Routing & NAT
Routers pass a packet along one decision at a time, and NAT lets a whole private network borrow one public address.
An interactive Networking lesson: 23 steps, about 35 minutes, on a live simulation in your browser.
A company with two sites. hostA sits on the office network 10.0.1.0/24. The server hostB is on 10.0.2.0/24 at the other site. Two routers, r1 and r2, join the sites over a direct line. Leave r3 and the top row alone for now.
hostA pings hostB. It knows hostB is not on its own network (how it knows is the subject of the sibling lesson IP, Subnets & CIDR), so it hands the packet to its gateway, r1. From there hostA has no say. r1 decides to pass it to r2; r2 decides to deliver it. The reply is routed back the same way, one decision at a time.
What you will learn
One hop at a time
- Across two routers: No router knows the whole path. Each one looks at the destination address and chooses only the next hop.
- Reading a routing table: A route is a prefix plus a next hop: for addresses in this range, hand the packet to that neighbour.
- Two routes match. Which wins?: When several routes match, the longest prefix wins. Order in the table means nothing.
- What a router changes: Each hop rewrites the Ethernet header and lowers the TTL. The IP source and destination ride through untouched.
Seeing the path
- A packet built to die: traceroute sends packets built to die one hop further each time. Every router that kills one signs the notice with its own address.
- Reading traceroute
- Drill: trace the path
Dead ends and one-way streets
- Break it: a missing route: A router with no matching route drops the packet and says so. The address in the error is the router to go and look at.
- The line goes dead: An error message means a router made a decision. Silence means the packet was lost somewhere nobody was deciding.
- Break it: a route one way only: A route covers one direction only. Two hosts can talk when there is a working route there and a working route back.
- Drill: fix the way back
- Failover: both directions via r3: Failover is nothing more than different table entries. Routing protocols exist to make those edits for you.
The way out
- An address nobody has heard of
- The default route: The default route matches everything and beats nothing. It is where a packet goes when no better route exists.
- Out is easy. Back is the problem: A private address is not unique, so the internet has no route to it. Replies can only reach an address the internet can find.
NAT: one address for many
- NAT rewrites the source: NAT rewrites the source of outgoing packets to the router's public address, and remembers the swap so it can undo it on the reply.
- The translation table: The NAT table maps inside address:port to public address:port, one row per conversation. The reply is matched against it and translated back.
- Two hosts behind one address: Many private hosts share one public address because each conversation gets its own public port.
- Idle mappings expire: A NAT mapping lives only while traffic keeps using it. Idle for long enough, and the router forgets the conversation ever existed.
- Three idle hours
- Break it: calling in from outside: Inbound packets are translated only if an inside host opened the conversation first. No mapping, no delivery.
Recap & playground
- Cheat sheet
- Playground