It's important first to know how Network Address Translation (NAT) works. You establish a connection to a server on the internet. In reality you send packets to your router, going out from your computer on some randomly chosen port:
Your computer Router
+------------+ +-----------+
| | | |
| port 31746 o====>o |
| | | |
+------------+ +-----------+
Your router, in turn, establishes a connection to the server you want to talk to. It talks out it's own randomly chosen port:
Router www.google.com
+-----------+ +----------------+
| | | |
| port 21283o====>o port 80 |
| | | |
+-----------+ +----------------+
When google's webserver sends you back information, it is actually sending it back to your router (since your router is the guy actually on the internet):
Router www.google.com
+-----------+ +----------------+
| | | |
| port 21283o<====o port 80 |
| | | |
+-----------+ +----------------+
A packet arrives at your router, on port 21283 from www.google.com. What should the router do with it?
In this case the router has kept a record of you, and the traffic it sent to www.google.com:80 from port 21283 on your behalf. So the router will relay the packet to your computer:
Your computer Router
+------------+ +-----------+
| | | |
| port 31746 o<====o |
| | | |
+------------+ +-----------+
Open NAT
In open NAT, any machine on the internet can send traffic to your router's port 21283, and the packet will be sent back to you:
Your computer Router
+------------+ +-----------+ {www.google.com:80
| | | | {www.google.com:443
| port 31746 o<====o port 21283o<===={serverfault.com:80
| | | | {fbi.gov:32188
+------------+ +-----------+ {botnet.cn:11288
Closed NAT
Closed nat is more restrictive. It won't allow anything in unless it came from the original address and port that you wanted to talk to, i.e. www.google port 80:
Your computer Router
+------------+ +-----------+ {www.google.com:80
| | | | | (rejected) www.google.com:443
| port 31746 o<====o port 21283o<====+ (rejected) serverfault.com:80
| | | | (rejected) fbi.gov:32188
+------------+ +-----------+ (rejected) botnet.cn:11288
Moderate NAT
Moderate NAT is a mixture, where your router will accept any traffic from any port, but only from the same host:
Your computer Router
+------------+ +-----------+
| | | | {www.google.com:80
| port 31746 o<====o port 21283o<===={www.google.com:443
| | | | (rejected) serverfault.com:80
+------------+ +-----------+ (rejected) fbi.gov:32188
(rejected) botnet.cn:11288
That's one set of definitions. The other is:
- Open: allows computers on the LAN to use UPNP to open ports
- Moderate: some port forwards have been created and are working
- Closed: no static port forwarding exists
But the terminology really is nebulous.
See also
