Routers and NAT

What a router does

A router connects different networks and decides where each packet should go next. A switch only moves frames inside one network, so you need a router whenever traffic has to leave that network.

Your home router has your private home network on one side and your internet provider on the other. When your laptop requests a website, the request goes to the router, and the router forwards it towards the internet.

The default gateway

A device only talks directly to other devices in its own subnet. For everything else, it needs a router to hand the packet to. The address of that router is the device's default gateway: "if the destination is not on my local network, send it here".

ip route          # Linux
route print       # Windows

On Linux you will see a line like default via 192.168.1.1. That is your gateway, and at home it is almost always your router.

Routing tables

A router keeps a routing table, a list of known networks and the next step for reaching each one.

Destination        Next hop              Interface
192.168.1.0/24     directly connected    eth0
10.0.0.0/8         192.168.1.254         eth0
0.0.0.0/0          203.0.113.1           eth1   (default route)

When a packet arrives, the router finds the matching row. If no specific row matches, it uses the default route, 0.0.0.0/0, which means "everything else".

Worked example: which row wins

Using the table from the previous card, the router decides like this:

Packet for 192.168.1.25  matches 192.168.1.0/24  -> deliver directly
Packet for 10.0.5.9      matches 10.0.0.0/8       -> send to 192.168.1.254
Packet for 8.8.8.8       matches only 0.0.0.0/0   -> send to 203.0.113.1

What if two rows match? Suppose the table also has a row for 10.0.5.0/24. A packet for 10.0.5.9 then matches both 10.0.0.0/8 and 10.0.5.0/24. The router chooses the one with the longest prefix, which is the most specific one. Here that is the /24.

How data crosses the internet

No router has a map of the whole internet. Each one only knows the next hop, the next router that is closer to the destination. A packet is passed from router to router until it arrives.

You can watch the hops with a trace:

traceroute example.com     # Linux and macOS
tracert example.com        # Windows

Each line of the output is one router that your packets passed through.

TTL: why packets cannot circle forever

If routers disagree about the best path, a packet could be passed around in a loop. To prevent this, every IP packet has a TTL (time to live) value, often starting at 64 or 128. Each router subtracts 1. When it reaches 0, the router discards the packet and sends back an error message.

This also explains how traceroute works. It sends packets with TTL 1, then 2, then 3 and so on. The router where each packet expires sends back an error that reveals its address, and together these replies form the list of hops.

Static and dynamic routing

• Static routes are entered by hand. They are simple and predictable and work well in small networks, but they do not adapt when a link breaks.
• Dynamic routing lets routers exchange information with each other through protocols such as OSPF and BGP. If a path fails, they find another automatically. BGP is the protocol that connects the networks of the internet to each other.

NAT: sharing one public address

Home devices use private addresses, which cannot be routed on the internet. So how can ten devices browse at the same time with one public address? Through NAT (Network Address Translation).

When a packet leaves your network, the router replaces the private source address with its own public address and remembers which device sent it. When the reply arrives, the router looks up that record and forwards the reply to the right device.

A NAT table in action

The router keeps a table with one entry for each active conversation:

Inside                   Outside (what the web sees)
192.168.1.23:51514  ->   203.0.113.9:40001
192.168.1.40:49822  ->   203.0.113.9:40002

Two devices share one public address, and the router gives each conversation a different public port. When a reply arrives for port 40002, the router finds the entry and forwards the packet to 192.168.1.40.

The table only contains conversations that were started from inside. A packet that arrives from the internet with no matching entry is dropped. If you want to run a server at home, you add a port forwarding rule, which tells the router that anything arriving on a certain port goes to a certain device inside.