Deterministic network address and port translation

A network device comprising:

• a plurality of interfaces configured to send and receive packets for subscribers of a service provider network;
• a control unit that provides a user interface for configuring at least one network address (NAT) rule;
• a NAT controller that, upon receiving a packet for a new subscriber session, deterministically computes a public network address and a range of ports assigned to a private network address of a subscriber based on the NAT rule and selects an unused port from the range of ports, wherein the NAT controller deterministically computes the public network address and the range of port for the private network address by computing an offset within a private address space for the NAT rule as a function of the private source network address, computing an offset within a public address space for the NAT rule as a function of the offset within the private address space, and computing the public network address as a function of the offset within public network address, and wherein the NAT controller computes a port block offset as a function of both the offset within the private address space and a number of public network addresses within the public address space, and computes the range of ports for the subscriber as a function of the port block offset and a port block size for the NAT rule;
• and
• a forwarding component to output a translated packet that includes the computed public network address and the selected unused port in place of the private source address and a source port of the packet.

A network router comprising:

• a plurality of interfaces configured to send and receive packets for subscribers of a service provider network;
• a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network, wherein the control unit provides a user interface for configuring at least one network address (NAT) rule;
• a forwarding component configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding component comprising a switch fabric to forward the packets to the interfaces based on the selected next hops;
• and
• a NAT controller of the network router, the NAT controller, upon receiving a packet for a new subscriber session, deterministically computing a public network address and a range of ports assigned to a private network address of a subscriber based on the NAT rule,
• wherein the NAT controller deterministically computes the public network address and the range of port for the private network address by computing an offset within a private address space for the NAT rule as a function of the private source network address, computing an offset within a public address space for the NAT rule as a function of the offset within the private address space, and computing the public network address as a function of the offset within public network address,
• wherein the NAT controller computes a port block offset as a function of both the offset within the private address space and a number of public network addresses within the public address space, and computes the range of ports for the subscriber as a function of the port block offset and a port block size for the NAT rule,
• wherein the NAT controller dynamically selects an unused port from the range of ports and programs the forwarding component with the computed public network address and the unused port selected for the subscriber session;
• and
• wherein the forwarding component outputs a translated packet that includes the computed public network address and the selected unused port in place of the private source address and a source port of the packet.