pcAnywhere and Network Address Translation

Situation:
You want to know if pcAnywhere will work with Network Address Translation.

Solution:
Network Address Translation (NAT) is a technology that allows workstations using private Internet Protocol (IP) addresses to still have access to the Internet. NAT does this by substituting a registered IP address into the source address of a message leaving the internal network and then restoring the internal address into the source address from a reply message.

Registered IP addresses are a scarce resource and while you can buy static IP addresses, the cost can be prohibitive for small businesses and home users. Large businesses either cannot purchase the large number of addresses they need, or they want to limit, for security reasons, the number of addresses that access the Internet. With NAT gateways running on a single or limited number of computers, it is possible to share a single registered address between multiple local computers and connect them all at the same time. The outside world is unaware of this division and thinks that only one computer is connected.

There are various ways to implement NAT:

• Single internal IP address is paired to a single external IP address. This is an uncommon practice. It does not extend the registered IP addresses between computers but does increase security.
• Multiple internal IP addresses are mapped to the same external IP address. This is the most common use of NAT.
• Multiple internal IP addresses are mapped to dynamically assigned external IP addresses. Home users and small businesses would use this solution most often.
• Any of the previous three options, plus associating an internal IP address with a TCP and/or UDP port. This is an extra layer of control and security.
• Dynamically assigned internal IP addresses mapped to external IP addresses. This is not common because the internal machine does not have an IP address until it is needed to access the Internet through the NAT gateway.

NAT is usually included with a router and/or firewall. Network administrators have to create the NAT table that controls the address mapping. NAT provides firewall type protection on the Internet because it only allows connections that originate on the internal network unless you use inbound mapping for certain services. An example of this would be mapping the pcAnywhere TCP/UDP ports inbound to a specific host waiting on the network.

pcAnywhere and NAT

PLEASE NOTE: The ability of pcAnywhere to get to a host through a NAT is totally dependent on the configuration of the NAT. pcAnywhere Technical Support cannot assist in configuring any NAT to allow pcAnywhere connections. You must contact the vendor of the NAT software for that information.

pcAnywhere should work with the first four methods of NAT. It does not work with the last method because the host machine cannot get an assigned IP address until it contacts the NAT server by sending an outbound IP packet.

If you intend to use address/port mapping with NAT, that mapping is done with NAT and not by changing the TCP/UDP ports that pcAnywhere uses.

Here are a few things to consider when using pcAnywhere with NAT:

• The NAT table must map to the address of the pcAnywhere host; for this reason the host address should be a static (internal) IP address unless you can dynamically update the NAT table and mappings.
• If you have multiple hosts on the internal network, you will probably have to assign different TCP/UDP ports to each host. The default ports for pcAnywhere are 5631 (TCP) and 5632 (UDP). For pcAnywhere 9.x and 8.0, see the document, How to change the pcAnywhere IP ports, for detailed information on changing these port numbers. For pcAnywhere 10.0, see the document How to change the IP ports that pcAnywhere 10 uses.
  
  NOTE: Any remote trying to connect to the hosts will have to use the same ports as those assigned to the host.
• pcAnywhere remotes will have to know the external IP address of the host's NAT server. If the NAT server connects to the Internet using Dial-up Networking, that address is dynamically assigned by an Internet Service Provider and will probably be different with each dial-up. Remotes connecting in will have to somehow be given that address each time.