System Design Cases
IP, Routing, NAT for Architects
IP addressing (IPv4/IPv6, CIDR, RFC1918), routing (BGP between AS), NAT (SNAT/DNAT/PAT), anycast vs unicast — concept page for foundations curriculum. Demonstrates outbound NAT mapping, inbound DNAT vs P2P NAT-traversal failure, BGP route propagation with anycast routing к ближайшему DC, BGP hijack attack scenario. Includes ADRs on IPv4 exhaustion (NAT vs IPv6) and stateful NAPT-table memory pressure.
IP routing and NAT: forwarding, translation, and state
Routing selects a next hop from destination reachability. NAT rewrites addresses or transport identifiers and maintains mapping state. They are often co-located, but they solve different problems and fail differently.
Mental model
- Forwarding uses the most specific matching destination prefix. The control plane learns or configures routes; the data plane applies the installed forwarding entry.
- BGP exchanges reachability and policy attributes between autonomous systems; it is not the per-packet forwarding algorithm.
- Traditional NAPT creates or reuses an address-and-port mapping for outbound traffic. Mapping behavior and filtering behavior are separate properties.
- NAT does not create end-to-end identity, encryption, or a general security boundary. IPv6 removes address scarcity pressure but still needs routing and security policy.
Гарантии и границы
- IPv4 routers decrement TTL when forwarding; expiration bounds loops and can generate ICMP Time Exceeded.
- A NAT return path requires applicable live state or explicit inbound configuration.
- CGN external ports are finite shared resources; exhaustion should reject new mappings instead of deleting established ones.
- Route availability is not application availability: the destination can be routed but unhealthy.
Сценарии диаграммы
Longest-prefix forwarding. The data plane chooses the most specific matching prefix from its installed forwarding entries.
Outbound NAT mapping and return traffic. An outbound packet creates or reuses translation state; permitted return traffic is translated through that state.
Mapping expiry and unsolicited inbound traffic. Translation mapping and filtering policy are distinct; expired or absent state cannot identify an internal endpoint.
TTL limits a forwarding loop. A router decrements IPv4 TTL while forwarding and discards a packet that reaches zero, normally returning ICMP Time Exceeded for unicast.
Архитектурные решения
- Separate route control, forwarding, translation, filtering, and application retry policies in diagrams and alerts.
- Prefer IPv6 where feasible; if CGN is required, budget port capacity, mapping churn, logs, privacy, and abuse correlation.
- For inbound reachability, specify an explicit mechanism rather than assuming NAT will discover the internal target.
Сбои и неоднозначные исходы
- A missing route and an expired NAT mapping can both look like a timeout but require different telemetry.
- Asymmetric paths are valid for routing but stateful NAT or firewalls must observe the required direction or share state.
- BGP convergence and policy can change the next hop; existing application sessions still need transport recovery.
Операционный checklist
- Show the destination prefix and selected next hop separately from translated source state.
- Budget external addresses, ports, mapping rate, and mapping lifetime.
- Log only the mapping data required by policy and protect it as sensitive operational data.
- Test expiry, port exhaustion, asymmetric return, and ICMP handling.