thecraftman / aws-nat-gateway Goto Github PK

For the average Internet user, a significant value of NAT is the technique's ability to
act with the most desirable property of a firewall: because outbound traffic appears
to come from the NAT gateway, there is no way to target an individual host behind
the gateway.

Most wireless routers and similar devices therefore use dynamic NAT - each outbound
endpoint - an (IP_adress, port) pair - is logged in a translation table against the originating
(IP_address, port) pair when it is first detected.
Outbound traffic from an internal host is then rewritten on the fly, so to the remote
endpoint it appears to come from an endpoint on the gateway. When the remote system
replies to the gateway endpoint, the gateway looks up the internal endpoint associated
with that gateway endpoint and rewrites it so the internal system sees what appears to be
a direct reply from the remote host.

Since translation table entries cannot be created by incoming traffic, hosts inside the
(dynamic) NAT gateway are secure against any inbound connection. Typically table
entries will time out if no traffic is seen between the mapped port pair for a specific length
of time.

Static NAT systems allow the administrators to create specific mappings from external
endpoints to internal endpoints. Since the mappings are independent of traffic,
external systems can connect to internal endpoints by addressing the external
endpoint mapped to it. This is typically used to unify disparate services behind the
gateway, possibly on different servers, so they appear to be independent services
all running on different ports on the same host.

The above information might make the README even more informative.

testinggg