WeOS
5.29.0

# Stateless NAT HowTo

## Introduction

This document details some common use-cases for stateless NAT and how to configure them using WeOS.

For more information, see the Stateless NAT Configuration Guide.

## Single Private Network

The below figure shows a sample network where the NAT GW translates the private network (192.168.1.0/24) to the 10.0.2.0/24 network on the public side and vice versa.

                 .--.-.
                ( (    )__
               (_,  \ ) ,_)  Internet/Intranet
                 '-'--`--'
                  |
                .-+-.
                | R |
                '-+-'
                  |.1
                  |
      ^           |.33       10.0.0.0/24
      |       .---+--.
    Public    |      | vlan2
    ------    |  GW  |
    Private   |      | vlan1
      |       '---+--'
      V           |.1        (10.0.2.0/24)
                  |          192.168.1.0/24
        ---+------+---+----------+---------
           |          |          |
           |.11       |.5        |.139
         .-+--.     .-+--.     .-+--.
         | H1 |     | H2 |     | H3 |
         '----'     '----'     '----'

Figure 1: Basic stateless NAT setup

Assumptions: * The NAT gateway is already set up with two VLAN interfaces, with relevant addresses and IP forwarding enabled * The upper router (`R`) has a route to the 10.0.2.0/24 network via 10.0.0.33, the IP address of the NAT GW.

The additional configuration for setting up stateless NAT is as follows:

    example:/#> configure
    example:/config/#> ip
    example:/config/ip/#> stateless-nat
    example:/config/ip/stateless-nat/#> dnat in vlan2 dst 10.0.2.0/24 to-dst 192.168.1.0
    Would you like routes to be added for NAT rules (y/N)? n

    You will have to manually add routes for your NAT rules!
    example:/config/ip/stateless-nat/#> leave
    Configuration activated.  Remember "copy run start" to save to flash (NVRAM).
    example:/#> copy run start
    example:/#>

## Multiple Private Networks

The network below illustrates a case where a private network (192.168.1.0/24) is used in one setup and then replicated. When connecting these networks together, stateless NAT can be used to achieve connectivity across all private networks.

                      .--.-.
                     ( (    )__
                    (_,  \ ) ,_)                            Internet
                      '-'--`--'
                        |
                      .-+-.
                      | R |                                 (optional)
                      '---'
                        |.100
                        |                                   10.0.0.0/24
               ---+-----+------------+-----------------+---------------
      ^           |.1                |.2               |.3
      |        .--+--. vlan2      .--+--. vlan2     .--+--. vlan2
    Public     |     |            |     |           |     |
    -------    | GW1 |            | GW2 |           | GW3 |
    Private    |     |            |     |           |     |
      |        '--+--' vlan1      '--+--' vlan1     '--+--' vlan1
      V           |.1                |.1               |.1
           -------+---------  -------+---------  ------+---------
           192.168.1.0/24     192.168.1.0/24     192.168.1.0/24
           => 10.0.1.0/24     => 10.0.2.0/24     => 10.0.3.0/24
           Private Net #1     Private Net #2     Private Net #3

Figure 2: Multiple similar private networks

All private networks use subnet 192.168.1.0/24 internally. From the outside, above their respective NAT GW, they are:

- Private Net #1 is known as 10.0.1.0/24
- Private Net #2 is known as 10.0.2.0/24
- Private Net #3 is known as 10.0.3.0/24

For full reachability NAT GW1 must have routes for to 10.0.2.0/24 via 10.0.0.2 and 10.0.3.0/24 via 10.0.0.3, etc. In this example there is also an additional router towards the Internet (`R`), meaning NAT GW1 has its default route pointing to 10.0.0.100. Similar routes must be set up for NAT GW2, NAT GW3, and the (optional) Upper Router (`R`).

    nat-gw1:/config/ip/#> route 10.0.2.0/24 10.0.0.2
    nat-gw1:/config/ip/#> route 10.0.3.0/24 10.0.0.3
    nat-gw1:/config/ip/#> route default 10.0.0.100

The stateless NAT configuration at NAT GW1 is as follows:

    nat-gw1:/config/ip/#> stateless-nat
    nat-gw1:/config/ip/stateless-nat/#> dnat in vlan2 dst 10.0.1.0/24 to-dst 192.168.1.0
    Would you like routes to be added for NAT rules (y/N)? n

    You will have to manually add routes for your NAT rules!
    nat-gw1:/config/ip/stateless-nat/#>

After configuring all NAT GWs, and optionally Upper Router (`R`), a host on private network #1 can ping a remote host (192.168.1.33) on private network #3, using its public address (10.0.3.33).

