Windows 2000 Server RRAS NAT Configuration

This article provides an overview of how Microsoft Windows 2000 Server implements Network Address Translation (NAT) via the Routing and Remote Access Service (RRAS). It details the architectural role of RRAS, the mechanics of mapping private IP addresses to a public interface, and the supplementary services—such as the DHCP Allocator and DNS Proxy—that enable seamless Internet connectivity for private local area networks.

The Role of RRAS in Windows 2000 Server

In Windows 2000 Server, Routing and Remote Access Service (RRAS) is fully integrated into the operating system as a native multiprotocol routing engine. Unlike simple proxy servers that operate at the application layer, RRAS operates at the network layer (Layer 3) of the OSI model. When configured as a NAT router, RRAS allows an entire private network to share a single public IP address (or a pool of public IP addresses) to access external networks like the Internet.

How RRAS Translates Traffic

NAT in Windows 2000 Server functions by rewriting the source and destination headers of IP packets crossing the network boundary:

  1. Outbound Traffic: When an internal host (using private addressing defined by RFC 1918) sends an outbound packet to an Internet host, the packet reaches the Windows 2000 Server via its private network adapter. The RRAS NAT routing protocol replaces the private source IP address and source port with the server's public IP address and a dynamically assigned port number.
  2. State Table Tracking: The NAT protocol records this mapping in an internal translation table, keeping track of the private IP, original port, translated public IP, translated port, and the destination address.
  3. Inbound Traffic: When the external host responds, the incoming packet targets the server's public IP address and the assigned port. RRAS looks up the active session in its translation table, restores the original private IP address and port number as the destination, and forwards the packet onto the internal LAN.

Public and Private Interface Roles

To manage NAT, RRAS requires at least two network interfaces:

  • Private Interface: Connected to the local subnet. NAT receives inbound requests on this interface without modifying the source address at this stage.
  • Public Interface: Connected to the external network or Internet (such as a WAN link, DSL connection, or public Ethernet adapter). The NAT protocol must be explicitly enabled on this interface. RRAS handles address translation and port translation exclusively as packets transit this interface.

Integrated Address and Name Resolution

Windows 2000 Server RRAS simplifies small-to-medium network setups by bundling two lightweight helper services directly inside the NAT routing protocol:

  • DHCP Allocator: A simplified DHCP service designed for networks that do not run an Active Directory-integrated or enterprise DHCP server. It leases IP addresses, subnet masks, and default gateway configurations to internal clients on the NAT private interface (typically assigning addresses in the 192.168.0.0/24 range).
  • DNS Proxy: When internal clients submit DNS queries to the Windows 2000 NAT server, the DNS proxy intercepts these requests and forwards them to the external DNS servers configured on the server's public interface. Once resolved, the NAT server returns the result to the client.

Inbound Access and Special Ports

While NAT primarily protects internal devices by hiding their addresses, Windows 2000 Server RRAS supports inbound traffic routing through Special Ports (static port mappings). Administrators can configure RRAS to direct traffic arriving on a specific public TCP or UDP port directly to a designated private IP address on the internal network. This capability allows internal devices to host services such as HTTP (port 80) or FTP (port 21) while remaining behind the NAT firewall.

NAT Editors

Standard NAT fails on protocols that embed IP addresses or port numbers inside the application payload rather than just the packet header. Windows 2000 Server addresses this limitation by including built-in NAT editors. These editors inspect and modify payload data for complex protocols, including File Transfer Protocol (FTP), Internet Control Message Protocol (ICMP), Point-to-Point Tunneling Protocol (PPTP), and H.323 for multimedia streaming.