NAT and DHCP

The Address Crisis That Never Ended

Network Address Translation (NAT) allows an entire private network to share one or a few public IP addresses. The principle: routers rewrite packet headers at the boundary between private and public address space, maintaining a translation table that maps inside addresses to outside addresses and back. From the internet's perspective, all devices behind a NAT share a single identity.

NAT is defined in RFC 2663 (terminology) and RFC 3022 (traditional NAT). It enables three private address ranges defined in RFC 1918 — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — to be reused in billions of networks simultaneously without conflict.

The RFC 1918 Private Address Space

Three ranges are reserved for private use — never routed on the public internet:

• 10.0.0.0/8: Class A equivalent — 16,777,216 host addresses. Used by large enterprises and cloud VPCs.

• 172.16.0.0/12: Covers 172.16.0.0 – 172.31.255.255 — 1,048,576 addresses. Common in medium enterprises.

• 192.168.0.0/16: 65,536 addresses. The home/SMB standard — virtually every home router defaults to 192.168.1.0/24.

Additionally, 100.64.0.0/10 (RFC 6598) is reserved for Carrier-Grade NAT (CGNAT) — a second layer of NAT where ISPs aggregate multiple customers behind a single public IP, compounding the address translation problem.

NAT Types — Static, Dynamic, and PAT

PAT — How Port Multiplexing Works

PAT (Port Address Translation) — also called NAT Overload or IP Masquerade — is the most widely deployed form of NAT. It allows thousands of inside hosts to share a single public IP by differentiating flows using transport layer port numbers.

The NAT router maintains a connection tracking table mapping (inside_ip, inside_port, protocol) → (outside_ip, outside_port). When a packet arrives from the inside:

1. Router looks up the source IP:port in the NAT table. If no entry, creates one, assigning an available ephemeral port from the router's public IP.

2. Router rewrites the source IP to the public IP and the source port to the assigned port.

3. Router forwards the packet. When the reply arrives at the public IP and assigned port, the router reverses the translation.

# Cisco IOS PAT configuration
! Define inside interface (private side)
interface GigabitEthernet0/0
  ip address 192.168.1.1 255.255.255.0
  ip nat inside

! Define outside interface (public side)
interface GigabitEthernet0/1
  ip address 203.0.113.5 255.255.255.252
  ip nat outside

! Define which inside traffic gets translated
access-list 1 permit 192.168.0.0 0.0.255.255

! Enable PAT (overload = PAT mode)
ip nat inside source list 1 interface GigabitEthernet0/1 overload

! Verify
show ip nat translations                   ! Live translation table
show ip nat translations verbose           ! With timing info
show ip nat statistics                     ! Hit counts, miss counts, translation table size

The NAT Translation Table in Detail

NAT and Application Layer Gateways (ALGs)

PAT works cleanly for protocols where addresses are only in IP/TCP headers. But some protocols embed IP addresses in the application payload — and those embedded addresses are not translated by basic NAT:

• FTP Active Mode: the client sends its IP:port in the DATA channel within the PORT command. The server tries to connect back to that private IP — which is unreachable from the internet. Fix: FTP Passive Mode (PASV) or NAT FTP ALG.

• SIP (VoIP): Session Description Protocol (SDP) bodies embed IP:port for media streams. NAT breaks SIP without a SIP ALG or STUN/TURN infrastructure.

• IPsec ESP: ESP encrypts the entire packet including port numbers, so NAT cannot track connections. NAT-T (UDP port 4500 encapsulation) wraps ESP in UDP to work around this.

• WebRTC: uses ICE (Interactive Connectivity Establishment) with STUN/TURN to discover and traverse NAT, establishing peer-to-peer paths even behind symmetric NAT.

NAT Security Implications

NAT does provide implicit inbound filtering for unsolicited traffic — packets arriving at the public IP without an existing translation entry are dropped because there is nowhere to forward them. This incidentally blocks many opportunistic scans and unsolicited inbound connections.

