30

This is a little theory question that has been confusing me for a pretty long time.

Basically, if we are inside of a private LAN, and we want incoming packets to reach, for example, an HTTP server located on one of the machines, we forward ports so that incoming packets reach exactly that computer.

Now, I'm quite confused as to how 'response' packets reach their destination inside of a LAN, like, when we open a web page or so. Can't really find any useful information on that topic.

I hope someone can give me a couple of clues or link me to some information that might explain it. Thanks.

EDIT: I think I should clarify. An example of what I'm asking would be something like this:
1. A computer inside of a LAN with a single external IP tries to load a web-page from a web-server outside of this LAN (Basically on the Internet)
2. The web-server responds and sends the web-page back to that computer.

What quite confuses me at this point is, how does the router know what computer to send the incoming data (given the router is connected to a LAN with multiple computers) without previous port forwarding.

1

5 Answers 5

61

Even though the question has been fully covered. I feel like this process should best be described step-by-step.

For this example, I sit in a private LAN connected to the Internet through a router. Because our network shares a single public IP address, we use NAT.

So when I request the page superuser.com that will generate many IP packets. Let's look at a single one.

IP Packet
Source: 192.168.1.12 (my IP)
Destination: 64.34.119.12 (superuser.com)

Now, my system is most likely set up similar to the one in question. I have my own IP address (192.168.1.12), a subnet mask (255.255.255.0) and a default gateway (192.168.1.1). Now, because my Destination field in my IP packet points to a network different than my own, it is sent to my default gateway (rather than to the computer directly).

But how can the packet get to the default gateway, if the Destination points somewhere completely else?

Ethernet

That's easy, because we use the addressing of the Ethernet protocol for that. We just set our destination IP address in the IP packet and the MAC address of our default gateway as the destination in the Ethernet Frame.

Now that will make sure our default gateway gets the packet for superuser.com. Yay!

Now the gateway has our packet and could send it right on its path. But to make sure it will get the answer, it first need to replace the packet Source address (otherwise superuser.com would try to send the answer to some (possibly) non-existent device with my IP address on their network. Now that wouldn't be very nice.)
So my router will place its public IP address in the Source field:

IP Packet
Source: 92.69.127.243 (my public IP)
Destination: 64.34.119.12 (superuser.com)

Now that same game goes on and on with all the routers on the world until the packet finally arrives at superuser.com and an answer is generated.

The Answer

Answer IP Packet
Source: 64.34.119.12 (superuser.com)
Destination: 92.69.127.243 (my public IP)

Ok, the answer got to my router, now what? How does my router now know to send the answer to 192.168.1.12?

TCP

Well, that actually works because we have only looked at the IP and Ethernet parts of the communication. What makes this work is the TCP part.

You most likely know that web servers usually run on port 80. IP has no notion of ports. That comes from TCP. In TCP we have (like in IP) a source and destination port.

My TCP Packet to superuser.com
Source: 192.168.1.12 (my IP)
Source Port: 11111 (the port my computer made up)
Destination: 64.34.119.12 (superuser.com)
Destination Port: 80

When your router sends that initial packet (that's addressed to superuser.com on port 80), he will put a new source port in there (like 12345).
And this is the important part! He will remember that replacement!

My router's TCP Packet to superuser.com
Source: 92.69.127.243 (my public IP)
Source Port: 12345 (the port my router made up)
Destination: 64.34.119.12 (superuser.com)
Destination Port: 80

So the answer packet received by the router actually looks like this:
Answer TCP Packet from superuser.com
Source: 64.34.119.12 (superuser.com)
Source Port: 80
Destination: 92.69.127.243 (my public IP)
Destination Port: 12345 (the port my router made up)

So now he gets that packet and sees that it is for a port it previously remembered was assigned to NAT operations for IP address 192.168.1.12 (my IP address).

