Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currently having some issues with TCP port reused too often (under 2 minutes) for a source NAT and I was wandering what is the algorithm used to select the IP and port for a SNAT.

Here is some context: I have an entire network (10.0.0.0/8, tons of users) accessing internet through one firewal (it happens to be a Fortigate). We have a public address pool (let's says 1.2.3.0/27) to NAT all these clients IP addresses.

How will my router/firewall decide what IP address to NAT to and what source port to use?

Is this vendor specific? Do you know of any implementation that you could explain to me?

I hope my questions are clear :)

Regards, Pierre

share|improve this question
    
Sounds like a use-case for a http/https proxy. –  symcbean Mar 22 '13 at 9:04
    
There is actually a proxy, it is hosted somewhere on the internetz so I have only one destination for my NAT. –  lilorox Mar 22 '13 at 11:20

1 Answer 1

This totally depends from your device (firewall) configuration/behavior. Eg. with a Linux firewall you can apply this configuration (with -j SNAT) to some matching rules, matching rules can check protocol, src/dst ports, src/dst address, maybe time of the day, etc..

share|improve this answer
    
Do you know the algorithm used in netfilter? I was also looking for a possible RFC recommanding a way to do it if it exists. –  lilorox Mar 22 '13 at 10:28
    
From iptables manpage: If no port range is specified, then source ports below 512 will be mapped to other ports below 512: those between 512 and 1023 inclusive will be mapped to ports below 1024, and other ports will be mapped to 1024 or above. Where possible, no port alteration will In iptables you can specify port range with --to-source. Some interesting information in RFC5382 –  Bertera Mar 24 '13 at 10:09
    
Thanks, I'll be sure to check that out! –  lilorox Mar 25 '13 at 13:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.