What Happened to the “NAT” VMSwitch?

Published Mar 21 2019 04:59 PM 1,055 Views
Microsoft
First published on TECHNET on May 14, 2016
Author: Jason Messer

Beginning in Windows Server Technical Preview 3, our users noticed a new Hyper-V Virtual Switch Type – “NAT” – which was introduced to simplify the process of connecting Windows containers to the host using a private network. This allowed network traffic sent to the host to be redirected to individual containers running on the host through network and port address translation (NAT and PAT) rules. Additional users began to use this new VM Switch type not only for containers but also for ordinary VMs to connect them to a NAT network. While this may have simplified the process of creating a NAT network and connecting containers or VMs to a vSwitch, it resulted in confusion and a layering violation in the network stack.

Beginning in Windows Server Technical Preview 5 and with recent Windows Insider Builds, the “NAT” VM Switch Type has been removed to resolve this layering violation.

In the OSI (Open Systems Interconnect) model, both physical network switches and virtual switches operate at Layer-2 of the network stack without any knowledge of IP addresses or ports. These switches simply forward packets based on the Ethernet headers (i.e. MAC addresses) in the Layer-2 frame. NAT and PAT operate at Layers-3 and 4 respectively of the network stack.
Layer Function Example
Application (7) Network process HTTP, SMTP, DNS
Presentation (6) Data representation and encryption JPG, GIF, SSL, ASCII
Session (5) Interhost communication NetBIOS
Transport (4) End-to-End Connections TCP, UDP (Ports)
Network (3) Path determination and routing based on IP addresses Routers
Data Link (2) Forward frames based on MAC addresses 802.3 Ethernet, Switches
Physical (1) Send data through physical signaling Network cables, NIC cards



Creating a “NAT” VM Switch type actually combined several operations into one which can still be done today (detailed instructions can be found here ):

  • Create an “internal” VM Switch

  • Create a Private IP network for NAT

  • Assign the default gateway IP address of the private network to the internal VM switch Management Host vNIC


In Technical Preview 5 we have also introduced the Host Network Service (HNS) for containers which is a servicing layer used by both Docker and PowerShell management surfaces to creates the required network “plumbing” for new container networks. A user who wants to create a NAT container network through docker, will simply execute the following:
c:\> docker network create -d nat MyNatNetwork
and HNS will take care of the details such as creating the internal vSwitch and NAT.

Looking forward, we are considering how we can create a single arbitrator for all host networking (regardless of containers or VMs) so that these workflows and networking primitives will be consistent.

~ Jason
1 Comment
Occasional Visitor

Hi,

 

I am trying to run Docker Swarm in Hyper-V VM Windows Server 2019.  I have installed Docker EE and Enabled swarm.  When I deploy my stack to Swarm, my containers do not get outbound connectivity with the Overlay network that gets created.   I referred to this article https://docs.microsoft.com/en-us/virtualization/windowscontainers/container-networking/network-drive...  I couldn't understand what it means by the comment for Overlay external connectivity "Not directly supported - requires second container endpoint attached to NAT network on Windows Server 2016 or VFP NAT rule on Windows Server 2019."  Can you explain exactly the steps required to make overlay network work with outbound connectivity to internet.  

 

