In which network layer is the data located that lets a gateway(using NAT) know which computer a packet is meant for?

Question

Main questions:

1. In which network layer is the data located that lets a gateway(using NAT) know which computer a packet is meant for?

2. Could someone explain how the process works? In explaining the process would it be possible to answer the following questions/suspicsions: I assume that the data(which distinquishes to which pc's incoming packets need to be sent within a network) conversion is unique for each gateway device? (I think otherwise you could find out from outside the network for which computer in a network a packet is for, but then again that maybe would not necessarily be a security issue?)

Answer 1

For any TCP or UDP connection, there are four components that make up an addressing of a packet. The source IP address, the destination IP address, the source port, and the destination port.

The destinatin IP is the server to which you are connectin, and the destination port is the port you are connecting to, such as TCP port 80 for an http connection. The source port is "ephemeral" meaning that it is chosen from a range and has no specific meaning. The range is between 1024-65535. The port selection is dependent on the OS, but it doesn't matter too much which port is chosen.

The source IP address is the PC originating the connection. So lets say the connection is to 222.222.222.222:80 and we have two PCs internally connecting to this IP address, 10.1.1.1 and 10.1.1.2

So as the packets originate they may be addressed like this:

10.1.1.1:3434 -> 222.222.222.222:80
10.1.1.2:5455 -> 222.222.222.222:80

Response packets are reversed, like this:

222.222.222.222:80 -> 10.1.1.1:3434 
222.222.222.222:80 -> 10.1.1.2:5455 

So we can see that the source port is what allows the return packet to get to the originator.

When we pass through a NAT router, the source IP is changed to the IP of the router - in this case 111.111.111.111. So the packets look like this:

111.111.111.111:3434 -> 222.222.222.222:80
111.111.111.111:5455 -> 222.222.222.222:80

So provided the router keeps a track of the source port of a connection, then it knows that response packets to port 3434 should be sent to 10.1.1.1. This is the NAT translation table.

But what if both of our PCs happened to choose the same source port?

10.1.1.1:3434 -> 222.222.222.222:80
10.1.1.2:3434 -> 222.222.222.222:80

The NATted packets would look like this:

111.111.111.111:3434 -> 222.222.222.222:80
111.111.111.111:3434 -> 222.222.222.222:80

So a response packet to 3434 intended for 10.1.1.1 is indistinguishable from one intended for 10.1.1.2.

To get around this, the router will not only change the source IP address, but also the source port. Then the router can ensure that every connection outgoing has a unique source port, and keeps a translation table to change both the IP and port of the response packets so they are sent to the right originator.

To answer your security question, realistically, the router only needs to alter the source port in the event of a collision, however most will alter the source port in every case, and choose a random source port. This makes it difficult to predict what the next chosen source port might be, and makes it more difficult for an attacker to inject packets into the sequence.

Answer 2

Typically in a home router NAT operates at layer 4. In TCP and some UDP connections the router will look at the source and destination ports to create a NAT translation table to map the real IP address and port to the natted IP address and port. This is called overload NAT or PAT(port address translation). In some protocols such as DNS the router will look into the packet and use the application layer data (the domain name being queried) to determine which address to send the DNS response to.
This is an example of a NAT translation table taken from a Cisco ASA:

PAT Global 216.1.250.22(400) Local 172.16.1.102(123)
PAT Global 216.1.250.22(9370) Local 172.16.1.107(13286)
PAT Global 216.1.250.22(45935) Local 172.16.1.107(36159)
PAT Global 216.1.250.22(60152) Local 172.16.1.107(10736)
PAT Global 216.1.250.22(322) Local 172.16.1.107(123)
PAT Global 216.1.250.22(48642) Local 172.16.1.44(59136)
PAT Global 216.1.250.22(24719) Local 172.16.1.44(59764)
PAT Global 216.1.250.22(17045) Local 172.16.1.44(57830)
PAT Global 216.1.250.22(44616) Local 172.16.1.44(59100)
PAT Global 216.1.250.22(19426) Local 172.16.1.44(57632)
PAT Global 216.1.250.22(38447) Local 172.16.1.44(58904)
PAT Global 216.1.250.22(6053) Local 172.16.1.44(59958)
PAT Global 216.1.250.22(49473) Local 172.16.1.44(59323)
PAT Global 216.1.250.22(55193) Local 172.16.1.44(58597)
PAT Global 216.1.250.22(38978) Local 172.16.1.44(59170)

Answer 3

Basically for outgoing connections, the router uses a "NAT translation table", which is generated dynamically. E.g. once the outgoing connection is started, a relevant entry is added to that table (listing internal computer IP/port, used outgoing port on the router, target IP/port, etc). Naturally, this table is kept in router's memory and is not sent anywhere, so OSI levels do not apply. Once incoming packet arrives, the router consults that table to determine how to handle it further.

For incoming connections, router has to use pre-defined configuration, which connects a service on a certain internal computer to a port (e.g. NAT all incoming connections to TCP port 80 to internal computer A.B.C.D port 8080, etc.) Again, this information is never sent on the wire explicitly.