Answer TCP Packet from my router
Source: 64.34.119.12 (superuser.com)
Source Port: 80
Destination: 192.168.1.12 (my IP)
Destination Port: 11111 (the port my computer made up)

10
  • 1
    I edited your answer, it did not clearly show what was happening to the port numbers. I added more examples on the intermediate steps and what the port numbers where each step. Mar 17, 2012 at 18:57
  • 1
    @OliverSalzburg I was looking for the same question answered and your explanation helped me recall, just a quick question on this. Wondering for how long the router would keep this reverse mappings (source port) feels like it would run out of space if it keeps doing that for so many requests, does it flush them too regularly ?
    – Ahmed
    Sep 16, 2012 at 0:43
  • @Ahmed: The amount of memory to keep track of that information is limited. There are 65536 possible port numbers, they are stored in 2 bytes. So, to remember an IP address (4 bytes) for each port would sum up to 65536 x 4 bytes = 262144 bytes = 256 kB. However the specifics are implemented in the router, that's not a lot of memory. Sep 16, 2012 at 11:11
  • @Oliver Great answer, exactly what I was searching for! I have a few questions - (1) "same game goes on and on with all the routers on the world" - is that accurate? Surely the source field wouldn't continue to get replaced at each step? (2) Does the router remember the opened ports longterm or does it regularly drop them for non-responding requests? (3) Does this mean a hacker can get packets past through your router's firewall with a man-in-the-middle attack: snooping your outgoing TCP packets, then targeting your router's open TCP port with a spoofed source IP matching your destination? Mar 8, 2013 at 0:37
  • 1
    How does an ICMP ping response come back to a computer in LAN ? Does it have something similar to port for TCP ? How about other protocols ?
    – Jean
    Sep 3, 2013 at 19:36
11

Network Address Translation. Briefly, when the private LAN's gateway router replaces the private LAN source address with its own public address, it modifies the packet in some way such as assigning a unique and otherwise locally meaningless port number which it maps back to the originating LAN node and outgoing request. It remembers this port mapping so when a reply comes back to the public IP/unique port #, it (the router) knows how to unmap that back to the one of its originating node. This is also how you can run multiple tabs, browsers or browser-instances and the replies to each browser request come back to the correct browser and tab.

1
  • 2
    JRobert: What about IP protocols (e.g. ICMP), other than tcp or udp, which do not have a port number?
    – Uri London
    Nov 7, 2014 at 12:21
0

When an initial packet arrives at the router's external interface, it changes the packet's destination-IP-address as per the port-forwarding configuration and transmits the modified packet on the router's internal interface (after the usual ARP if necessary)

The packet reaches the web-server and still has an external source-IP-address which will be used as a destination-address for any reply. The server accordingly addresses the outgoing reply packet(s) in the usual way with a destination IP-address equal to the request's source IP-address. Because the requester's IP-address is external, the packet is addressed, at the MAC layer, to the router's internal interface.

Note that there are different targets in each network layer.

0

Port forwarding is usually done on a router or device adjacent to it. When a device on a LAN sends traffic to another device on that same LAN, the router is not involved at all. Traffic doesn't even touch it. Your port forwarding rules will have no effect on LAN-to-LAN traffic.

Ethernet was designed with a "bus" topology in mind where each computer was physically connected to the same medium. While modern switches optimize traffic flow by learning the MAC address at the other end of the port and replicating traffic accordingly, the "bus" topology still remains. Anything connected to a standard switch can "directly" reach anything else (assuming it's within the same subnet) without having to "go through" an intermediate device such as a router.

You may be confused if the device you are connecting all the computers to has multiple "LAN" Ethernet ports and then a single "WAN" port. These types of devices are actually both a router and switch in the same chassis.

So, inside your LAN, if your HTTP server has the address 192.168.1.55, to reach it inside of your LAN, you will need to type "http://192.168.1.55" in your browser's address bar. Router never sees it. To reach it outside of your LAN, you will need type your external IP, i.e. "http://256.99.88.77:{the port you forwarded here}" or whatever it is. This does hit your router, the router's NAT function works on it, and then the router sends it to 192.168.1.55.

0

Quite simply, when a computer inside the private LAN initiates an outgoing connection, the NAT gateway automatically generates a port mapping for it. They're about the same as port mappings you've manually entered before: {public port, private address, private port}, and are used about the same way. The biggest difference with dynamic mappings is that the NAT gateway often has to arbitrarily assign the public ports for the mappings, when the expected port number is already in use.

Not the answer you're looking for? Browse other questions tagged .