2

Should there be a difference in latency when accessing resources by their public IP address versus their private, internal IP address? And if there is, would (mis)configuration be to blame?

My understanding (probably over-simplified) is the router will be smart enough to know that packets don't need to go out and back in when calling the public IP address and therefore there shouldn't be any performance hit.

Is that accurate?

Context: accessing a web server that is hosted on the internal LAN with a private address, but is accessible through the firewall via a public IP address on the WAN.

Improve this question
7
  • Define "internal IP addresses." There is nothing preventing internal IP addresses to be public Internet addresses. Certainly, using a firewall would be the intelligent thing to do in such a case, and the traffic from internal hosts to internal resource would not need to hit the firewall, while external hosts would need to pass through the firewall.
    – Ron Maupin ♦
    Aug 14, 2015 at 0:17
  • Added a bit of context that will hopefully clarify.
    – willWorkForCookies
    Aug 14, 2015 at 0:22
  • No. My point is that the public IP address and the internal IP address could be the same thing. In that case, properly configured routing would route directly from one host to another on the internal network. Using private addresses, on the other hand, would prove more problematic. So, again, define "internal IP addresses."
    – Ron Maupin ♦
    Aug 14, 2015 at 0:26
  • private, non-routable
    – willWorkForCookies
    Aug 14, 2015 at 0:34
  • Under normal circumstances, routing to public addresses from a private address would not work. If you have a single public address, this can be difficult. A one-to one public-to private addressing scheme would be much easier, but why would you use private addresses in such a case?
    – Ron Maupin ♦
    Aug 14, 2015 at 0:40

2 Answers 2

Reset to default
4

Technically yes there will be a small difference and notability will depend on your devices/configuration. This is because of the different paths the packets have to take, but like i said, depends on how your setup is designed - there are plenty of variables.

1) If you are on the LAN then your path to the webserver via its private IP is merely just switched.

2) If you are on the LAN and you try and access the webserver via its public IP then the traffic has to go out through your LAN gateway (which I am assuming is your router with a public ip address on the other side) , get natted out, get natted inbound and forwarded to the private IP address of the server and then return the traffic.

So you can see there will be marginally more resources used than #1

Improve this answer
6
  • The traffic to a public IP address would go out and get a NAT address. It doesn't necessarily come back. As you said, there are lots of variables in this.
    – Ron Maupin ♦
    Aug 14, 2015 at 0:55
  • yeah of course, all depending on if the router does hairpinning i guess. My assumption is that connectivity back in is possible for the scenario to be in question in the first place, otherwise latency is irrelevant.
    – OJS
    Aug 14, 2015 at 1:00
  • I'm still not sure why anyone with enough public addresses to do one-to-one NAT would go to all the trouble to actually NAT. All pain, no gain...
    – Ron Maupin ♦
    Aug 14, 2015 at 1:14
  • agreed, I guess it's a legacy concept really.
    – OJS
    Aug 14, 2015 at 1:31
  • Any references to new best practices?
    – willWorkForCookies
    Aug 14, 2015 at 11:22
0

It all depends on the setup.

Assuming a simple setup with a single router/firewall and a number of Ethernet switches on a flat ethernet network traffic to the private IP will go directly while traffic to the public IP will have to harpin through the router/firewall. That will add latency to the path, how much depends on how highly loaded the router/firewall is, how highly loaded the network in general is, how fast it can process packets, where the router sits on the network relative to the client and server and so-on.

In a more complex network you would have to look at the overall toplogy of the network to determine what impact using the public IP would have on the path and whether the path going through the translation would be longer.

Asside from performance two other issues to bear in mind.

  1. It is likely that the client IP address seen by the server will be an IP address of a NAT box rather than the internal IP of the client.
  2. some NAT setups may not support connections to the public IP from internal clients at all.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.