Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

NAT options on domestic routers often come configured as strict. What does this mean? What do moderate or open do? Port-forwarding/DMZ access works properly on strict so why bother with the other two?

A look through the router suggests this affects the firewall. When spending a large amount of your time securing networks using Cisco/iptables such a limp non-descriptive answer is nothing but infuriating and leaves no clues as to what effect upon a firewall this has.

Please can someone shed some light.

share|improve this question
    
Some makes\models would be helpful, question seems more aimed at the superuser market. Are you planning on using these for some business purpose, seems more likely to be a superuser type question? –  Helvick Dec 2 '10 at 20:44
1  
I am sorry, but I believe these terms are most commonly used by a consumer gaming system, and are not commonly used by system administrators. Perhaps you should be asking Microsoft what precisely the meant in their dumbed down terms. support.microsoft.com/kb/908880 –  Zoredache Dec 2 '10 at 20:49
    
A NetGEAR WNDR3700 in this current case, but the Drayteks (used by quite a few SoHo's and showroom offices) also have the same option. I'd just like to know what every option, that many need investigated when trouble strikes, does. This one in particular seems increasingly common across models. Although if its better asked at SuperUser, I'll try there instead. –  Metalshark Dec 2 '10 at 21:16

1 Answer 1

up vote 10 down vote accepted

It's important first to know how Network Address Translation (NAT) works. You establish a connection to a server on the internet. In reality you send packets to your router, going out from your computer on some randomly chosen port:

Your computer        Router
+------------+     +-----------+
|            |     |           |
| port 31746 o====>o           |
|            |     |           |
+------------+     +-----------+

Your router, in turn, establishes a connection to the server you want to talk to. It talks out it's own randomly chosen port:

                     Router            www.google.com
                   +-----------+     +----------------+
                   |           |     |                |
                   | port 21283o====>o port 80        |
                   |           |     |                |
                   +-----------+     +----------------+

When google's webserver sends you back information, it is actually sending it back to your router (since your router is the guy actually on the internet):

                     Router            www.google.com
                   +-----------+     +----------------+
                   |           |     |                |
                   | port 21283o<====o port 80        |
                   |           |     |                |
                   +-----------+     +----------------+

A packet arrives at your router, on port 21283 from www.google.com. What should the router do with it?

In this case the router has kept a record of you, and the traffic it sent to www.google.com:80 from port 21283 on your behalf. So the router will relay the packet to your computer:

Your computer        Router
+------------+     +-----------+
|            |     |           |
| port 31746 o<====o           |
|            |     |           |
+------------+     +-----------+

Open NAT

In open NAT, any machine on the internet can send traffic to your router's port 21283, and the packet will be sent back to you:

Your computer        Router            
+------------+     +-----------+     {www.google.com:80
|            |     |           |     {www.google.com:443
| port 31746 o<====o port 21283o<===={serverfault.com:80
|            |     |           |     {fbi.gov:32188
+------------+     +-----------+     {botnet.cn:11288

Closed NAT

Closed nat is more restrictive. It won't allow anything in unless it came from the original address and port that you wanted to talk to, i.e. www.google port 80:

Your computer        Router            
+------------+     +-----------+     {www.google.com:80
|            |     |           |     | (rejected) www.google.com:443
| port 31746 o<====o port 21283o<====+ (rejected) serverfault.com:80
|            |     |           |       (rejected) fbi.gov:32188
+------------+     +-----------+       (rejected) botnet.cn:11288

Moderate NAT

Moderate NAT is a mixture, where your router will accept any traffic from any port, but only from the same host:

Your computer        Router            
+------------+     +-----------+     
|            |     |           |     {www.google.com:80
| port 31746 o<====o port 21283o<===={www.google.com:443
|            |     |           |       (rejected) serverfault.com:80
+------------+     +-----------+       (rejected) fbi.gov:32188
                                       (rejected) botnet.cn:11288

That's one set of definitions. The other is:

  • Open: allows computers on the LAN to use UPNP to open ports
  • Moderate: some port forwards have been created and are working
  • Closed: no static port forwarding exists

But the terminology really is nebulous.

See also

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.