1

Lecture 14: Translation, tunneling, filtering

NATs, VPNs, firewalls

Olof Hagsand KTH CSC

DD2393/EP2120 p1 2011

2

Literature

•Forouzan Chapter 5.5 - NATNote that NAT figure 5.41 and Table 5.3 can be confusing. Use the figures in the lecture slides instead

•Forouzan Chapter 30.1 – Fig 30.14 - VPNsVery limited coverage on VPNs and only in the context of IPSEC

•Forouzan Chapter 30.4 - FirewallsRead a computer security course!

3

Address translation•How do you translate from one address space to another?

Network Address Translation (NAT)

•Private IP <-> Global IP Original reason for address translation with NAT was lack of IPv4 address space.

•IPv6 NAT: IPv4 <-> IPv6Mapping between IPv6-only and IPv4 networks.

•'Carrier-grade' NAT – NAT in operator networks•How is mapping established?

Statically configuredOn demand - established from one side which makes duplex communication difficult

•Sequences of address translations (eg two NATs) is difficultNAT traversal techniques required

Address domain B

Addressdomain A

mapping

4

Network Address Translation (NAT)•Internally many hosts with private addresses

RFC1918 addresses (10/8, 192.168/16,..)

•One or a small set of global address•A NAT router or switch translates between local/private and global addresses•NAT binding most often established dynamically from the inside

But static mapping is also used

•You also need (UDP/TCP) ports to extend the mappingSometimes called network address port translation (NAPT/PAT)

Global10.0.0.1 200.24.5.8

10.0.0.2 10.0.0.410.0.0.3

NAT

25.8.2.10

Private

5

NAT UDP/TCP example

src: 10.0.0.2:1400dst: 25.8.2.10:80

NAT

NAT binding:10.0.0.2:1400 <--> 200.24.5.8:2100

Private Global

src: 25.8.2.10:80dst: 10.0.0.2:1400

src: 200.24.5.8:2100dst: 25.8.2.10:80

src: 25.8.2.10:80dst: 200.24.5.8:2100

•NAT binding is dynamically established by a connection from the inside, eg a TCP SYN.

6

NAT exercise

•Assume two hosts behind a NAT:–10.1.1.1 and 10.1.1.2

•They both start a communication at the same time with TCP to an external server web 2.2.2.2 using port 80.•The NAT has an internal address 10.2.2.2 and a (single) global address 3.3.3.3.•Show the address/port of the two TCP SYN segments inside and outside the NAT.•What is the NAT binding?•The server replies with SYN/ACK to both requests•Show the address/port of the two TCP SYN/ACK segments inside and outside the NAT.•What would be different if the two SYNs were sent from the same host (eg 10.1.1.1?)

7

NAT and ICMP

•ICMP does not have ports– So how can you map ICMP flows from/to different internal hosts?

•You need to make 'tricks' to map the reply to the original request•ICMP queries (e.g. Echo) have an identity field (and sequence)

–Some OS:s uses same identity field for all hosts → you can only ping one external host from one internal host–You need to have different identity fields for different hosts to make this work.

•ICMP error messages: The payload of the ICMP carries the header from the datagram that could not be delivered.

8

NAT ICMP query example

src: 10.0.0.2ident: 4567dst: 25.8.2.10

NAT

NAT binding:10.0.0.2:4567 <--> 200.24.5.8:4567

Private Internet

src: 25.8.2.10:80ident: 4567dst: 10.0.0.2

src: 200.24.5.8 ident: 4567dst: 25.8.2.10

src: 25.8.2.10ident: 4567dst: 200.24.5.8

•NAT binding uses ICMP query identifier and source adress•Only unique if every host uses different identifiers for different external hosts

9

NAT Header rewrite•Example: TCP/IP SYN packet sent from inside•The following colored fields are rewritten:

source port number destination port number

TCP checksum urgent pointer

sequence number

acknowledgement number

window sizeflagsreservedheaderlength

src addr

dst addr

header checksumprotocolttl

fragment fieldsidentification

total lengthtoshlenversion

NOTE

10

NAT address filtering•With just a binding, other peers can use the ”hole” in the NAT opened by an initial communication

–'Hole punching'

•A NAT may also filter – to restrict which external peers can communicate with the internal host

•The idea is that only the destination used for the binding is allowed to use the hole

–This is typically the destination of a connection initiated from the inside

•NAT filtering is not standardized, it varies between NAT boxes – this makes NAT traversal difficult

–Some variants are shown in the next slides

•Why is there filtering?–Mainly for 'security' reasons although NATs should not really be used for security.

11

Example filtering: 'Full cone'

• Full cone NAT– no filtering–32.4.5.6 can use the hole opened by the access to 25.8.2.10

src: 10.0.0.2:1400dst: 32.4.5.6:80

NAT

NAT binding:10.0.0.2:1400 <--> 200.24.5.8:2100

Private Global

src: 32.4.5.6:80dst: 10.0.0.2:1400

NAT filtering:*:*

25.8.2.10

32.4.5.6

12

Example filtering: 'Symmetric'

• Symmetric NAT –32.4.5.6 can not use the entry–Only 25.8.2.10:80 is accepted as source address

• Other filterings: Restricted port/ restricted cone

NAT

NAT binding:10.0.0.2:1400 <--> 200.24.5.8:2100

Private Global

NAT filtering:25.8.2.10:80

25.8.2.10

32.4.5.6blocked!

13

NAT and other applications•Problem: address and ports numbers may also be present in payload

–FTP and SIP prints the port numbers converted into ASCII in the payload during connection set up–IPSEC encrypts datagrams including ports,–Etc, etc

•Figure shows an application protocol sends a private address in payload. •In the global address space, the private address in the payload is not translated (just the IP/TCP header).•So NAT needs to be made application-specific.

NATPrivate

NAT binding:10.0.0.2:1400 <--> 200.24.5.8:2100

Global

Address 10.0.0.100 referenced in payload Private address 10.0.0.100

referenced in payload10.0.0.100

14

NAT Traversal techniques•In order to communicate over NATs in other ways than client/server, protocols affected need to perform NAT traversal•Why would applications need to do that?

–The telephone is peer-to-peer,...–Especially low-latency applications (eg Voice over IP)–But to some extent also bandwidth-intense applications

•There are several NAT-traversal protocols–'STUN' – client/server NAT detection and traversal–'TURN'–NAT-T for IPSEC–Teredo for IPv6

•Many peer-to-peer applications use special (ad-hoc) techniques to bypass NAT:

–UDP/TCP 'hole punching'–Sending 'speculative' packets in both directions–A global third party not behind NAT–Overloading of well-known ports, eg port 80

15

Exercise: NAT traversal - UDP hole punching

•Goal is to establish direct UDP flow between 10.1.1.1 and 10.2.2.2 by first establishing a binding to 3.3.3.3

•Which UDP packets are sent to setup the NAT binding table?•What is the states of the NAT binding table?•Follow a UDP packet from 10.1.1.1 to 10.2.2.2: how does addresses and ports change as the packet traverses the networks?

NAT NAT

Internet

10.1.1.1 10.2.2.2

2.2.2.21.1.1.1

3.3.3.3

PrivateNetworks

16

Classification and packet filtering

17

Firewalls

•You want to access the global network•But you want protection from the outside•Packet filter firewalls are the simplest form of firewalls•Also called ACL - Access Lists in routers•Many use NAT for security - but this is not its intended use.•More advanced firewalls must be aware of application-level semantics

This is also referred to as deep inspection (inspect application-layer data)

untrustedInternet

trustedIntranet

Firewall routerwith packet filtering

18

Classification and filtering•Based on packet header (or even payload) classify packets into classes

–Eg, all TCP traffic with dst port 80 and source IP address in 193.12.3.4/24

•Classes may then be handled in different ways–Drop, count, measure, priority, shape,

•Stateful inspection

–Keep state of every TCP/UDP flow and allow reverse traffic

–Traffic from inside ”opens” the firewall for incoming traffic dynamicall (cf dynamic NAT binding)

•Example:

– permit out on eth0 from 77.2.3.0/24 to any proto tcp keep state

– permit input on eth0 proto icmp

– deny default

untrustedInternet

77.2.3.0/24 eth0

19

Tunneling

20

Tunneling•Extended encapsulation: 'break' the layering model by iterating over the same (or higher) layer•One IP network then acts as a link in another IP network•Tunneling is used in many places

IPv6 deploymentVPNsMobile IP

•There are many different encapsulationsIP-in-IP, IPv6 in IPv4, IPv4 in IPv6GRE - Generic tunneling protocolEth-in-IP (VPLS, pseudowire)

PayloadIPHeader

PayloadIPheader

Inner Datagram

Outer Datagram

21

Issues with tunneling

•TTL – decrement the TTL once or for complete path? –This influences debugging and tracerouting– A failure in the tunnel may not be able to send ICMP back to the original source (only to tunnel entry)

•MTU (Maximum transmission unit)–May cause heavy fragmentation–Many backbones therefore have high MTU ('jumbo-frames')

hdr payloadhdr payloadIP

hdr payload

22

Virtual Private Networks

23

Virtual Private networks

•You want to use a global network to communicate between private sub-networks•The cause is primary economic (leased lines are expensive)•You tunnel traffic between the subnetworks•You may also need to ensure privacy and integrity

GlobalPrivate Private

Private

24

Addressing and security•Public IP networks are public and have only one address domain.•You may want to separate your private traffic from the global traffic (addressing)•You may want to secure your traffic (encryption, authentication)•Provider-based VPNs (peer)

–You trust your provider (no encryption or authentication) –Guarantee resources–Provider adds service – more costly–One provider / set of providers only

•Customer-based VPNs (overlay)–Do it yourself using IPSEC tunneling–Cheap solution–Best effort – no guarantees–You can run over the Internet–Encryption / authentication important

25

Tunneling in VPNs

•Your private datagrams are encapsulated within a global datagram•Privacy: Encrypt inner datagram•Integrity: Ensure data is not changed•Authentication: You can trust it came from the right sender•Tunneling is again used: encrypt/authenticate the inner datagram

PayloadIPHeader

PayloadIPheader

Inner

Outer Global addressing

Private addressing

encryption/authentication

26

VPN simple architecture

IP-network

Point-to-pointtunnels

MainLAN

•Simplest VPNs are point-to-point tunnels to a central site•Tunneling with encryption/authentication is used •Available in several variants on all modern operating systems

27

More advanced VPNs

•More complex VPNs interconnect several network 'islands'•In a static solution, tunnels need to be setup manually

– Full mesh: setup tunnels between all pair of peers– Hub-and-spoke: setup tunnels to a (set of) central sites

•In a dynamic solution tunnels are setup automatically. Sometimes BGP is used for signaling: setting up the tunnels on-demand.

Internet

LAN LAN

LAN

28

VPN on different layers•L3VPN: Interconnects a routed network•L2VPN: Interconnects a switched network•Pseudo-wires: static variant of L2VPN•Virtual Private LAN Services (VPLS): dynamic variant of L2VPN

The figure shows an example of 'full-mesh' L2VPN pseudo-wires. That is, 'virtual' links have been setup between all customer sites. L2 frames (eg Ethernet) are tunneled in IP through the public network.

29

IPSEC VPN•IPSEC can be used for VPNs•A sender and receiver agree on a set of security schemes,

–Security Association (SA) – a cleartext index (SPI)–SA includes: encryption algorithm, keys, lifetime, addresses

•IPsec implemented in the IP header–Part of IP stack, network layer

•IPsec consists of two protocols–Privacy: Encapsulation Security Payload (ESP) –Authentication, etc: Authentication Header (AH)

Internet

Security Association

H2H1 R2R1

30

Encapsulation Security Payload - ESP•ESP encrypts the payload of an IP datagram

–But ESP also has authentication–ESP addresses privacy, but also authentication, etc.

•In tunnel mode, the whole datagram is encrypted•Some ESP header fields:

–SA index, sequence number (may not re-occur), padding

originaldatagram

ESP hdr ESP trailer ESP auth

IP hdr TCP hdr Payload

IP hdr TCP hdr Payload

ESP hdr ESP trailer ESP authIP hdr TCP hdr Payload

transportmode

tunnelmode

IP hdr

New proto: 50

New hdr

encryptedauthenticated

encryptedauthenticated