System and method for IP network address translation using selective masquerade

An address management method, comprising the steps of:

• associating a plurality of subsets of private addresses with two or more public names, each said subset including two or more private addresses;
• specifying a plurality of masquerade rules for hiding said subsets of addresses behind said public names associated with a single gateway system;
• and
• processing at said gateway system datagrams with respect to said masquerade rules.

An address management method, comprising the steps of:

• processing ADDRESS statements and HIDE rule statements to generate a file of masquerade rules;
• said ADDRESS statements including an address name and one or more associated addresses and said HIDE statements including a left hand side (lhs) address-entry and a right hand side (rhs) address-entry;
• said rhs address-entry being a public address name and said lhs address entry being a set of private addresses;
• and
• responsive to said masquerade rules, performing network address translation for each IP datagram;
• said processing step comprising the steps of:
• for each ADDRESS statement, creating a new address-entry with said public address name and said associated private addresses in a rules file;
• and
• for each HIDE statement, creating a hide-entry including said rhs address-entry and said lhs address-entry in a symbol file;
• each said datagram including a source address, a source port, a destination address and a destination port;
• with respect to outbound datgrams, said performing step comprising the steps of:
• selectively creating a conversation or finding a conversation, said conversation including a source address, a source port and an associated rhs address-entry and rhs port;
• said finding step including matching the source address and source port of said datagram with the source address and source port of said conversation;
• said creating step including locating a hide-entry with a source address matching the source address of said datagram;
• and translating said datagram source address to said rhs address-entry and entering to said rhs port a port selected from a pool of available ports;
• with respect to inbound datagrams, said processing step comprising the steps of:
• finding a matching conversation based upon the datagram destination address and datagram destination port;
• and
• translating said datagram destination address and datagram destination port;
• and
• sending said datagram.

An address management system, comprising:

• a rule compiler for processing ADDRESS statements and HIDE rule statements to generate a file of masquerade rules;
• said ADDRESS statements including an address name and one or more associated addresses and said HIDE statements including a left hand side (lhs) address-entry and a right hand side (rha) address-entry;
• said rhs address-entry being a public address name and said lhs address entry being a set of private addresses;
• and
• a network address translation (NAT) interpreter operable responsive to said masquerade rules for performing network address translation for each IP datagram;
• said rule compiler:
• for each ADDRESS statement, creating a new address-entry with said public address name and said associated private addresses in a rules file;
• and
• for each HIDE statement, creating a hide-entry including said rhs address-entry and said lhs address-entry in a symbol file;
• each said datagram including a source address, a source port, a destination address and a destination port;
• with respect to outbound datagrams, said NAT interpreter:
• selectively creating a conversation or finding a conversation, said conversation including a source address, a source port and an associated rhs address-entry and rhs port;
• for finding, said NAT interpreter matching the source address and source port of said datagram with the source address and source port of said conversation;
• for creating, said NAT interpreter locating a hide-entry with a source address matching the source address of said datagram;
• and translating said datagram source address to said rhs address-entry and entering to said rhs port a port selected from a pool of available ports;
• with respect to inbound datagrams, said NAT interpreter:
• finding a matching conversation based upon the datagram destination address and datagram destination port;
• and
• translating said datagram destination address and datagram destination port;
• and
• means for sending said datagram.

An article of manufacture comprising:

• a computer useable medium having computer readable program code means embodied therein for managing addresses, the computer readable program means in said article of manufacture comprising:
• computer readable program code means for causing a computer to effect processing ADDRESS statements and HIDE rule statements to generate a file of masquerade rules for associating subsets including two or more entries of internal addresses among a plurality of public addresses on a single physical interface;
• and
• computer readable program code means for causing a computer to effect responsive to said masquerade rules, performing network address translation for incoming and outgoing IP datagrams.

An address management method, comprising the steps of:

• processing ADDRESS statements and HIDE rule statements to generate a file of masquerade rules for associating subsets of internal addresses among a plurality of public addresses, each said subset including two or more public address entries;
• responsive to said masquerade rules, performing network address translation for incoming and outgoing IP datagrams;
• said ADDRESS statements including a public address name and one or more associated private addresses and said HIDE statements including a left hand side (lhs) address-entry and a right hand side (rhs) address-entry, said processing step further including:
• for each ADDRESS statement, creating a new address-entry with said public address name and said associated private addresses in a rules file;
• and
• for each HIDE statement, creating a hide-entry including said rhs address-entry and said lhs address-entry in a symbol file, said rhs address-entry being a public address name and said lhs address entry being a set of private addresses.