How does a webpage get back to me behind NAT

[globalnode]

Hi,

My first guess at this is that the rounter is adding headers to all my IP traffic so that it can determine which of the PC's on my local network gets the result of a HTTP request..

Is this correct?

[wimiadmin]

I believe the way it works is when you make a request to a server for a website, the initial request is sent to that computer on port 80. Once the server receives your request, the two computers open a connection....most likely on a different port.....until the server delivers 100% of the data. Once the data is delivered, the connection is usually dropped after a certain amount of seconds. Then while you're scanning the page and see a link you click on, a new connection (port) is established and the process happens again.

Because the outbound connection was initiated by your computer, your network allows that traffic in most cases.

[globalnode]

Thanks for your reply

I'm still confused, I'll add some more detail to my question.

Lets say my IP on a local network is 10.0.0.2, this is a private IP address. My router has an address that is public on the internet, say a static IP, lets make something up: 123.456.789.012.

The web server at the other end is going to respond to which IP address? and if it responds to the public router, how does it get to MY pc if I have 2 computers on the local network? 10.0.0.1 or 10.0.0.2?

*scratches head*

[wimiadmin]

Your router acts as a post office. In your case there are 3 cities 2 are represented by PCs 10.0.0.1, 10.0.0.2, and the 3rd city is the internet. If 10.0.0.1 makes a request for a web site the router directs that PC to the internet. If that computer makes a request for google.com. We humans see it as google.com. The computer sees it completely different, but I'll keep this simple. It will initially see it as 209.85.171.100:80. 209.85.171.100 is the IP address of the server the site is hosted on and :80 is the port for an http request. If you went to https google.com then the request would be 209.85.171.100:443 with 443 being the port for https.

The PC on your network receives an answer from google.com or 209.85.171.100:80 and the google.com server might say lets move to port 42000. So now, the connection is 209.85.171.100:42000 to your externalIP:42000. The router knows which computer made the request so it forwards the incoming traffic on port 42000 to the PC that made the request.

The reason the google server would move the request off of port 80 would be to free up port 80 for new incoming requests.

[globalnode]

So routers are smart little things, keeping all sorts of tables about who made what request etc.

Thank you for your patience, after reading your replies and a "Whole lot of wiki's" I understand finally. ^^

Now what evillness can I get up to with this information.