Network Address and Port Translation (NAPT)

Network Address and Port Translation (NAPT) allows a single device, such as a router, to be an agent between the Internet (or "public network") and a local (or "private") network. This means that only a single unique IP address represents an entire group of devices to the outside world.

Implementing dynamic NAPT automatically creates a firewall between your internal network and the Internet. NAPT only allows connections that originate inside the internal network. Essentially, this means that a computer on an external network cannot connect to your computer unless your computer has initiated the contact. Nobody from the outside can latch onto your IP address and use it to connect to a port on your computer.

Under NAPT, all internal network computers are inaccessible from the outside. However, if you need to use public services such as Web, FTP, or e-mail servers from your private network, you can set up a virtual server to permit secured access. In this method, a connection with the outside is redirected to a host (the virtual server) running the services on the private network. (IP forwarding is another term for this.)

The Virtual Servers setup page allows you to add, remove, and save virtual server settings.

Passing Applications Through NAPT

Port Forwarding When Hosting Services Behind NAPT

Port Forwarding When Hosting Games Behind NAPT

Port Triggering for Playing Games Behind NAPT

Applications that Do Not Require Configuration Behind NAPT

The following applications, when run behind NAPT, do not require any router user configuration.

Notes:


All protocols mentioned above are for clients running behind the NAPT. If a hosting server is needed, use port forwarding instead.

Windows Media Player uses TCP port 1755 from the player to connect to the server, and uses UDP ports 7000-7007 to perform the actual data streaming.

DirectX uses TCP port 47624 from the client behind NAPT to connect to the peer, and it expects the peer to use the UDP ports 2300-2400 thereafter.

The AOL and MSN Messenger Proxy Server are required for user-user direct connection during file and image transfer.

Applications Behind NAPT Requiring Application Configuration Change ICQ

The following steps provide a workaround to problems you might have when using ICQ's file transfer, Send/Start ICQ chat and PC2PC phone. The problem is that some of these applications set the Web browser to use a proxy server to listen to incoming connection requests.

1. In your Web browser, go to the user connection preferences and enable Using proxy. Set the type to SOCKS 4.

2. Disconnect and reconnect.

3. Set the type back to Not using proxy and change settings to use the ports you specify. You should now be able to make a functioning connection. Be sure to disconnect/reconnect after you make every change.

4. From the router, use virtual servers (port forwarding) to forward the TCP port range chosen in the previous step to your local machine.

Return to Tutorials page