{"id":330,"date":"2020-04-06T00:25:51","date_gmt":"2020-04-05T22:25:51","guid":{"rendered":"http:\/\/tech.sosthe.sk\/?p=330"},"modified":"2020-04-06T00:25:51","modified_gmt":"2020-04-05T22:25:51","slug":"4-6-nat-network-address-translation","status":"publish","type":"post","link":"http:\/\/tech.sosthe.sk\/index.php\/2020\/04\/06\/4-6-nat-network-address-translation\/","title":{"rendered":"4.6. NAT: Network address translation"},"content":{"rendered":"<p>\u00dalohou NAT routra je sprostredkova\u0165 komunik\u00e1ciu stan\u00edc v priv\u00e1tnej neverejnej sieti s verejnou sie\u0165ou. NAT je be\u017enou doplnkovou slu\u017ebou aj lacn\u00fdch routrov pre dom\u00e1cnosti. Typick\u00e1 situ\u00e1cia je, \u017ee provider pridel\u00ed pre dom\u00e1cnos\u0165 alebo mal\u00fa firmu jedin\u00fa IPv4 adresu, ale t\u00ed chc\u00fa pripoji\u0165 na internet viac stan\u00edc ako jednu. Ke\u010f\u017ee ka\u017ed\u00e9 zariadenie by malo ma\u0165 pridelen\u00fa vlastn\u00fa IP adresu, tak bez NAT routra by sme si museli \u017eiada\u0165 od providera viac IP adries (a obvykle aj za vy\u0161\u0161iu cenu).<\/p>\n<p>Tak\u017ee si predstavme, \u017ee n\u00e1m provider pridelil verejn\u00fa IP adresu 138.76.29.7, ale my chceme pripoji\u0165 do internetu 3 po\u010d\u00edta\u010de. Vieme, \u017ee ka\u017ed\u00e9 rozhranie routra mus\u00ed ma\u0165 tie\u017e svoju IP adresu. Nastav\u00edme teda pre rozhranie routra ozna\u010den\u00e9 WAN (wide area network) IP adresu 138.76.29.7. Na LAN (local area network) rozhran\u00ed routra nastav\u00edme nejak\u00fa neverejn\u00fa IP adresu ur\u010den\u00fa pre priv\u00e1tne siete (pozri predch\u00e1dzaj\u00facu predn\u00e1\u0161ku, kapitolu \u201e\u0160peci\u00e1lne IP adresy\u201c) napr\u00edklad 10.0.0.4\/8 a po\u010d\u00edta\u010dom v tejto na\u0161ej nastav\u00edme postupne IP adresy 10.0.0.1\/8, 10.0.0.2\/8 a 10.0.0.3\/8 (toto nastavenie m\u00f4\u017eeme vykona\u0165 alternat\u00edvne aj v DHCP serveri a necha\u0165 po\u010d\u00edta\u010de, nech si tieto IP adresy nastavuj\u00fa dynamicky).<\/p>\n<p>Keby sme pou\u017eili oby\u010dajn\u00fd router bez NAT, tak by nebol probl\u00e9m odosla\u0165 pakety z tejto siete, ke\u010f\u017ee routre sa riadia iba cie\u013eov\u00fdmi IP adresami, ale probl\u00e9m by bol nejak\u00e9 pakety prija\u0165. Predstavme si, \u017ee chceme z po\u010d\u00edta\u010da s IP adresou 10.0.0.1 z\u00edska\u0165 webov\u00fa str\u00e1nku z webov\u00e9ho servera na adrese 128.119.40.186. Pri pokuse o vytvorenie TCP spojenia dostane tento server paket s cie\u013eovou IP adresou 128.119.40.186 a portom 80 (zn\u00e1my port pre HTTP). Zdrojov\u00e1 IP adresa by v\u0161ak bola 10.0.0.1. Ke\u010f\u017ee tak\u00e1to adresa sa vo verejnom internete nenach\u00e1dza, SYNACK segment z tohto servera by si nikdy nena\u0161iel cestu k n\u00e1\u0161mu po\u010d\u00edta\u010du.<\/p>\n<p>NAT router ukr\u00fdva za seba cel\u00fa priv\u00e1tnu sie\u0165 tak, \u017ee sa z internetu nejav\u00ed ako router, ale ako oby\u010dajn\u00fd po\u010d\u00edta\u010d. \u013dubovo\u013en\u00fd paket z \u013eubovo\u013en\u00e9ho po\u010d\u00edta\u010da v priv\u00e1tnej sieti, ktor\u00fd je preposlan\u00fd cez NAT router do internetu, je zmenen\u00fd tak, aby to vyzeralo, \u017ee p\u00f4vodn\u00fd odosielate\u013e je WAN rozhranie NAT routra. Ke\u010f\u017ee WAN rozhranie NAT routra m\u00e1 verejn\u00fa IP adresu, pakety ur\u010den\u00e9 pre t\u00fato IP adresu pr\u00eddu spr\u00e1vne k tomuto rozhraniu. \u00dalohou pre NAT router je teraz zmeni\u0165 pre pakety prich\u00e1dzaj\u00face z internetu cie\u013eov\u00fa adresu tak, aby to bola spr\u00e1vna IP adresa a spr\u00e1vny port po\u010d\u00edta\u010da v priv\u00e1tnej LAN sieti (teda v na\u0161om pr\u00edklade adresa 10.0.0.1).<\/p>\n<p>Cel\u00fd proces je pekne vidite\u013en\u00fd na nasleduj\u00facom obr\u00e1zku.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-331 size-full aligncenter\" src=\"http:\/\/tech.sosthe.sk\/wp-content\/uploads\/2020\/04\/fig04_22.gif\" alt=\"\" width=\"833\" height=\"471\" \/><\/p>\n<ol>\n<li>Stanica v priv\u00e1tnej sieti s neverejnou IP adresou 10.0.0.1 vy\u0161le paket s cie\u013eovou adresou 128.119.40.186 a cie\u013eov\u00fdm portom 80. T\u00e1to stanica o\u010dak\u00e1va odpove\u010f na porte 3345, nastav\u00ed teda zdrojov\u00fd port 3345 a zdrojov\u00fa IP adresu 10.0.0.1. Ke\u010f\u017ee adresa 128.119.40.186 nie je v lok\u00e1lnej sieti, paket je poslan\u00fd cez default router 10.0.0.4.<\/li>\n<li>NAT router vezme tento paket, otvor\u00ed jeden z vo\u013en\u00fdch portov pre WAN rozhranie, na na\u0161om obr\u00e1zku port 5001, a zap\u00ed\u0161e si do prekladovej tabu\u013eky, \u017ee ak pr\u00edde na WAN rozhranie paket s cie\u013eovou IP adresou 138.76.29.7 a cie\u013eov\u00fdm portom 5001, m\u00e1 posla\u0165 tento paket po\u010d\u00edta\u010du 10.0.0.1 na port 3345. N\u00e1sledne zmen\u00ed paket tak, \u017ee zmen\u00ed zdrojov\u00fa IP adresu na adresu WAN rozhrania a zdrojov\u00fd port na 5001 a odo\u0161le paket smerom k cie\u013eu 128.119.40.186.<\/li>\n<li>Ke\u010f pr\u00edde na WAN rozhranie paket s cie\u013eovou IP adresou 138.76.29.7 a cie\u013eov\u00fdm portom 5001, zmen\u00ed cie\u013eov\u00fa IP adresu na 10.0.0.1 a cie\u013eov\u00fd port na 3345 a odo\u0161le tento paket do priv\u00e1tnej siete.<\/li>\n<li>Z poh\u013eadu po\u010d\u00edta\u010da 10.0.0.1 to ani nevyzer\u00e1 tak, \u017ee m\u00e1 neverejn\u00fa IP adresu \u2013 ani nevie, \u017ee je za NAT routrom.<\/li>\n<\/ol>\n<p>Po\u010det po\u010d\u00edta\u010dov v priv\u00e1tnej sieti s\u00edce nie je limitovan\u00fd, ale ke\u010f\u017ee \u010d\u00edsla portov m\u00f4\u017eu by\u0165 z rozsahu 0 a\u017e 65535, tak maxim\u00e1lne m\u00f4\u017ee by\u0165 s\u00fa\u010dasne akt\u00edvnych 65535 spojen\u00ed. Ke\u010f\u017ee be\u017en\u00fd po\u010d\u00edta\u010d m\u00e1va akt\u00edvnych s\u00fa\u010dasne iba p\u00e1r spojen\u00ed (alebo p\u00e1r stov\u00e1k, ak pr\u00e1ve intenz\u00edvne pou\u017e\u00edva P2P softv\u00e9ry), d\u00e1 sa predpoklada\u0165, \u017ee okolo 100 po\u010d\u00edta\u010dov v priv\u00e1tnej sieti by ur\u010dite nemalo ma\u0165 probl\u00e9m komfortne komunikova\u0165 s internetom.<\/p>\n<p>V\u00fdhodou NATu je to, \u017ee aj v \u010dase, ke\u010f za\u010d\u00edna by\u0165 IPv4 adries nedostatok, st\u00e1le sa d\u00e1 prip\u00e1ja\u0165 mnoho nov\u00fdch zariaden\u00ed. Nev\u00fdhodou je to, \u017ee ak chcete otvori\u0165 na niektorom z po\u010d\u00edta\u010dov serverov\u00fa aplik\u00e1ciu, \u017eiadni nov\u00ed klienti sa na v\u00e1s nevedia priamo napoji\u0165, lebo nem\u00e1te verejn\u00fa IP adresu. Ide o takzvan\u00fd\u00a0<em>NAT traversal probl\u00e9m<\/em>. T\u00fdmto probl\u00e9mom dos\u0165 trpia P2P softv\u00e9ry, ktor\u00e9 predpokladaj\u00fa, \u017ee ka\u017ed\u00fd peer je s\u00fa\u010dasne klient, ktor\u00fd s\u0165ahuje s\u00fabory, aj server, ktor\u00fd zdie\u013ea a poskytuje stiahnut\u00e9 s\u00fabory.