How to resolv this NAT problem?

Question

I am taking my first network class and I came across a question I just cant wrap my head around.

We have an external machine that has a public IP address from using NAT, the external machine want to contact one other machines but using their local IP address no the one public provided by NAT. How can initiate the connection in order for the remote machine to contact the local one?

How to know which machine the remote machine will connect to?

Any tips would be highly appreciated

Answer 1

I understand your question the following way:

There are multiple computers behind a NAT. The NAT has a global IP address while the computers behind the NAT only have a local IP address.

A computer in the Internet wants to send some data to a computer behind the NAT.

How is this possible?

First of all:

The NAT needs to know which computer should receive a certain IP packet.

Using real NATs, this is typically only possible using Port Forwarding:

The NAT does not only evaluate the IP addresses of the incoming packet, but also the TCP port numbers (in the case of a TCP connection).

Depending on the TCP port number, the NAT will send the IP packet to one computer or another one. Example: If the port number is 443, the NAT will send the packet to the web server, if the port number is 25, it will send the packet to the e-mail server.

The person who operates the NAT must configure it in a way that the NAT knows which port number shall be sent to which local IP address.

If that person does not configure the NAT, the NAT does not know which packets shall be sent to which computer and it is not possible to send data to computers behind the NAT.

(By the way:

This is one of the reasons why there are a lot of people who plan to continue using "IPv4-like" NAT together with the new IPv6 protocol, which does not require NAT any more:

They argue that using NAT it is not possible for a hacker to send unwanted data to a computer behind the NAT.)

Theoretically it would also be possible to build a NAT that accepts "proxy server" connections at a certain TCP port (8080 is often used for proxy servers).

This would work the following way:

Computer in                      10.2.3.4
the Internet           NAT       TCP port 1234
     |                  |              |
     |----------------->|              |
     |  (connect to     |              |
     |  TCP port 8080)  |              |
     |                  |              |
     |----------------->|              |
     | Send data:       |              |
     | "10.2.3.4:1234"  |------------->|
     |                  | (connect)    |
     |<-----------------|              |
     | Send data:       |              |
     | "SUCCESS"        |              |
     |                  |              |
     |----------------->|              |
     | Send data:       |------------->|
     | "hello"          | Send data:   |
     |                  | "hello"      |
     |                  |              |
     |                  |<-------------|
     |<-----------------| Send data:   |
     | Send data:       | "world"      |
     | "world"          |              |
              ...