NAT Terminology and Translation MechanismsNAT 術語與轉譯機制

In NAT terminology, addresses are categorized into two types. All classifications described apply to the border device that performs translations.

在 NAT 術語中，位址分為兩種類型。以下所有分類都是就執行轉譯的邊界裝置而言。

In NAT terminology, the inside network is the set of networks that are subject to translation. The outside network refers to all other addresses. Usually, these other addresses are valid addresses that are located on the Internet.

在 NAT 術語中，內部網路（inside network）是指受轉譯影響的一組網路。外部網路（outside network）是指其他所有位址。通常這些其他位址是位在網際網路上的有效位址。

A good way to remember what is local and what is global is to add the word visible. An address that is locally visible normally implies a private IP address, and an address that is globally visible normally implies a public IP address. The rest is simple. Inside means internal to your network, and outside means external to your network. So, for example, an inside global address means that the device is physically inside your network and has an address that is visible from the Internet. It could be a web server, for instance.

記住哪個是本地、哪個是全域的一個好方法，是加上「可見」這個詞。本地可見的位址通常代表私有 IP 位址，全域可見的位址通常代表公有 IP 位址。其餘就很簡單了：內部（inside）表示在你的網路內部，外部（outside）表示在你的網路外部。舉例來說，內部全域位址表示該裝置實體上位於你的網路內部，但擁有一個從網際網路可見的位址，例如它可能是一台網頁伺服器。

To classify NAT, it is important to clarify which header fields can be the subject of translation first. So far, the NAT explanation focused on IPv4 address fields. But NAT implementations can also translate port numbers.

要對 NAT 進行分類，首先必須釐清哪些標頭欄位可能是轉譯的對象。到目前為止，NAT 的說明都聚焦在 IPv4 位址欄位。但 NAT 實作也可以轉譯連接埠號。

The inside and outside definition is important for NAT operation. The figure illustrates the importance of inside and outside definitions regarding the processing sequence. When a packet travels from an inside domain to an outside domain, it is received at an inside interface, routed, and, only then, addresses are translated to global addresses. At this point, the border device automatically creates translation-mapping (basically a "dictionary entry") if the mapping does not exist. The packet is then forwarded out the exit (outside) interface. In dynamic translation, the border device also sets a timeout value for each mapping it creates. The key point to remember is that with dynamic NAT implementation, mapping creation is "provoked" by inside to outside traffic. Without outbound traffic, no mappings are created.

內部與外部的定義對 NAT 運作十分重要。此圖說明了內部與外部定義在處理順序上的重要性。當封包從內部網域傳往外部網域時，會先在內部介面被接收、進行路由，然後才將位址轉譯為全域位址。此時，若對映不存在，邊界裝置會自動建立轉譯對映（基本上就是一筆「字典項目」）。接著封包會從出口（外部）介面轉送出去。在動態轉譯中，邊界裝置也會為它建立的每一筆對映設定逾時值。要記住的重點是：在動態 NAT 實作中，對映的建立是由「內部到外部」的流量所觸發的。若沒有出向流量，就不會建立任何對映。

When a packet travels from an outside domain to an inside domain, the process is reversed: packets arriving from the outside with their global addresses are first translated back to their local addresses and, only then, routed. Note that the inbound traffic has the translated address (the inside global address) in the destination IPv4 header. Since the routing happens after translation, it will be based on the original, local IPv4 address. However, all outside routers—routers in external networks—must have a route towards the global IPv4 address in order for packets to reach the inside network. Only the global address is visible in the external world.

當封包從外部網域傳往內部網域時，流程則相反：從外部到來、帶著全域位址的封包會先被轉譯回本地位址，然後才進行路由。請注意，入向流量的目的地 IPv4 標頭中帶的是經過轉譯的位址（內部全域位址）。由於路由是在轉譯之後才進行，因此會依原始的本地 IPv4 位址來路由。然而，所有外部路由器（外部網路中的路由器）都必須有一條通往該全域 IPv4 位址的路由，封包才能到達內部網路。在外部世界中，只有全域位址是可見的。

What happens if a packet arrives from the outside, and there is no mapping for its destination address? When NAT service on a device cannot find a mapping for an inbound packet, it will discard the packet. When is this situation encountered? Dynamic NAT creates mappings when an inside host initiates communication with the outside. However, dynamic mappings do not last forever. After a dynamic mapping timeout expires, the mapping is automatically deleted. Recall that dynamic mappings are not created unless there is inside to outside traffic. Also, when NAT is required, the outside to inside communication will not be possible, unless there was prior outbound communication. In other words, NAT does not allow requests initiated from the outside.

如果封包從外部到來，但其目的位址沒有對應的對映，會發生什麼事？當裝置上的 NAT 服務找不到某入向封包的對映時，會直接丟棄該封包。這種情況何時會發生？動態 NAT 是在內部主機發起與外部的通訊時才建立對映，但動態對映並非永久存在。動態對映逾時到期後，該對映會自動被刪除。請記住，若沒有內部到外部的流量，就不會建立動態對映。此外，當需要使用 NAT 時，除非先前已有出向通訊，否則無法進行由外部到內部的通訊。換句話說，NAT 不允許由外部發起的請求。

If the return communication is received after the timeout expires, there would be no mappings, and the packets will be discarded. You will not encounter this issue in static NAT. A static NAT configuration creates static mappings, which are not time limited. In other words, statically created mappings are always present. Therefore, those packets from outside can arrive at any moment, and they can be either requests initiating communication from the outside, or they can be responses to requests sent from inside.

如果逾時到期後才收到回傳的通訊，此時已無對映，封包將被丟棄。靜態 NAT 則不會遇到此問題。靜態 NAT 設定所建立的靜態對映沒有時間限制，換句話說，靜態建立的對映永遠存在。因此，這些來自外部的封包可能在任何時刻到達，它們可能是由外部發起通訊的請求，也可能是對內部所發送請求的回應。

The examples show how Network Address Translation is configured to enable internet access. Your task is to examine the examples and match the correct type of address with the callout letter displayed on the figure.

以下範例說明如何設定網路位址轉譯以啟用網際網路存取。你的任務是檢視這些範例，並將正確的位址類型與圖中標示的字母對應起來。