    host-on-net1:~$ ping -c 3 10.0.3.33
    PING 10.0.3.33 (10.0.3.33) 56(84) bytes of data.
    64 bytes from 10.0.3.33: icmp_seq=1 ttl=62 time=1.25 ms
    64 bytes from 10.0.3.33: icmp_seq=2 ttl=62 time=1.11 ms
    64 bytes from 10.0.3.33: icmp_seq=3 ttl=62 time=1.12 ms

    --- 10.0.3.33 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2002ms
    rtt min/avg/max/mdev = 1.115/1.164/1.250/0.072 ms
    host-on-net1:~$

## Multiple Private Networks using Proxy ARP

The network below illustrates almost the exact same case, except that all NAT gateways and the Upper Router (`R`) reside on a /16 subnet rather than a /24 subnet. Note that the 10.0.0.0/16 subnet covers all of the /24 networks (10.0.1.0/24, etc). used for translation of the private networks.

                      .--.-.
                     ( (    )__
                    (_,  \ ) ,_)                            Internet
                      '-'--`--'
                        |
                      .-+-.
                      | R |                                 (optional)
                      '---'
                        |.100
                        |                                   10.0.0.0/16
               ---+-----+------------+-----------------+---------------
      ^           |.1                |.2               |.3
      |        .--+--. vlan2      .--+--. vlan2     .--+--. vlan2
    Public     |     |            |     |           |     |
    -------    | GW1 |            | GW2 |           | GW3 |
    Private    |     |            |     |           |     |
      |        '--+--' vlan1      '--+--' vlan1     '--+--' vlan1
      V           |.1                |.1               |.1
           -------+---------  -------+---------  ------+---------
           192.168.1.0/24     192.168.1.0/24     192.168.1.0/24
           => 10.0.1.0/24     => 10.0.2.0/24     => 10.0.3.0/24
           Private Net #1     Private Net #2     Private Net #3

Figure 3: Multiple similar private networks with simplified routing

As before, all private networks use subnet 192.168.1.0/24 internally. From the outside it looks as if each private network represents a slice of the larger 10.0.0.0/16 subnet:

- Private Net #1 is known as 10.0.1.0/24
- Private Net #2 is known as 10.0.2.0/24
- Private Net #3 is known as 10.0.3.0/24

The purpose here is to avoid configuring individual routes to every Private Network at the NAT Gateways. With many private networks this can otherwise be a real hassle. Instead, the NAT gateways need to use Proxy ARP on their upper interface to ensure the traffic to their private network will reach them. In order for NAT GW1 to proxy-ARP for traffic toward 10.0.1.0/24, it needs a route to that subnet. Such a route can be added automatically, to the loopback interface, by answering Yes when adding the DNAT rule (see below).

The following example shows the route, stateless NAT and proxy ARP configuration at NAT GW1.

    nat-gw1:/config/ip/#> route default 10.0.0.100
    nat-gw1:/config/ip/#> stateless-nat
    nat-gw1:/config/ip/stateless-nat/#> dnat in vlan2 dst 10.0.1.0/24 to-dst 192.168.1.0
    Would you like routes to be added for NAT rules (y/N)? y
    Added routes for NAT rules!
    nat-gw1:/config/ip/stateless-nat/#> end
    nat-gw1:/config/ip/#> show route
    Network          Netmask          Gateway          Interface        Distance
    ==============================================================================
    10.0.1.0         255.255.255.0    *                lo               254
    0.0.0.0          0.0.0.0          10.0.0.100       *                0
    nat-gw1:/config/ip/#> end
    nat-gw1:/config/#> iface vlan2
    nat-gw1:/config/iface-vlan2/#> proxy-arp
    nat-gw1:/config/iface-vlan2/#>

Having configured all NAT GWs, and optionally Upper Router (`R`), a host on private network #1 can ping a remote host (192.168.1.33) on network #3, using its public address (10.0.3.33).

    host-on-net1:~$ ping -c 3 10.0.3.33
    PING 10.0.3.33 (10.0.3.33) 56(84) bytes of data.
    64 bytes from 10.0.3.33: icmp_seq=1 ttl=62 time=1.29 ms
    64 bytes from 10.0.3.33: icmp_seq=2 ttl=62 time=1.09 ms
    64 bytes from 10.0.3.33: icmp_seq=3 ttl=62 time=1.09 ms

    --- 10.0.3.33 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2002ms
    rtt min/avg/max/mdev = 1.097/1.164/1.296/0.093 ms
    host-on-net1:~$

« Previous Next »