2

Network Address Translation resolve the problem of limited IPv4 by allocating one public IPv4. When a node inside the network want to send a packet to the internet a special port is generated that act as a NAT index in order to mark the node.

In order to scan a computer behind a NAT, does an attacker can enumerate ports with the public IP address of the node that act as a NAT(router) to scan computers in the inner network?

2

It depends Upon the type of NAT

Full-cone NAT, also known as one-to-one NAT

Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort. Any external host can send packets to iAddr:iPort by sending packets to eAddr:ePort.

(Address)-restricted-cone NAT

Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort. An external host (hAddr:any) can send packets to iAddr:iPort by sending packets to eAddr:ePort only if iAddr:iPort has previously sent a packet to hAddr:any. "Any" means the port number doesn't matter.

Port-restricted cone NAT

Like an address restricted cone NAT, but the restriction includes port numbers .Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort.An external host (hAddr:hPort) can send packets to iAddr:iPort by sending packets to eAddr:ePort only if iAddr:iPort has previously sent a packet to hAddr:hPort.

Symmetric NAT

Each request from the same internal IP address and port to a specific destination IP address and port is mapped to a unique external source IP address and port; if the same internal host sends a packet even with the same source address and port but to a different destination, a different mapping is used. Only an external host that receives a packet from an internal host can send a packet back.

So, implementation of NAT is somehow vendor specific and depends on capabilty of device ,

Acording to the type of NAT you are parsing will controll the scanning activity

2

NAT in the context you describe (i.a. one external and multiple internal IP addresses) works by rewriting the source IP and port of an outgoing connection and adding a state so that replies to this rewritten connection can be mapped back in order to rewrite destination IP and port for incoming packets. This means that any connection attempt from outside must match an existing NAT state because otherwise no destination IP and port can be found. This makes scanning a computer behind a NAT impossible, because there will be practically no NAT states matching the source and destination used in scanning from outside.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.