Thanks

%3CLINGO-SUB%20id%3D%22lingo-sub-382299%22%20slang%3D%22en-US%22%3EWhat%20Happened%20to%20the%20%E2%80%9CNAT%E2%80%9D%20VMSwitch%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-382299%22%20slang%3D%22en-US%22%3E%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%3CSTRONG%3EFirst%20published%20on%20TECHNET%20on%20May%2014%2C%202016%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%20%3CSTRONG%3E%20Author%3A%20Jason%20Messer%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Beginning%20in%20Windows%20Server%20Technical%20Preview%203%2C%20our%20users%20noticed%20a%20new%20Hyper-V%20Virtual%20Switch%20Type%20%E2%80%93%20%E2%80%9CNAT%E2%80%9D%20%E2%80%93%20which%20was%20introduced%20to%20simplify%20the%20process%20of%20connecting%20Windows%20containers%20to%20the%20host%20using%20a%20private%20network.%20This%20allowed%20network%20traffic%20sent%20to%20the%20host%20to%20be%20redirected%20to%20individual%20containers%20running%20on%20the%20host%20through%20network%20and%20port%20address%20translation%20(NAT%20and%20PAT)%20rules.%20Additional%20users%20began%20to%20use%20this%20new%20VM%20Switch%20type%20not%20only%20for%20containers%20but%20also%20for%20ordinary%20VMs%20to%20connect%20them%20to%20a%20NAT%20network.%20While%20this%20may%20have%20simplified%20the%20process%20of%20creating%20a%20NAT%20network%20and%20connecting%20containers%20or%20VMs%20to%20a%20vSwitch%2C%20it%20resulted%20in%20confusion%20and%20a%20layering%20violation%20in%20the%20network%20stack.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Beginning%20in%20Windows%20Server%20Technical%20Preview%205%20and%20with%20recent%20Windows%20Insider%20Builds%2C%20the%20%E2%80%9CNAT%E2%80%9D%20VM%20Switch%20Type%20has%20been%20removed%20to%20resolve%20this%20layering%20violation.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20In%20the%20OSI%20(Open%20Systems%20Interconnect)%20model%2C%20both%20physical%20network%20switches%20and%20virtual%20switches%20operate%20at%20Layer-2%20of%20the%20network%20stack%20without%20any%20knowledge%20of%20IP%20addresses%20or%20ports.%20These%20switches%20simply%20forward%20packets%20based%20on%20the%20Ethernet%20headers%20(i.e.%20MAC%20addresses)%20in%20the%20Layer-2%20frame.%20NAT%20and%20PAT%20operate%20at%20Layers-3%20and%204%20respectively%20of%20the%20network%20stack.%20%3CBR%20%2F%3E%3CTABLE%3E%0A%20%20%20%3CTBODY%3E%3CTR%3E%0A%20%20%20%20%3CTD%3E%3CSTRONG%3E%20Layer%20%3C%2FSTRONG%3E%3C%2FTD%3E%0A%20%20%20%20%3CTD%3E%3CSTRONG%3E%20Function%20%3C%2FSTRONG%3E%3C%2FTD%3E%0A%20%20%20%20%3CTD%3E%3CSTRONG%3E%20Example%20%3C%2FSTRONG%3E%3C%2FTD%3E%0A%20%20%20%3C%2FTR%3E%0A%20%20%20%3CTR%3E%0A%20%20%20%20%3CTD%3EApplication%20(7)%3C%2FTD%3E%0A%20%20%20%20%3CTD%3ENetwork%20process%3C%2FTD%3E%0A%20%20%20%20%3CTD%3EHTTP%2C%20SMTP%2C%20DNS%3C%2FTD%3E%0A%20%20%20%3C%2FTR%3E%0A%20%20%20%3CTR%3E%0A%20%20%20%20%3CTD%3EPresentation%20(6)%3C%2FTD%3E%0A%20%20%20%20%3CTD%3EData%20representation%20and%20encryption%3C%2FTD%3E%0A%20%20%20%20%3CTD%3EJPG%2C%20GIF%2C%20SSL%2C%20ASCII%3C%2FTD%3E%0A%20%20%20%3C%2FTR%3E%0A%20%20%20%3CTR%3E%0A%20%20%20%20%3CTD%3ESession%20(5)%3C%2FTD%3E%0A%20%20%20%20%3CTD%3EInterhost%20communication%3C%2FTD%3E%0A%20%20%20%20%3CTD%3ENetBIOS%3C%2FTD%3E%0A%20%20%20%3C%2FTR%3E%0A%20%20%20%3CTR%3E%0A%20%20%20%20%3CTD%3ETransport%20(4)%3C%2FTD%3E%0A%20%20%20%20%3CTD%3EEnd-to-End%20Connections%3C%2FTD%3E%0A%20%20%20%20%3CTD%3ETCP%2C%20UDP%20(Ports)%3C%2FTD%3E%0A%20%20%20%3C%2FTR%3E%0A%20%20%20%3CTR%3E%0A%20%20%20%20%3CTD%3ENetwork%20(3)%3C%2FTD%3E%0A%20%20%20%20%3CTD%3EPath%20determination%20and%20routing%20based%20on%20IP%20addresses%3C%2FTD%3E%0A%20%20%20%20%3CTD%3ERouters%3C%2FTD%3E%0A%20%20%20%3C%2FTR%3E%0A%20%20%20%3CTR%3E%0A%20%20%20%20%3CTD%3EData%20Link%20(2)%3C%2FTD%3E%0A%20%20%20%20%3CTD%3EForward%20frames%20based%20on%20MAC%20addresses%3C%2FTD%3E%0A%20%20%20%20%3CTD%3E802.3%20Ethernet%2C%20Switches%3C%2FTD%3E%0A%20%20%20%3C%2FTR%3E%0A%20%20%20%3CTR%3E%0A%20%20%20%20%3CTD%3EPhysical%20(1)%3C%2FTD%3E%0A%20%20%20%20%3CTD%3ESend%20data%20through%20physical%20signaling%3C%2FTD%3E%0A%20%20%20%20%3CTD%3ENetwork%20cables%2C%20NIC%20cards%3C%2FTD%3E%0A%20%20%20%3C%2FTR%3E%0A%20%20%3C%2FTBODY%3E%3C%2FTABLE%3E%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Creating%20a%20%E2%80%9CNAT%E2%80%9D%20VM%20Switch%