Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Network Address Translation resolve the problem of limited IPv4 by allocating one public IPv4. When a node inside the network want to send a packet to the internet a special port is generated that act as a NAT index in order to mark the node.
In order to scan a computer behind a NAT, does an attacker can enumerate ports with the public IP address of the node that act as a NAT(router) to scan computers in the inner network?
It depends Upon the type of NAT
Full-cone NAT, also known as one-to-one NAT
Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort. Any external host can send packets to iAddr:iPort by sending packets to eAddr:ePort.
(Address)-restricted-cone NAT
Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort. An external host (hAddr:any) can send packets to iAddr:iPort by sending packets to eAddr:ePort only if iAddr:iPort has previously sent a packet to hAddr:any. "Any" means the port number doesn't matter.
Port-restricted cone NAT
Like an address restricted cone NAT, but the restriction includes port numbers .Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort.An external host (hAddr:hPort) can send packets to iAddr:iPort by sending packets to eAddr:ePort only if iAddr:iPort has previously sent a packet to hAddr:hPort.
Symmetric NAT
Each request from the same internal IP address and port to a specific destination IP address and port is mapped to a unique external source IP address and port; if the same internal host sends a packet even with the same source address and port but to a different destination, a different mapping is used. Only an external host that receives a packet from an internal host can send a packet back.
So, implementation of NAT is somehow vendor specific and depends on capabilty of device ,
Acording to the type of NAT you are parsing will controll the scanning activity
NAT in the context you describe (i.a. one external and multiple internal IP addresses) works by rewriting the source IP and port of an outgoing connection and adding a state so that replies to this rewritten connection can be mapped back in order to rewrite destination IP and port for incoming packets. This means that any connection attempt from outside must match an existing NAT state because otherwise no destination IP and port can be found. This makes scanning a computer behind a NAT impossible, because there will be practically no NAT states matching the source and destination used in scanning from outside.
