DHCP and NAT

Why it matters

When you join a Wi-Fi network, your phone gets an IP address, a gateway and DNS servers within a second, and then reaches the internet even though dozens of devices in the house share one public address. Two services make that happen: DHCP hands out the settings, and NAT shares the address. Both appear in cloud networks too (managed DHCP options and NAT gateways), and both are common sources of "no internet" problems.

DHCP: automatic configuration

A device needs four settings to use an IP network:

1. an IP address
2. a subnet mask
3. a default gateway (the router that leads off the local network)
4. one or more DNS servers

Typing these by hand on every device would be slow and error-prone, so the Dynamic Host Configuration ProtocolDHCP: the service that automatically gives devices an IP address, mask, gateway and DNS servers. does it. On a home network, the DHCP server is built into the router.

DORA: the four-message exchange

DHCP uses UDP (server port 67, client port 68). A device that has no address yet goes through DORAThe four DHCP messages: Discover, Offer, Request and Acknowledge.:

1. Discover: the client broadcasts "is there a DHCP server?" (it has no address, so it sends from 0.0.0.0 to 255.255.255.255).
2. Offer: the server offers an address, for example 192.168.1.23, plus mask, gateway and DNS.
3. Request: the client broadcasts "I'd like 192.168.1.23", so other servers know their offers were declined.
4. Acknowledge: the server confirms, and the client starts using the address.

Leases

Addresses are leased, not given forever. A typical home leaseThe limited time a DHCP address is assigned to a device before it must be renewed. is 24 hours. The client renews at about halfway through. When devices leave, their addresses return to the pool. A router often hands out a range such as 192.168.1.100 to 192.168.1.199.

A reservation (static lease) makes the router always give the same address to one device's MAC address, which is handy for a printer or a home server.

If no server answers, the device gives itself a 169.254.x.x address and cannot reach the internet. That address is a strong clue that DHCP failed.

NAT: sharing one public address

Your ISP usually gives your home one public IPv4 address. Inside, devices use private RFC 1918 addresses such as 192.168.1.x, which are not routable on the internet. Network Address Translation (NAT)Rewriting addresses at a router so devices with private addresses can share a public one. on the router rewrites addresses as traffic leaves and returns.

The form used at home is PAT (port address translation, also called NAT overload): many inside devices share the one public address, told apart by port numbers.

Worked example: the NAT table

Your public address is 203.0.113.7. Two devices browse at the same time:

Inside (private)        ->  Outside (public)          ->  Server
192.168.1.23:52814      ->  203.0.113.7:40001         ->  93.184.215.14:443
192.168.1.40:52814      ->  203.0.113.7:40002         ->  93.184.215.14:443

Both devices happened to pick source port 52814. The router rewrites each to a unique public port and records the mapping. When a reply arrives at 203.0.113.7:40002, the router looks it up and forwards it to 192.168.1.40:52814.

Side effects of NAT

• Inbound connections are blocked by default. An outside device cannot start a connection to 192.168.1.40 because the router has no mapping for it. This acts like a basic firewall, but it is not a security control to rely on.
• Port forwardingA permanent NAT mapping that sends traffic arriving on a public port to one inside device and port. creates a permanent mapping (for example public port 8443 to 192.168.1.50:443) to expose one inside service. Do it only when you understand the risk.
• Carrier-grade NAT (CGNAT): some ISPs put customers behind another layer of NAT, so your router's "WAN" address may itself be private (often in 100.64.0.0/10).
• IPv6 has enough addresses that NAT is generally not needed; firewalls do the filtering.

In the cloud

A cloud virtual network uses private subnets too. Instances in a private subnet reach the internet through a NAT gateway, which lets them download updates while blocking inbound connections. NAT gateways are usually billed per hour and per gigabyte, so they are a common surprise on a cloud bill.

Common mistakes

• Setting a static IP inside the DHCP pool. The router may later hand the same address to another device, causing an address conflict. Use a reservation or an address outside the pool.
• Running two DHCP servers on one network (for example, a second router left in router mode). Devices get conflicting gateways.
• Confusing your private and public addresses. ipconfig/ip addr shows the private one; a "what is my IP" site shows the public one.
• Treating NAT as a firewall. Keep a real firewall enabled.

Quick recap

• DHCP gives devices an address, mask, gateway and DNS servers via Discover, Offer, Request, Acknowledge, on a lease.
• NAT (PAT) lets many private addresses share one public address by rewriting ports.
• 169.254.x.x means DHCP failed; inbound traffic needs port forwarding through NAT.