Subject: [NAT] NAT question

From: Matt Alexander <[email-masked]>
Date: Wed, 22 Aug 2001 17:15:23 -0700 (PDT)

I have a question about NAT (IP Masq) that I've wondered about...
Let's say you have a setup like this:

     Internet
     --------
        |
        |
        |
     |-----|
     | NAT |
     |-----|
        |
        |
     |-----|       |------|
     | HUB |-------| Web  |
     |-----|       |Server|
        |          |------|
        |
    |--------|
    | client |
    |--------|

The NAT box is also port-forwarding any requests on the external interface
for port 80 to the Web server.  The web server and the client boxes have
private IP addresses.  Users connecting from the Internet are able to
access the Web server without any problems, but if a user sitting on the
internal network on the client box tries to access the web server, it
will do a lookup and get the external IP address of the NAT box, and the
connection to the web server will fail.  In the past I've dealt with this
situation by either putting the web server's private IP address in all the
client's hosts files, or I've setup a DNS server on the internal network.
So my question is, why does NAT fail in this situation?  Why doesn't the
client's request get redirected back to the web server?  I'm fairly
comfortable with TCP/IP so feel free to get as detailed as possible.
Thanks,
~M

_______________________________________________
nat mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/nat

---

From: "Tim Dorcey" <[email-masked]>
Date: Wed, 22 Aug 2001 17:36:36 -0700

I don't know about TCP, but with UDP, "IP Masquerade" (Linux) will
forward the UDP packet to the proper destination, but without
translating the source address.  This means the server reply will go
directly back to the client private IP, rather than through the NAT.  I
guess this is more efficient routing, but would confuse most protocols,
since the reply is coming from the server private IP, rather than the
NAT address it was sent to.  If it does the same thing with TCP, that
would explain the problem.  Not sure if there is any reason why it works
this way, or if it just turned out that way.  It would seem to be more
sensible if the NAT treated all packets addressed to the external
address the same, whether they originate internally or externally.  If
you want more efficient routing, THEN make sure the clients on the
private network use the server's private IP in the first place.

Tim

> -----Original Message-----
> From: Matt Alexander [mailto:[email-masked]]
> Sent: Wednesday, August 22, 2001 5:15 PM
> To: [email-masked]
> Subject: [NAT] NAT question
> 
>