22

The computer network of an organization has a NAT with 192.168/16 IP address range. There is a department with a server that has an IP address 192.168.x.y and this server handles hosts of this department with another NAT with the IP address range 172.16/16.

Thus there are 2 layers of NAT. Why don't they have subnetting instead. This would allow easy routing.

I feel multiple layers of NAT can cause performance losses. Could you please help me compare the two design strategies.

Update:

@Jon Some more information

In discussion with a friend, we realized that subnetting would cause the following problem. The ARP requests of a computer would flood the entire organization's network. If the router does not forward these requests then PC's in one department will not be able to connect to PC's in other departments which anyway cannot be done if they are behind different NATs. With a packet sniffer we saw that there is a large number of ARP requests as most computers in the department have File Sharing on Windows enabled.

How to solve this problem?

Also if two computers are behind different NATs then is there no way for them to connect to each other.

6
  • Please change your question into: "Why is it a bad idea to use multiple NAT layers?"
    – compie
    Mar 10, 2010 at 17:12
  • 1
    NO. it is a practical problem. I always mention homeworks. Mar 15, 2010 at 20:04
  • 3
    @Jon (and his upvoters), there's no problems with asking homework questions on here. It's a topic that's been discussed dozens of times over at meta.stackoverflow.com - although personally I don't see anything in the question that points to HW. Mar 15, 2010 at 21:08
  • @Farseeker - the whole question is abstract. He doesn't seem to be in a position to change anything, he wants us to "compare the 2 design strategies" with no clear goal - it just smells like homework not a real world problem. Of course I'm more than happy to accept that I am wrong and somebody does have this crazy setup - in that case ask them why they must have a good reason. Mar 16, 2010 at 11:55
  • @Jon I have some specific questions as well. try answering these. Mar 18, 2010 at 6:50

7 Answers 7

6
+50

The only real problem with doing multi-layered NATing is that it makes your network topology confusing. If you use multiple layers of NAT then you throw out the symmetric routing between all hosts in the organization and you also run into the potential for overlapping private address spaces inside your network. Imagine if you used an address range in your n+1 NAT layer that was being used in the n NAT layer. Those networks would never be able to route to each other, but hosts in the n+1 layer could have the same address as the n layer, making the identity of the server confusing.

If I were laying out the topology of a large network, I would use only 10.* or 172.16-24.* addresses for hosts on any of our subnets. Then if some department or individual wanted to double NAT, they could (using the 192.168.* network) with the understanding that they are responsibly for the network behind their NAT host. I would also be more inclined to create more subnets than to let any of those double NAT'd networks get too big.

9

Problems with multi-level NAT are essentially the same as for single layer NAT but compounded. Such as:

  1. Latency due to extra work being done in a packets lifetime (though this is unlikely to be significant in most cases)

  2. Knowing where anything comes from. If you are trying to track down where certain requests came from (perhaps your outgoing firewall has logged what looks like a compromised machine trying to spew spam or search for other infection targets), NAT makes such diagnostics much more difficult.

  3. Incoming connection port forwarding, if you need incoming connections, is more faf to setup and maintain.

  4. Limited number of ports. NAT works by translating source addresses to itself on different ports, so for example:

    • machine 1 talks to an external web server using port 1024 as it's source gets translated to the NAT box's address on, say, port 10000.
    • the same machine makes two requests to that, or another, web server concurrently (not unusual) using source port 1025 (two concurrent connections need to have different source ports). The NAT box translates this to "me on source port 10001"
    • another machine talks makes three connections to external servers. Fine, the NAT box translates these to "me on ports 10002, 10003 and 10004"
    • as packets come back in form the external machines the NAT box knows that it stuff destined for itself on port 10000 are really supposed to go to machine 1 on port 1024, and so on for the other active connections.

    This is all fine and dandy until you have many outgoing connections - i.e. a large network or a smaller network with machines that make many connections (P2P applications like those that implement the bittorrent protocol can create many concurrent connections). There are only 65536 ports in the IP protocol, less the 1024 that are reserved. While 60,000 might sound like a lot it can quickly be consumed then the NAT box needs to decide which old mappings can be removed which usually isn't as simple as "drop the oldest". This can result in odd bugs (random connections dropping for difficult to diagnose reasons) or the machine simply not being able to make new connections for a while.