But NAT provides zero protection against:

• Malware that initiates outbound connections (C2 callbacks, data exfiltration)

• Drive-by downloads and browser exploits

• DNS-based attacks and DNS exfiltration

• Any attack embedded within allowed application traffic (HTTP, HTTPS)

• IPv6 traffic (if IPv6 is deployed alongside NAT IPv4, it bypasses NAT entirely)

CGNAT and Port Exhaustion

Carrier-Grade NAT (CGNAT, RFC 6888) applies a second NAT layer at the ISP level: thousands of customers share a block of public IPs in the 100.64.0.0/10 range. This solves the ISP's IPv4 exhaustion but introduces severe problems for applications:

• Port forwarding for home servers is impossible (customer gets a CGNAT IP, not a real public IP)

• Law enforcement tracing by IP becomes ambiguous (thousands of customers share one IP at any moment)

• Some gaming platforms, WebRTC, and VPN protocols fail behind double-NAT

• IP reputation systems mistakenly penalize the shared CGNAT IP for any single misbehaving customer

DHCP — Automatic Address Assignment

DHCP (Dynamic Host Configuration Protocol) automates the assignment of: IP address, subnet mask, default gateway, DNS servers, and hundreds of optional parameters (NTP servers, domain name, TFTP server for PXE boot, WPAD URL for proxy autoconfiguration, etc.).

DHCP is a client-server protocol running over UDP: clients use port 68, servers use port 67. The exchange is the DORA handshake: Discover → Offer → Request → Acknowledge.

The DORA Exchange — Packet by Packet

Message Type: DISCOVER
Client Hardware Address: AA:BB:CC:DD:EE:FF
Transaction ID: 0x3903F326
Parameter Request List: [Subnet Mask, Router, DNS, Domain Name]

DHCP Lease Lifecycle

DHCP leases follow a three-phase lifecycle after DORA completes:

• T1 (Renewal Time): at 50% of lease duration, the client sends a unicast DHCPREQUEST directly to the server that granted the lease. If the server responds with DHCPACK, the lease is renewed with a fresh duration. Most deployments default T1 to 50% of lease time.

• T2 (Rebind Time): at 87.5% of lease duration, if T1 renewal failed, the client broadcasts DHCPREQUEST to any DHCP server. This allows a different server to take over the lease if the original server is unavailable.

• Expiry: if T2 also fails, the lease expires. The client must start a new DORA exchange and will likely receive a different IP address.

# Cisco IOS DHCP server configuration
! Define excluded addresses (routers, printers, servers — never auto-assign these)
ip dhcp excluded-address 192.168.1.1 192.168.1.20

! Define DHCP pool
ip dhcp pool OFFICE
  network 192.168.1.0 255.255.255.0    ! Address space
  default-router 192.168.1.1           ! Option 3: gateway
  dns-server 8.8.8.8 8.8.4.4          ! Option 6: DNS
  domain-name corp.example.com        ! Option 15: domain
  lease 1                              ! Lease duration: 1 day (86400s)
  netbios-node-type h-node             ! Option 46: WINS type (Windows)

! Static DHCP binding (always give this MAC the same IP)
ip dhcp pool PRINTER-FLOOR2
  host 192.168.1.50 255.255.255.0
  hardware-address 00:1A:2B:3C:4D:5E
  default-router 192.168.1.1

! Verify
show ip dhcp binding                   ! All active leases (IP, MAC, expiry)
show ip dhcp pool                      ! Pool utilization stats
show ip dhcp conflict                  ! IPs that caused conflicts (duplicate detection)
debug ip dhcp server events            ! Live DORA trace

DHCP Relay — Crossing Layer 3 Boundaries

The DHCP relay agent (also called IP Helper) receives the broadcast DISCOVER on the client's VLAN interface, records the incoming interface IP (the subnet gateway) as the giaddr (gateway IP address) field in the DHCP packet, and forwards it as a unicast UDP packet to the configured DHCP server. The server uses giaddr to determine which pool to allocate from. The server's reply is unicast back to the relay agent, which forwards it to the client.

! Configure DHCP relay on the VLAN interface
interface Vlan10
  ip address 10.10.0.1 255.255.0.0
  ip helper-address 192.168.1.100     ! Forward DHCP broadcasts to this server
  ip helper-address 192.168.1.101     ! Second DHCP server for redundancy

! ip helper-address forwards 8 UDP services by default:
!   TFTP (69), DNS (53), DHCP/BOOTP (67/68), TACACS (49),
!   NetBIOS Name Service (137/138), IEN-116 Name Service (42), Time (37)
! To restrict to DHCP only:
no ip forward-protocol udp 69        ! Disable TFTP forwarding
no ip forward-protocol udp 137       ! Disable NetBIOS forwarding

! Verify relay operation
debug ip dhcp server packet           ! See DISCOVER arriving from relay (giaddr set)

DHCPv6 and SLAAC — Address Assignment in IPv6

IPv6 address assignment uses three mechanisms, controlled by flags in Router Advertisements (RA):

• SLAAC (Stateless Address Autoconfiguration): the client uses the router's advertised prefix + its own interface identifier (EUI-64 or random) to construct an address. No server needed. The RA M-flag = 0 and O-flag = 0 indicates pure SLAAC.