20type%20actually%20combined%20several%20operations%20into%20one%20which%20can%20still%20be%20done%20today%20(detailed%20instructions%20can%20be%20found%20%3CA%20href%3D%22https%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Fvirtualization%2Fhyperv_on_windows%2Fuser_guide%2Fsetup_nat_network%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%20here%20%3C%2FA%3E%20%3A(%3C%2Fimg%3E%20%3CBR%20%2F%3E%3CUL%3E%3CBR%20%2F%3E%3CLI%3ECreate%20an%20%E2%80%9Cinternal%E2%80%9D%20VM%20Switch%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3ECreate%20a%20Private%20IP%20network%20for%20NAT%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3EAssign%20the%20default%20gateway%20IP%20address%20of%20the%20private%20network%20to%20the%20internal%20VM%20switch%20Management%20Host%20vNIC%3C%2FLI%3E%3CBR%20%2F%3E%3C%2FUL%3E%3CBR%20%2F%3E%20In%20Technical%20Preview%205%20we%20have%20also%20introduced%20the%20Host%20Network%20Service%20(HNS)%20for%20containers%20which%20is%20a%20servicing%20layer%20used%20by%20both%20Docker%20and%20PowerShell%20management%20surfaces%20to%20creates%20the%20required%20network%20%E2%80%9Cplumbing%E2%80%9D%20for%20new%20container%20networks.%20A%20user%20who%20wants%20to%20create%20a%20NAT%20container%20network%20through%20docker%2C%20will%20simply%20execute%20the%20following%3A%20%3CBR%20%2F%3E%20c%3A%5C%26gt%3B%20docker%20network%20create%20-d%20nat%20MyNatNetwork%20%3CBR%20%2F%3E%20and%20HNS%20will%20take%20care%20of%20the%20details%20such%20as%20creating%20the%20internal%20vSwitch%20and%20NAT.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Looking%20forward%2C%20we%20are%20considering%20how%20we%20can%20create%20a%20single%20arbitrator%20for%20all%20host%20networking%20(regardless%20of%20containers%20or%20VMs)%20so%20that%20these%20workflows%20and%20networking%20primitives%20will%20be%20consistent.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20~%20Jason%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-382299%22%20slang%3D%22en-US%22%3EFirst%20published%20on%20TECHNET%20on%20May%2014%2C%202016%20Author%3A%20Jason%20MesserBeginning%20in%20Windows%20Server%20Technical%20Preview%203%2C%20our%20users%20noticed%20a%20new%20Hyper-V%20Virtual%20Switch%20Type%20%E2%80%93%20%E2%80%9CNAT%E2%80%9D%20%E2%80%93%20which%20was%20introduced%20to%20simplify%20the%20process%20of%20connecting%20Windows%20containers%20to%20the%20host%20using%20a%20private%20network.%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-382299%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Ehyper%20v%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ENAT%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ENetworking%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2364821%22%20slang%3D%22en-US%22%3ERe%3A%20What%20Happened%20to%20the%20%26amp%3B%238220%3BNAT%26amp%3B%238221%3B%20VMSwitch%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2364821%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20trying%20to%20run%20Docker%20Swarm%20in%20Hyper-V%20VM%20Windows%20Server%202019.%26nbsp%3B%20I%20have%20installed%20Docker%20EE%20and%20Enabled%20swarm.%26nbsp%3B%20When%20I%20deploy%20my%20stack%20to%20Swarm%2C%20my%20containers%20do%20not%20get%20outbound%20connectivity%20with%20the%20Overlay%20network%20that%20gets%20created.%26nbsp%3B%20%26nbsp%3BI%20referred%20to%20this%20article%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fvirtualization%2Fwindowscontainers%2Fcontainer-networking%2Fnetwork-drivers-topologies%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fvirtualization%2Fwindowscontainers%2Fcontainer-networking%2Fnetwork-drivers-topologies%3C%2FA%3E%26nbsp%3B%20I%20couldn't%20understand%20what%20it%20means%20by%20the%20comment%20for%20Overlay%20external%20connectivity%20%22%3CSPAN%3ENot%20directly%20supported%20-%20requires%20second%20container%20endpoint%20attached%20to%20NAT%20network%20on%20Windows%20Server%202016%20or%20VFP%20NAT%20rule%20on%20Windows%20Server%202019.%22%26nbsp%3B%20Can%20you%20explain%20exactly%20the%20steps%20required%20to%20make%20overlay%20network%20work%20with%20outbound%20connectivity%20to%20internet.%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThanks%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Version history
Last update:
‎Mar 21 2019 04:59 PM
Updated by: