IPv4 provides approximately 4 billion unique addresses. Although 4 billion is a lot of addresses, it is not enough to keep up with the growth of the internet.
IPv4 提供約 40 億個獨一無二的位址。雖然 40 億個位址數量龐大,但仍不足以跟上網際網路的成長速度。
To allocate IPv4 addresses efficiently, CIDR was developed. CIDR allows the address space to be divided into smaller blocks, varying in size depending on the number of hosts needed in individual blocks. These blocks are no longer associated with predefined IPv4 addresses classes, such as class A, B, and C. Instead, the allocation includes a subnet mask or prefix length, which defines the size of the block.
為有效配置 IPv4 位址,業界開發了 CIDR。CIDR 讓位址空間可依個別區塊所需的主機數量,被劃分為大小不一的較小區塊。這些區塊不再與傳統預先定義的 IPv4 位址類別(如 A 級、B 級、C 級)相關聯。取而代之的是,配置時會包含子網路遮罩或前綴長度,用以定義區塊的大小。
VLSMs allow more efficient use of IPv4 addresses, specifically on small segments, such as point-to-point serial links. VLSM usage was recommended in RFC 1817. CIDR and VLSM support was a prerequisite for ISPs to improve the scalability of the routing on the internet.
VLSM 讓 IPv4 位址的使用更有效率,特別是在小型區段(如點對點序列連結)上。RFC 1817 建議使用 VLSM。CIDR 與 VLSM 的支援是 ISP 提升網際網路路由可擴充性的先決條件。
NAT introduced a model in which a device facing outward to the internet has a globally routable IPv4 address, while the internal network is configured with private RFC 1918 addresses. These private addresses can never be routed outside the site, as they can be identified in many different enterprise networks. In this way, even large enterprises with thousands of systems can hide behind a few routable public networks.
NAT 引入了一種模式:面向網際網路的裝置擁有一個可全球路由的 IPv4 位址,而內部網路則設定使用 RFC 1918 私有位址。這些私有位址永遠無法路由到站台之外,因為它們可能在許多不同的企業網路中重複出現。透過這種方式,即使擁有數千個系統的大型企業,也能隱身在少數幾個可路由的公有網路之後。
DHCP is used extensively in IPv4 networks to dynamically allocate addresses, typically from private IPv4 addresses space (RFC 1918), then translated to public addresses using NAT.
DHCP 在 IPv4 網路中被廣泛用來動態配置位址,通常是從私有 IPv4 位址空間(RFC 1918)配置,之後再透過 NAT 轉換為公有位址。
One of the arguments against deploying IPv6 is that NAT will solve the problems of limited address space in IPv4. The use of NAT merely delays the exhaustion of the IPv4 address space. Many large organizations and ISPs are moving to IPv6 because they are running out of IPv4 private addresses, for example, as Internet of Things (IoT) devices are added to their networks.
反對導入 IPv6 的論點之一,是認為 NAT 就能解決 IPv4 位址空間有限的問題。然而,使用 NAT 只是延緩了 IPv4 位址空間耗盡的時間。許多大型企業與 ISP 正在轉向 IPv6,因為他們的 IPv4 私有位址即將用盡,例如隨著物聯網(IoT)裝置陸續加入其網路。
Negative implications of using NAT, some of which are identified in RFC 2775 and RFC 2993 include:
使用 NAT 的一些負面影響(部分已在 RFC 2775 與 RFC 2993 中提及)包括:
- NAT breaks the end-to-end model of IP, in which only the endpoints, not the intermediary devices, should process the packets.NAT 破壞了 IP 的端對端模型,該模型主張只有端點(而非中介裝置)應該處理封包。
- NAT inhibits end-to-end network security. To protect the integrity of the IP header by some cryptographic functions, the IP header cannot be changed between the origin of the packet (to protect the integrity of the header) and the final destination (to check the integrity of the received packet). Any translation of parts of a header on the path will break the integrity check.NAT 妨礙了端對端網路安全性。若要透過加密函式保護 IP 標頭的完整性,IP 標頭在封包來源(用以保護標頭完整性)與最終目的地(用以檢查收到封包的完整性)之間就不能被更動。路徑上任何對標頭部分的轉換,都會破壞完整性檢查。
- When applications are not NAT-friendly, which means that, for a specific application, more than just the port and address mapping are necessary to forward the packet through the NAT device, NAT must embed complete knowledge of the applications to perform correctly. This fact is especially true for dynamically allocated ports, embedded IP addresses in application protocols, security associations, and so on. Therefore, the NAT device needs to be upgraded each time a new non-NAT-friendly application is deployed (for example, peer-to-peer).當應用程式不相容於 NAT,也就是說,對於特定應用程式而言,僅有連接埠與位址對應不足以讓封包透過 NAT 裝置轉送時,NAT 就必須內建完整的應用程式知識才能正確運作。這一點對於動態配置的連接埠、內嵌在應用程式協定中的 IP 位址、安全性關聯等情況尤其如此。因此,每當部署一項新的、不相容於 NAT 的應用程式(例如點對點應用程式)時,NAT 裝置就需要升級。
- When different networks use the same private address space and merge or connect, an address space collision occurs. Hosts that are different but have the same address cannot communicate with each other. There are NAT techniques available to help with this issue, but they increase NAT complications.當不同網路使用相同的私有位址空間並合併或連接時,就會發生位址空間衝突。位址相同但實際上不同的主機將無法彼此通訊。雖然有一些 NAT 技術可協助解決此問題,但也會增加 NAT 的複雜度。