Chapter 30
Private Networks,
Virtual Private Networks,
and Network Address
Translation
Outline
PRIVATE NETWORKS
VIRTUAL PRIVATE NETWORKS (VPN)
NETWORK ADDRESS RESOLUTION
(NAT)
30.1
PRIVATE NETWORKS
The McGraw-Hill Companies, Inc., 2000
Private Networks
Designed to be used inside an organization
Intranet
A private network (LAN) that uses the TCP/IP protocol
suite
However, access to the private network is limited only to
the users inside the organization
Extranet
The same as an intranet with one major difference
Some resources may be accessed by specific groups of uses
outside the organization under the control of the network
administrators
For example, a university can allow distance learning
students access to the computer lab after passwords have
been checked
Addressing
A private network has its IP address by the following
three methods
The network can apply for a set of addresses from the
Internet authorities and use them without being connected
to the Internet
Advantage: easy when the organization decides to be connected
to the network
Disadvantage: the address space is wasted
The network can use any set of addresses without
registering with the Internet authorities
The network can use any set of addresses without registering
with the Internet authorities
Because the network is isolated, the address do not have to be
unique
Drawback: users might mistakenly confuse the address as part of
the global network
Addressing (Cont.)
The internet authorities have reserved three sets
of addresses to overcome the problems in
previous two strategies
Without permission from the Internet authorities
Everybody knows that these reserved addresses are
for private networks
Unique inside the organization, but not unique
globally
No router will forward a packet that has one of these
address as the destination address
Addresses for Private Networks
Prefix
Range
Total
10/8
10.0.0.0 ~ 10.255.255.255.255
2^24
172.16/12
172.16.0.0 ~ 172.31.255.255
2^20
192.168/16 192.168.0.0 ~ 192.168.255.255
2^16
30.2
VIRTUAL PRIVATE
NETWORKS
(VPN)
The McGraw-Hill Companies, Inc., 2000
Virtual Private Networks (VPN)
Use the global Internet for both intra- and
inter-organization communication
But require privacy in their intra-organization
communication
How to achieving Privacy
Three strategies: private networks, hybrid
networks, and virtual private networks
Private Networks
An organization that needs privacy when routing
information inside the organization can use a private
network
Small organization with one single site
Can use an isolated LAN
Data in the organization is totally remain inside the
organization, secure from outsiders
Large organization with several sites
The LANs at different site can be connected using routers
and leased lines
Thus, network is made out of private LANs and private
WANs
Figure 30-1
Private Network with Large Organization
The McGraw-Hill Companies, Inc., 2000
Private Networks (Cont.)
Thus, the organization has created a private
internet that is totally isolated from the global
Internet
There is no need for the organization to apply
for IP addresses with the Internet authorities
Because the internet is private, duplication of
addresses by another organization in the global
Internet is not a problem
Hybrid Network
However, above scenario does not allow the
organizations to be connected to the global
Internet
Solution: hybrid network
Allow a organization to have its own private
internet
Intraorganization data is routed through private network
And allow to access to the global Internet
Interorganization data is routed through global Internet
Figure 30-2
Hybrid Network
The McGraw-Hill Companies, Inc., 2000
Virtual Private Networks
Both private and hybrid networks have a
major drawback: cost
Private wide area networks are expensive
To connect several sites, an organization needs
several leased lines
Goal: use the global Internet for both private
and public communication
Solution: virtual private network (VPN)
Virtual Private Networks (Cont.)
VPN creates a network that is private but
virtual
Private: it guarantees privacy inside an
organization
Virtual: it does not use real private WANs
The network is physically public but virtually private
Figure 30-3
Virtual Private Network
The McGraw-Hill Companies, Inc., 2000
VPN Technology
VPN uses two simultaneous technologies to
guarantee privacy for an organization
IPSec
Tunneling
IPSec
Discussed in Chapter 29
A virtual private network can use either AH or
ESP for authentication and privacy
Tunneling
Each IP datagram destined for private use in
the organization must be encapsulated in
another datagram
The inner datagram carries the actual source and
destination address
The outer datagram header carries the source and
destination of the two router, i.e., R1 and R2
Figure 30-4
Tunneling
The McGraw-Hill Companies, Inc., 2000
Tunneling (Cont.)
Note that, the entire IP datagram must be first
encrypted and then encapsulated
R1 encrypts the datagram
R2 decrypts the datagram
Figure 30-5
Addressing in a VPN
The McGraw-Hill Companies, Inc., 2000
30.3
NETWORK ADDRESS
TRANSLATION
(NAT)
The McGraw-Hill Companies, Inc., 2000
Network Address Translation (NAT)
Allow
A set of private addresses for internal communication
A set of (at least one) global Internet addresses for
communication with another site
From the next slide
The private network uses private addresses
The NAT router uses one private address and one global
address
The rest of the internet sees only the NAT router with the address
200.24.5.8
Figure 30-6
NAT
The McGraw-Hill Companies, Inc., 2000
Address Translation
NAT
Replaces the source address of all outgoing
packets with the global NAT address
Replace the destination address of all incoming
packets with the appropriate private address
Figure 30-7
Address Translation
The McGraw-Hill Companies, Inc., 2000
Translation Table
Used by the NAT to drive the destination
address for a packet coming from the Internet
Three cases
Using one IP address
Using a Pool of IP addresses
Using Both IP addresses and Port numbers
Using One IP Address
The translation table has only two columns
The private address
The external address (destination address of the
packet)
When the router translates the source address
of the outgoing packet
It also make note of the destination address,
where the packet is going
Figure 30-8
Translation
The McGraw-Hill Companies, Inc., 2000
Using One IP Address (Cont.)
Communication must always be initiated by
the private network
Thus, a private network cannot run a server
program for clients outside of its network if it
is using NAT technology
Using a Pool of IP Addresses
Using only one global address allows only
one private-network host to access the same
external host
Solution: using a pool of IP addresses
For example, if the NAT can use four address
Four private-network hosts can communicate
with the same external host at the same time
Using a Pool of IP Addresses (Cont.)
Drawbacks
No more than four connections can be made to
the same destination
No private-network host can access two external
server program (e.g., HTTP and TELNET) at the
same time
Two private-network hosts cannot access the
same external server program at the same time
Using Both IP Addresses and Port
Numbers
To allow a many-to-many relationship
between private-network hosts and external
server programs
We need more information in the translation table
When the response comes back, the
combination of source address (25.8.3.2) and
destination port number (1400) define the
private network host
Five-Column Translation Table
Private
Address
172.18.3.1
Private
Port
1400
External
Address
25.8.3.2
External
Port
80
Transport
Protocol
TCP
172.15.3.2
1401
25.8.3.2
80
TCP
…
…
…
…
…
Using Both IP Addresses and Port
Numbers
Thus, for this translation to work, the
temporary port number (1400 and 1401) must
be unique
NAT and ISP
An ISP the serves dial-up customers can use
NAT technology to conserve address
For example, an ISP is granted 1000 addresses
But has 100,000 customers
The ISP can divide the customers into 1000
groups
Each group is a private network
Figure 30-9
An ISP and NAT
The McGraw-Hill Companies, Inc., 2000
0
