The TCP/IP Guide - IP NAT "Overlapping" / "Twice NAT" Operation

Please Whitelist This Site?

I know everyone hates ads. But please understand that I am providing premium content for free that takes hundreds of hours of time to research and write. I don't want to go to a pay-only model like some sites, but when more and more people block ads, I end up working for free. And I have a family to support, just like you. :)

If you like The TCP/IP Guide, please consider the download version. It's priced very economically and you can read all of it in a convenient format without ads.

If you want to use this site for free, I'd be grateful if you could add the site to the whitelist for Adblock. To do so, just open the Adblock menu and select "Disable on tcpipguide.com". Or go to the Tools menu and select "Adblock Plus Preferences...". Then click "Add Filter..." at the bottom, and add this string: "@@||tcpipguide.com^$document". Then just click OK.

Thanks for your understanding!

Sincerely, Charles Kozierok
Author and Publisher, The TCP/IP Guide

Let's try a new example. Suppose our network has been improperly numbered so that it is not in the 10.0.0.0 private block but in the 18.0.0.0 block used by MIT. A client on our private network, 18.0.0.18, wants to send a request to the server “www.twicenat.mit.edu”, which has the address 18.1.2.3 at MIT. Our client can't just make a datagram with 18.1.2.3 as the destination and send out, as the router will think it's on the local network and not route it. Instead, 18.0.0.18 uses a combination of DNS and NAT to get the outside device address as follows:

Once our client has the translated address, it initiates a transaction just as before. NAT now will perform both translation of the inside devices and the outside devices as well. The outside device address must be translated because the inside device is using 172.16.44.55, which isn't a valid address for the server it is trying to reach. The inside device address must still be translated as in regular NAT because 18.0.0.18 is not a valid public address for us. It may refer to a real machine in MIT and we aren't supposed to be using it on the Internet!

Let's say that we are still using the pool of 20 inside global addresses from 194.54.21.1 through 194.54.21.20 for inside addresses, and let's further suppose the NAT router chooses 194.54.21.12 for this particular exchange. The transaction sequence would be roughly as described in Table 77, and illustrated in Figure 115.

**Table 77: Operation Of “Overlapping” NAT / “Twice NAT”**
Step #	Description	Datagram Type	Datagram Source Address	Datagram Destination Address
1	Inside Client Generates Request And Sends To NAT Router: Device 18.0.0.18 generates a request using the destination 172.16.44.55 that it got from the (NAT-intercepted) DNS query for “www.twicenat.mit.edu. The datagram is sent to the NAT router for the local network.	*Request* (from inside client to outside server)	18.0.0.18 (Inside Local)	172.16.44.55 (Outside Local)
2	NAT Router Translates Source Address And Destination Address and Sends To Outside Server: The NAT router makes two translations. First, it substitutes the 18.0.0.18 address with a publicly registered address, which is 194.54.21.12 for this example. It then translates the bogus 172.16.44.55 back to the real MIT address for “www.twicenat.mit.edu”. It routes the datagram to the outside server.	*Request* (from inside client to outside server)	194.54.21.12 (Inside Global)	18.1.2.3 (Outside Global)

3	Outside Server Generates Response And Sends Back To NAT Router: The MIT server at 18.1.2.3 generates a response and sends it back to 194.54.21.12, which causes it to arrive back at the NAT router.	*Response* (from outside server to inside client)	18.1.2.3 (Outside Global)	194.54.21.12 (Inside Global)
4	NAT Router Translates Source Address And Destination Address And Delivers Datagram To Inside Client: The NAT router translates back the destination address to the actual address being used for our inside client, as in regular NAT. It also substitutes back in the 172.16.44.55 value it is using as a substitute for the real address of “www.twicenat.mit.edu”.	*Response* (from outside server to inside client)	172.16.44.55 (Outside Local)	18.0.0.18 (Inside Local)

As you can see, in this example the outside local and outside global addresses are different, unlike in the preceding NAT examples. Twice NAT can also handle an inbound transaction, by watching for datagrams coming in from the Internet that overlap with the addresses used on the local network and doing double substitutions as required.