Nat 类型

[lihongjie0209]

Full-cone NAT, also known as one-to-one NAT

• Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort.
• Any external host can send packets to iAddr:iPort by sending packets to eAddr:ePort.

一旦建立的地址映射, 那么外部的网络都可以通过映射的地址访问内部的服务

[lihongjie0209]

(Address)-restricted-cone NAT

• Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort.
• An external host (hAddr:any) can send packets to iAddr:iPort by sending packets to eAddr:ePort only if iAddr:iPort has previously sent a packet to hAddr:any. "Any" means the port number doesn't matter.

只有之前访问过的外部网络才能通过映射端口主动发送数据包

[lihongjie0209]

Port-restricted cone NAT Like an address restricted cone NAT, but the restriction includes port numbers.

• Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort.
• An external host (hAddr:hPort) can send packets to iAddr:iPort by sending packets to eAddr:ePort only if iAddr:iPort has previously sent a packet to hAddr:hPort. 只有之前访问过的 ip:port 才能主动发送数据包给映射的地址和端口

[lihongjie0209]

Symmetric NAT

• Each request from the same internal IP address and port to a specific destination IP address and port is mapped to a unique external source IP address and port; if the same internal host sends a packet even with the same source address and port but to a different destination, a different mapping is used.
• Only an external host that receives a packet from an internal host can send a packet back.

每一个外网访问都会生成不同的nat, 外部网络不能主动发起连接