• Stateless DHCPv6: SLAAC for address + DHCPv6 for options (DNS servers, domain name). RA has M-flag = 0, O-flag = 1. The client autoconfigures its address from the prefix but queries a DHCPv6 server for configuration options only.

• Stateful DHCPv6: DHCPv6 assigns both address and options, like DHCPv4. RA has M-flag = 1. Server maintains a binding database. Required for environments that need to control exactly which address each client gets.

! IPv6 Router Advertisement configuration (IOS)
interface GigabitEthernet0/0
  ipv6 address 2001:db8:1::1/64
  ipv6 nd managed-config-flag         ! M-flag = 1: use stateful DHCPv6 for address
  ipv6 nd other-config-flag           ! O-flag = 1: use DHCPv6 for options

! Stateful DHCPv6 pool
ipv6 dhcp pool OFFICE-V6
  address prefix 2001:db8:1::/64 lifetime 86400 3600
  dns-server 2001:4860:4860::8888
  domain-name corp.example.com

interface GigabitEthernet0/0
  ipv6 dhcp server OFFICE-V6

! DHCPv6 relay (like ip helper-address for IPv6)
interface Vlan20
  ipv6 address 2001:db8:2::1/64
  ipv6 dhcp relay destination 2001:db8:255::100 GigabitEthernet0/1

! Verify
show ipv6 dhcp binding                ! Active DHCPv6 leases
show ipv6 neighbors                   ! NDP neighbor table (IPv6 ARP equivalent)

DHCP Security — Starvation, Spoofing, and Snooping

DHCP attacks are among the most accessible Layer 2 attacks. The defenses are built into modern switches:

DHCP Snooping (IEEE 802.1Q): the switch differentiates between trusted ports (connecting to DHCP servers) and untrusted ports (connecting to clients). DHCP OFFER and DHCPACK messages on untrusted ports are dropped. The switch also builds a DHCP snooping binding table (IP-to-MAC-to-port mappings) that feeds Dynamic ARP Inspection and IP Source Guard.

! Enable DHCP snooping (Cisco IOS-based switch)
ip dhcp snooping                           ! Enable globally
ip dhcp snooping vlan 10,20,30             ! Enable on specific VLANs

! Mark the uplink to DHCP server as trusted
interface GigabitEthernet0/24
  ip dhcp snooping trust                   ! Allow DHCP server responses

! Rate-limit client-facing ports (starvation defense)
interface GigabitEthernet0/1
  ip dhcp snooping limit rate 15           ! Max 15 DHCP packets/second

! Verify
show ip dhcp snooping binding              ! Binding table (IP, MAC, VLAN, port)
show ip dhcp snooping statistics           ! Dropped messages by reason

! Dynamic ARP Inspection (builds on snooping table)
ip arp inspection vlan 10,20,30
interface GigabitEthernet0/24
  ip arp inspection trust                  ! Only trust ARP from this uplink

NAT and Firewall Interaction

Modern next-generation firewalls (NGFW) integrate NAT and firewall policy in a unified platform. Key behaviors to understand:

• Cisco ASA: NAT rules are evaluated after access-list inspection. Firewall policy uses pre-NAT (real) addresses. Object NAT is evaluated before twice-NAT.

• Palo Alto Networks: Security policy uses pre-NAT source and post-NAT destination for matching. NAT rules run in a separate evaluation pass.

• iptables (Linux): DNAT (destination NAT, port forwarding) happens in PREROUTING before the FORWARD chain. SNAT happens in POSTROUTING after the FORWARD chain. Rules in FORWARD see post-DNAT destination but pre-SNAT source.