<\/p>\n<p>NAT traversal probl\u00e9m sa d\u00e1 vyrie\u0161i\u0165 nieko\u013ek\u00fdmi sp\u00f4sobmi:<\/p>\n<ul>\n<li>Ru\u010dn\u00e9 nastavenie NAT prekladovej tabu\u013eky umo\u017e\u0148uje \u0161pecifikova\u0165, kam maj\u00fa by\u0165 preposielan\u00e9 pakety pre ur\u010dit\u00e9 porty. D\u00e1 sa napr\u00edklad nastavi\u0165 aj to, \u017ee \u013eubovo\u013en\u00e9 nov\u00e9 pripojenia maj\u00fa by\u0165 preposielan\u00e9 k dan\u00e9mu po\u010d\u00edta\u010du. Ru\u010dn\u00e9 nastavenie je trochu nepohodln\u00e9, ale vcelku efekt\u00edvne, ak chceme nejak\u00fd server prev\u00e1dzkova\u0165 dlhodobo.<\/li>\n<li>Mnoh\u00e9 NAT routre poskytuj\u00fa na svojom LAN rozhran\u00ed slu\u017ebu IGD (Internet gateway device), ozna\u010dovan\u00fa aj ako UPNP (universal plug and play), ktor\u00e1 umo\u017e\u0148uje stanici v lok\u00e1lnej sieti zisti\u0165 verejn\u00fa IP adresu NAT routra na WAN rozhran\u00ed, zisti\u0165 aktu\u00e1lny stav prekladovej tabu\u013eky a hlavne prid\u00e1va\u0165 a odobera\u0165 riadky v prekladovej tabu\u013eke. T\u00fdm p\u00e1dom, ak chceme aktu\u00e1lne po\u010d\u00fava\u0165 na nejakom svojom porte m\u00f4\u017eeme si nastavi\u0165 prekladov\u00fa tabu\u013eku na NAT routri a navy\u0161e informova\u0165 okolie o tom, na akej IP adrese a porte bude NAT router po\u010d\u00fava\u0165 (a odtia\u013e preposiela\u0165 na na\u0161u stanicu a n\u00e1\u0161 port)<\/li>\n<li>Tretie rie\u0161enie je vyu\u017ei\u0165 nejak\u00fd po\u010d\u00edta\u010d s verejnou IP adresou a v\u0161etku komunik\u00e1ciu dan\u00e9ho spojenia preposiela\u0165 cez neho. Toto rie\u0161enie vyu\u017e\u00edva napr\u00edklad Skype. Ak je volan\u00fd \u00fa\u010dastn\u00edk za NAT routrom, vyberie sa stanica s verejnou IP adresou, na ktor\u00fa sa napoj\u00ed volan\u00fd aj volaj\u00faci a cel\u00fd rozhovor je potom preposielan\u00fd cez t\u00fato stanicu.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u00dalohou NAT routra je sprostredkova\u0165 komunik\u00e1ciu stan\u00edc v priv\u00e1tnej neverejnej sieti s verejnou sie\u0165ou. NAT je be\u017enou doplnkovou slu\u017ebou aj lacn\u00fdch routrov pre dom\u00e1cnosti. Typick\u00e1&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"_links":{"self":[{"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/posts\/330"}],"collection":[{"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/comments?post=330"}],"version-history":[{"count":1,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/posts\/330\/revisions"}],"predecessor-version":[{"id":332,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/posts\/330\/revisions\/332"}],"wp:attachment":[{"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/media?parent=330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/categories?post=330"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/tags?post=330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}