Port Address Translation連接埠位址轉換

PAT is the most widely used form of NAT. Sometimes referred to as NAT overload, the PAT translation mechanism is dynamic and it applies to IPv4 addresses and to TCP or UDP port numbers. As far as the addresses are concerned, PAT maps multiple local addresses to a single global address or to a pool of global addresses. As far as port numbers are concerned, PAT maps multiple local port numbers to multiple global port numbers. Mappings that are created by PAT always specify pairs of values, consisting of an IPv4 address and a port number.

PAT 是最廣泛使用的 NAT 形式，有時也稱為 NAT 過載（NAT overload）。PAT 的轉換機制是動態的，同時套用於 IPv4 位址以及 TCP 或 UDP 連接埠號。就位址而言，PAT 會把多個本地位址對應到單一全域位址或一組全域位址；就連接埠號而言，PAT 會把多個本地連接埠號對應到多個全域連接埠號。PAT 建立的對應項目一律以「IPv4 位址與連接埠號」的配對來表示。

PAT allows multiple devices to share a single or a few inside global addresses. Most home routers operate in this way. Your ISP assigns one public address to your router, yet several members of your family can simultaneously surf the internet.

PAT 讓多部裝置共用單一或少數幾個內部全域位址。大多數家用路由器都是以這種方式運作：您的 ISP 只指派一個公開位址給您的路由器，但家中多位成員卻能同時上網。

PAT translates local IPv4 addresses to one or more global IPv4 addresses. In either case, PAT has to ensure that each connection is translated unambiguously. When only a single global IPv4 address is available, PAT will assign each translated packet the same global IPv4 address, but different port number. When all available port numbers are exhausted, the translations will not be possible, and no new connections would be created. The number of available port numbers determines the number of simultaneous outbound connections. Since the port numbers are not as scarce as global IPv4 addresses, PAT is very efficient and can accommodate many outbound connections.

PAT 會將本地 IPv4 位址轉換為一個或多個全域 IPv4 位址。不論哪種情況，PAT 都必須確保每個連線都能被明確地轉換。當只有單一全域 IPv4 位址可用時，PAT 會為每個經過轉換的封包指派相同的全域 IPv4 位址，但使用不同的連接埠號。當所有可用連接埠號都耗盡時，就無法再進行轉換，也無法建立新連線。可用連接埠號的數量決定了可同時進行的對外連線數量。由於連接埠號不像全域 IPv4 位址那樣稀少，PAT 相當有效率，能容納許多對外連線。

The mechanism of translating port numbers tries to preserve the original local port number, meaning that it tries to avoid port translation. If more than one connection uses the same original local port number, PAT will preserve the port number only for the first connection translated. All other connections will have the port number translated.

連接埠號轉換機制會嘗試保留原本的本地連接埠號，也就是盡量避免進行連接埠轉換。若多個連線使用相同的原始本地連接埠號，PAT 只會為第一個被轉換的連線保留該連接埠號，其餘連線的連接埠號都會被轉換。

As with dynamic NAT, all mappings created by PAT have a timeout. Once they expire, the mappings are deleted from the mapping table.

與動態 NAT 相同，PAT 建立的所有對應項目都有逾時時間。一旦逾時，對應項目就會從對應表中刪除。

When responses to the translated packets are received at the outside interface of the border device, the destination IPv4 address and destination port numbers are translated back from global to local values. For this "backward" translation to succeed, both destination IPv4 address and destination port number of the inbound packet must have entries in the mapping table. PAT can be implemented for both inside and outside addresses, but this course focuses only on inside PAT translations.

當邊界裝置的外部介面收到針對已轉換封包的回應時，目的 IPv4 位址與目的連接埠號會從全域值轉換回本地值。這種「反向」轉換要成功，進入封包的目的 IPv4 位址與目的連接埠號都必須在對應表中有對應項目。PAT 可以同時套用於內部與外部位址的轉換，但本課程只著重於內部 PAT 轉換。

Incoming packets from the outside network are delivered to the destination device on the inside network by looking for a match in the NAT-mapping table. This mechanism is called connection tracking.

來自外部網路的進入封包，是藉由在 NAT 對應表中尋找符合項目，才能送達內部網路上的目的裝置。這種機制稱為連線追蹤（connection tracking）。

The figure illustrates an example of using PAT. In the example, the R2 router is configured to perform only inside PAT. It initially has no mappings in its mapping table. This example shows the port preserving feature of PAT. There are two hosts on the inside network that access servers in the internet.

此圖示範了 PAT 的使用範例。在此範例中，R2 路由器只設定為執行內部 PAT，一開始其對應表中沒有任何對應項目。此範例展示了 PAT 保留連接埠號的特性。內部網路上有兩部主機會存取網際網路上的伺服器。