# Linux iptables NAT + firewall
# PREROUTING: port forward before firewall evaluation
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.100:443

# FORWARD: firewall rules see post-DNAT destination (192.168.1.100)
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

# POSTROUTING: PAT for all outbound traffic
iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o eth0 -j MASQUERADE

# nftables equivalent (modern Linux)
table ip nat {
    chain prerouting {
        type nat hook prerouting priority dstnat;
        iif eth0 tcp dport 443 dnat to 192.168.1.100:443
    }
    chain postrouting {
        type nat hook postrouting priority srcnat;
        oif eth0 masquerade
    }
}

DHCP Options Deep Dive

DHCP options use the TLV (Type-Length-Value) format defined in RFC 2132. Key options in production environments:

DHCP Option Reference (RFC 2132 + extensions)
--
Option 1:   Subnet Mask           (e.g., 255.255.255.0)
Option 3:   Router / Default GW   (e.g., 192.168.1.1)
Option 6:   DNS Servers           (e.g., 8.8.8.8 8.8.4.4)
Option 12:  Hostname              (client sends its hostname)
Option 15:  Domain Name           (e.g., corp.example.com)
Option 42:  NTP Servers           (e.g., 192.168.1.5)
Option 43:  Vendor-Specific Info  (VoIP phones, APs, PDAs)
Option 51:  IP Address Lease Time (seconds)
Option 52:  Option Overload       (extends into sname/file fields)
Option 53:  DHCP Message Type     (DISCOVER/OFFER/REQUEST/ACK/etc.)
Option 54:  Server Identifier     (server's IP)
Option 55:  Parameter Request List (client's wish list)
Option 58:  Renewal Time T1       (default 50% of lease)
Option 59:  Rebind Time T2        (default 87.5% of lease)
Option 60:  Vendor Class ID       (client announces device type)
Option 66:  TFTP Server Name      (for PXE boot)
Option 67:  Bootfile Name         (for PXE boot)
Option 82:  Relay Agent Info      (switch port, circuit ID — anti-spoofing)
Option 121: Classless Static Routes (RFC 3442 — push specific routes)
Option 252: WPAD URL              (Web Proxy Auto-Discovery)

Option 121 (Classless Static Routes) is particularly powerful — it lets DHCP push specific routing entries to clients. This can override the default gateway for specific prefixes, but it also creates a security risk: a rogue DHCP server injecting Option 121 with a route for 0.0.0.0/0 via an attacker-controlled gateway can completely redirect a client's traffic — including VPN traffic on some operating systems (the VPN bypass vulnerability documented in 2024).

Troubleshooting NAT and DHCP

DHCP Troubleshooting Commands

! Client side (Windows)
ipconfig /all                          ! Show current DHCP lease, server IP, lease times
ipconfig /release                      ! Release the current lease
ipconfig /renew                        ! Perform new DORA exchange
netsh dhcp client show all

! Client side (Linux)
dhclient -v eth0                       ! Verbose DHCP client, shows DORA exchange
journalctl -u NetworkManager | grep DHCP

! Server side (IOS)
show ip dhcp binding                   ! Lease table — check utilization
show ip dhcp pool POOLNAME             ! Free vs. allocated addresses
show ip dhcp conflict                  ! IPs that triggered duplicate detection
clear ip dhcp binding *                ! Clear all leases (emergency fix for exhaustion)

! Relay debugging
debug ip dhcp server packet            ! Verify DISCOVER arrives with correct giaddr
show ip helper-address                 ! Check relay config

NAT Troubleshooting Commands

! Verify translation is happening
show ip nat translations               ! Active entries in NAT table
show ip nat translations verbose       ! With timeout remaining

! Statistics
show ip nat statistics                 ! Hits, misses, expired translations, pool usage

! Clear specific or all translations
clear ip nat translation *             ! Nuclear option — drops all active sessions

! Debug (use carefully — very verbose)
debug ip nat                           ! Live NAT event log
debug ip nat detailed                  ! Per-packet NAT decisions

! Check NAT is configured correctly
show running-config | include nat       ! Verify nat inside/outside and ip nat statements

A common NAT issue is asymmetric routing: packets go out via the NAT router but return via a different path. The NAT router never sees the return traffic, so it never creates the reverse translation entry. The fix: ensure symmetric routing so both directions of a flow traverse the same NAT device, or use stateful NAT clusters with session synchronization.

Common Misconceptions

Depth Check