第14章 VPN和NAT.ppt

yn@uestc.edu.cn yn@uestc.edu.cn 网络工程系 电子科大通信学院 Chapter 14 VPN and NAT Private networks Virtual private networks Network address translation 14.1 Private Networks Private network: 私有网 or 专用网 Designed to be used inside an organization Allows access to shared resources and provides privacy Intranet: 内联网 A private network that uses the TCP/IP protocol suite Access to the network is limited only to the users inside the organization LAN or WAN Extranet: 外联网 The same as an intranet with one major difference some resources may be accessed by specific groups of users outside the organization under the control WAN Addressing Strategy 1 Apply from the Internet authorities and use them Unique globally The organization can easily connect to the Internet in the future The address space is wasted Strategy 2 Use without registering with the Internet authorities Confuse the addresses as part of the global Internet Strategy 3 Use the addresses reserved by the Internet authorities Unique inside the organization, not globally Private Addresses No router in the Internet will forward a packet that has one of these addresses as the destination address 14.2 Virtual Private Networks Achieving privacy Private networks Hybrid networks Virtual Private Network, VPN VPN Technology IPsec Authentication and privacy Tunneling Privacy Addressing in a VPN 14.3 Network Address Translation NAT, RFC 3022 ( RFC 2663 ) Internal communication: Access Internet: Only one single connection to the Internet through a router or a proxy server that runs the NAT software 14.3.1 Variations of NAT Map between local and global addresses One local address ?? One global address Method: Basic NAT More local address ?? One global address Method: NAPT How to establish the map for NAT Static assignment Method: Static NAT Dynamic assignment Method: Dynamic NAT 14.3.2 Basic NAT All outgoing packets go through the NAT router source local address ? source global address All incoming packets pass through the NAT route