Routers, VIPs, SNATs, DSNATs


Illustration 1: 2 networks connected together by some device

The “IP” in TCP/IP means “Internetwork Protocol”. The genius of IP is that it allows one to connect together multiple networks into a network of networks. The reason why the internet works is because each entity develops a network to fit his or her (or its) need, and then connects them to the larger internet. This chapter covers how to connect those networks together.

One of the problems with the internet, at least version 4, is that the number of IP addresses is large but finite. (with IPv6, the number of IP addresses is larger than the number of atoms in the universal so we will never run out) . IPv4 IP addresses are a finite resource. So the internet architects set aside three groups of private IP addresses, sometimes called RFC-1918 private IP addresses, for internal networks. So then another question this chapter addresses is how to connect networks together.

The device in illustration 1 can be a router, a source network address translator (SNAT – sometimes called a secure network address translator), a destination network address translator (DNAT), or a Virtual IP (VIP – sometimes called a Virtual Server (VS)). What kind of device we pick depends on the details of what we're trying to accomplish.

Remember the table

This chapter will focus on layers 3 and 4. The discussion of VIPs will spill over into layer 5 when we get more detailed.

For the purposes of this discussion, a single network is any number of sub-networks connected together by either hubs, switches, or bridges. The idea behind this definition is that it is the scope of an ARP request.

Source IP address

Destination IP address

Address translation

Port translation

device

Many

Many

none

no

router

Single

Many

destination

maybe

VIP or VS

Single

Single

destination

yes

DNAT

Many

Single

Source

yes

SNAT