank You,

Hal F. Gottfried
Technical Instructor