Re: Comcast problems again

On 05/25/2011 02:03 PM, Carl Karsten wrote:
>
> close:
>
> The X1,2,3,x+1000 is just random numbers, I think between 1024 and
> 65565.   call it Y.
>
> A browser sends a request and waits for the response on port Y.
>
> The nat box picks a new port Z, stores Y, Z in memory, sends the
> request off.  response comes back to port Z, nat looks up Z, sends the
> response to port Y.
>
I've tried to look this stuff up, but everything is so general, what 
makes NAT different from several browsers on one computer is unclear.



OK, and I'm presuming if (in the same computer) another browser tab or a 
different browse sends out a second request to the same website, it asks 
for a response on port Y1.

How are Y and Y1 chosen?  this could be significant.

The NAT box uses a different range of return ports than a single PC 
would?  the PC would perhaps use relatively low numbered return ports, 
but the NAT/firewall, assigns a large range to each local computer, so 
the translated ports are relatively large numbers?

Comcast can recognize this and decide they want to force me to buy some 
premium service in order to use more than one computer, so they will 
make it fail?  Is there a firewall/NAT that lets me configure how these 
numbers are assigned so that I can prevent comcast from breaking my 
ability to use more than one computer on the internet at a time?


If that is what is happening, a firewall/NAT box COULD work as below,

in the example below, the following apply:
--all requests going to port 80 on Google.com except as noted
--alpha, beta, are computers on the local network
--A given browser (well the os on behalf of the browser) will use Y, Y1, 
Y2, Y3 in sequence for return ports.

1. A request comes in from computer Alpha on the local network and 
requests a response on port Y.  Since nobody has used port Y yet, the 
NAT box goes ahead and forwards the request, asking for the response on 
port Y, and marks Google/Y as going to Alpha/Y.

2. A request comes in from computer Alpha on the local network,  
requests a response on port Y1, since this is another tab.  Since nobody 
has used Y1, this goes out requesting a response on Y1 also, the return 
from Google.com/Y1 will go to Alpha/Y1.

3. A request comes in from computer Beta on the local network, 
requesting a response on Port Y.  Since somebody has used Google/Y, this 
gets translated to Y2 (selected the same way the browser would have 
selected Y2), and the return comes from Google.com/Y2 and gets 
translated to Beta/Y.

4. A request comes in from computer Alpha on the local network for 
**facebook .com**, requesting a return on port Y2.  Since Y2 is in use, 
it will go out requesting a return on Y3 and the return from facebook/Y3 
will be translated to alpha/Y2.   Or are the same ports reused for 
different targets, so it would it be Y again?,   If that is the case, it 
will go out untranslated and the return from facebook/Y will be 
forwarded to Alpha/Y untranslated.

This adds a little more table lookup, since each computer isn't forced 
to a distinct range, but computers are a lot faster than when NAT was 
first invents.


I think several documents on the web have said that the term 
"masquerading" has been used for similar but different processes.

The first instructions for masquerading I found, were intended to 
install on my desktop computer that connects to the ISP, and creating a 
local network for a few more computers.  When I read further, they 
involved applying source patches and rebuilding the kernal, so I gave up 
on doing that.

http://tldp.org/HOWTO/IP-Masquerade-HOWTO/

which says in "what is" section (note "similar to the one-to-many NAT 
servers", not the same, but similar:

    IP Masquerade is a networking function in Linux similar to the
    one-to-many (1:Many) NAT (Network Address Translation) servers found
    in many commercial firewalls and network routers. For example, if a
    Linux host is connected to the Internet via PPP, Ethernet, etc., the
    IP Masquerade feature allows other "internal" computers connected to
    this Linux box (via PPP, Ethernet, etc.) to also reach the Internet
    as well. Linux IP Masquerading allows for this functionality even
    though these internal machines don't have *an officially assigned IP
    address*.

    MASQ allows a set of machines to *invisibly* access the Internet via
    the MASQ gateway. To other machines on the Internet, the outgoing
    traffic will appear to be from the IP MASQ Linux server itself. In
    addition to the added functionality, IP Masquerade provides the
    foundation to create a HEAVILY secured networking environment. With
    a well built firewall, breaking the security of a well configured
    masquerading system and internal LAN should be considerably
    difficult to accomplish.

I liked the statement that it was invisible to the internet.  Perhaps 
this was naiveté back in 2005 when it was written, or perhaps those 
instructions would yield something like the NAT process I describe above 
that cannot be deduced from the outside by port numbers requested.

That same how to, later contains the following:

    For an excellent and very comprehensive description of the various
    forms of NAT, please see:

        *

          http://www.suse.de/~mha/linux-ip-nat/diplom/nat.html/
          <http://www.suse.de/%7Emha/linux-ip-nat/diplom/nat.html>

    Here is another good site to learn about NAT, although many of the
    URLs are old but still valid:

        *

          http://www.linas.org/linux/load.html/
          <http://www.linas.org/linux/load.html>

And the first link is broken, the second one is supposed to be old 
(already old in 2005), yet already mentions many versions software for 
NAT, masquerading, PAT, etc., presumably now there are even more?   Or 
has there been the consolidation the document mentions was needed and 
there are fewer?  In any event, it doesn't seem wise to learn about how 
things were back in 2005 (last revision to the HOWTO), or 1998 (when it 
was started).

Would a proxy server would be indistinguishable from a single computer 
to comcast?  But all my local network would have to change.  Is there a 
proxy server that "recreates" an internal web so configuring each 
computer to use a proxy server isn't needed?

--Carey

-- 
Linux Users Of Northern Illinois (Chicago) - Technical Discussion 
http://luni.org/mailman/listinfo/luni