2

These are my first questions asked into this forum so could you please help me? These were asked during a job interview:

  1. How does the ping work when we launch an ICMP echo request message from an internal LAN private IPv4 source address towards a public IPv4 destination address (example 8.8.8.8 - Google server) without enabling the NAT/PAT protocol on our default/internal gateway router?

  2. If the ping is unsuccessful (receiving the requested timed out/time exceeded) ICMP error type, which next-hop node will prevent forwarding the traffic (ICMP control) packets towards the Internet?

  3. Which methods we should use in order to obtain a successful echo reply ping?

I have thought of a possible answer, which I will share with you after the response in order to see if it's valid or not.

Improve this question
2
  • 4
    Network Engineering does not answer homework questions.
    – HAL
    Feb 29, 2016 at 13:59
  • 2
    This question comes across sounding suspiciously like a homework question, which is off topic here. If it is not school work, please edit your question to provide more context about why you are asking and it will automatically start a reopen vote. You may find our Question Checklist helpful to improve your question.
    – YLearn
    Feb 29, 2016 at 14:19

3 Answers 3

Reset to default
1

Private IPv4 addresses are defined by RFC1918, in which you will find:

Because private addresses have no global meaning, routing information about private networks shall not be propagated on inter-enterprise links, and packets with private source or destination addresses should not be forwarded across such links. Routers in networks not using private address space, especially those of Internet service providers, are expected to be configured to reject (filter out) routing information about private networks. If such a router receives such information the rejection shall not be treated as a routing protocol error.

Without NAT/PAT, the ICMP packet will be dropped by your ISP router. Most of the time, it will be silently drop, but you may have some ICMP message back, depending of the configuration your ISP made.

To have a successful ping reply from an Internet host to a echo request originated by a private IP address there's no other option than NAT/PAT.

Improve this answer
0
0

How does the ping work when we launch an ICMP echo request message from an internal LAN private IPv4 source address towards a public IPv4 destination address (example 8.8.8.8 - Google server) without enabling the NAT/PAT protocol on our default/internal gateway router?

Assuming it's a server on the public internet the ping will almost certinaly be unsuccessful. If it's a server on your own network with a public IP you may well be able to ping it successfully depending on internal routing configuration.

If the ping is unsuccessful (receiving the requested timed out/time exceeded) ICMP error type, which next-hop node will prevent forwarding the traffic (ICMP control) packets towards the Internet?

Theres various possibilities here depending on the configuration of different devices.

Most likely your ISP will simply block the packet based on either reverse path filtering or an explicit block on private IP addresses. If they don't block it then likely someone else along the route will.

If the packet does reach the destination server(because noone is performing filtering best practices) then a reply will be generated but that reply will not find it's way back to your network. It will either be dropped due to lack of a route or routed to somewhere in the destination network that happens to use the same private addresses you used.

Which methods we should use in order to obtain a successful echo reply ping?

Either enable some form of NAT or use legitimately aquired public IPs on your internal LAN and arrange for your ISP to route them to your gateway.

Improve this answer
-2

This is my formal answer.

If the packet leaves my internal network, the next hop which will block forwarding it into the Internet will be the firewall from the private LAN of the internet service provider or an edge router with an config/installed an ACL rule which prevents forwarding traffic originating with a private ip source address into the Internet ? Another possibility to receive an echo reply is using a proxy server instead of a NAT configured gateway (accepting the echo request/reply messages) or installing a secure private IPSec VPN tunnel towards the public destination address which we want our traffic to reach (of course the vpn tunnel solution must be authorized and configured on both peers/terminal nodes).

Improve this answer
3
  • 1
    yes actually proxy is a different solution. Concerning a VPN tunnel, then the destination is no more a "public destination address" (Virtual PRIVATE Network).
    – JFL
    Feb 29, 2016 at 14:20
  • ISP routers typically employ bogon lists in which private addresses, among others, are listed. For a private address to connect to a public address on the Internet, you must translate (NAT) the private address. Your gateway or proxy can do that. A VPN doesn't translate the private address. Somehow the private address must be translated to an address which can be routed on the public Internet in order to reach a public address such as Google.
    – Ron Maupin ♦
    Feb 29, 2016 at 23:07
  • thank you sir also for the info, i have been pointed on the right direction.
    – Costin Giumba
    Mar 1, 2016 at 10:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.