The Disadvantages of NAT

The Disadvantages of NAT
Now that we’ve sold you on using NAT in your network, you should be aware of the disadvantages
as well. The following is a list of some of the disadvantages of using NAT compared
to using individually registered IP addresses on each internal network host:

NAT increases latency (delay). Delays are introduced into the packet-switching process
because of the processor overhead needed to translate each IP address contained in the
packet header. The router’s CPU must be used to process every packet to decide if
Understanding Network Address Translation
81
the router needs to translate the IP addresses in the IP header. Depending upon the
type of traffic, NAT will change the IP addresses inside the payload, but this is on an
application-by-application basis.

NAT hides end-to-end IP addresses that render some applications unusable. Some
applications that use the IP address of the host computer inside the payload of the
packet will break when NAT translates the addresses in the IP header and not inside
the packet’s payload. As noted in the last bullet, this has been fixed somewhat, but this
is on an application-by-application basis and is not scalable in the long term.

Because NAT changes IP addresses, there is a loss in the ability to track an IP flow end-toend.
This does provide an advantage from a security standpoint by eliminating a hacker’s
ability to identify the packet’s true source. However, this slight increase in security is at the
expense of end-to-end accountability.

NAT also makes troubleshooting or tracking down where malicious traffic is coming from
more troublesome. This is because the traffic could be coming from a single user who is
using a different IP address depending on when the traffic passes through the NAT router.
This makes tracing back a malicious connection and making that person accountable much
more difficult.

Because a host that needs to be accessed from the outside network will have two IP addresses—
one inside local and one inside global—this creates a problem called split DNS. You need to set
up two DNS servers, one for global addresses and one for local addresses. This can lead to
administrative nightmares and problems if inside hosts are pointing to the DNS server with the
global addresses, because the host’s local peers are not accessible to it by those addresses. Also,
problems arise whenever outside hosts query the DNS server with the local addresses, the latter
case requiring additional translation or configuration before it can be possible.