  5. load on the NAT box(es). If you are using little low power boxes (off-the-shelf NAT supporting routers for instance, rather then a full PC with a chunky CPU) to do your NAT the extra translation work (compared to simply forwarding packets as per a basic routing table) could slow transfers through them down. For Internet access this is not likely to be an issue (your 'net connection will be the bottleneck) but as you are NATing between local network segments it could become quite noticable.

2
  • point 4 this problem should be the same for any number of layers of NAT or not! Mar 11, 2010 at 18:40
  • True, point 4 is the same problem on both single level NAT and multi-level NAT, but multilevel NAT exacerbates the problem of working out which connections are dead (the outer host might not know as much context as the inner one) and makes diagnostics harder if port mapping limitations do become an issue. It can also make fair bandwidth allocation and other traffic shaping more confusing to implement and monitor (though there are ways around that, simplifying your network topology is usually the better option). Mar 22, 2012 at 0:13
6

Performance loss / speed is really down to the quality of the router you use.

As for good/bad idea, I am against it when it is possible to simply use routing, however, it really depends on the environment and what you are trying to accomplish.

If the machines only ever need to run a few things that are shared over standard ports, you can go in to the router/nat-giving device and set a rule to allow what you want (1) . However, if you are going to be doing a lot of device to device tasks, it will be a lot easier to have a proper route with each machine having it's own unique IP (2).

(1) For example, one to many - One machine has a web server and you want to share it to others - you would set a rule in the router to port 80 of the machine, then any machine from the outside network (or inside if nat-loopback is enabled) can simply go to http://router.ip and can access.

(2) If however every machine is going to have a web server on, or you are going to be using a lot of services, you are going to have a nightmare setting up all the rules (but it is not impossible).

As for your scenario - If one department is using 192.168.x.x and the other 192.168.y.x, I would go through the devices and if there is no overlaps, it may simply be possible to change the subnet from /24 to /16 (or the other way round), then replace the routers with switches / or similar and have no loss of services.

It is really hard to help without knowing more about your network, there is nothing that "wrong" with double NAT, as long as it is set up correctly. However, unless you really need it, or there is a very good reason for it, I would look at migrating away if you can (personal opinion)


@iamrohitbanga - In response to your questions (to much for comments).

Comparing is hard - Routing works well for private networks where every machine has the ability to access every machine. Nat works well, but it is used mainly for networks that do not need routing as you usually have to manually set up incoming rules/routes.

For example, if you have an internet connection and disable NAT, then manually set up routes or bridged mode - your machine will be directly on the internet - all ports accessible and any machine can do what it wants to it.

If you have a router on the other hand with NAT, it will take the outside IP and provide "Nat-ed?" (not sure on terminology...) internet - all internal machines have an IP not accessible from the internet, but, you can set up manual rules - e.g. port 80 to one machine... It works very well for outgoing connections (firewall rules permitting), but can be a nightmare to set up incoming rules if you host many services... and if you do anything requiring dynamic ports (ftp, Windows AD etc.) it can be a nightmare.

Hope this helps, if you want to know anything else, feel free to ask.

2
  • could you compare the two strategies. the network is used to provide Internet access to the hosts. Mar 11, 2010 at 4:19
  • @iamrohitbanga - updating answer Mar 16, 2010 at 9:52
5

The main problem with NAT (in general and with multiple layers specifically) is that it can be exceedingly hard to troubleshoot.

4

The biggest problem with NAT is when there is outdated network software doing the translation, wich makes many applications hurt (FTP, VoIP etc). Modern firewalls/gateways have translations (fixups in Cisco-terms) wich makes it alot easier.

I don't understand why your company uses NAT between the private subnets. Why not just route it?

2

Just upgrade your network and clients to IPV6, then no need to use NAT ever again.

1

To answer the new second part of your question...

Routers break broadcast domains - routers do not forward arp packets, they stay within a subnet*. Your Windows file sharing (seriously?) Netbios broadcast traffic will not leave the subnet.

With Subnets :

If you need to access a Windows share from outside of a subnet then you can access it either by directly using its IP address or if you have a DNS or WINS server setup by hostname.

With NAT:

If your NAT is of the PAT kind and hence not a one to one mapping, you would need to configure port forwarding for this to work - this would be bad.

As has been discussed ad naseum, NAT is in general a bad thing as it breaks network functionality, we only use because we have to. Roll on IPv6.

*Of course broadcast forwarders/relays/helpers do exist

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .