3

Our telephone company has recently set us up a new ADSL connection. It consists of a PPP link over ATM.

The connection comes with a public /30 subnet that we can use to our liking. We used one of the IP addresses for standard NAT, and one of the addresses for remote router access (ports 22 and 443) and port forwarding to a server (ports 4000-5000).

It also uses a public /30 subnet for the PPP link, one IP for each endpoint.

I don't understand why:

  • A /30 subnet is used for the two public IP addresses. Couldn't they just route our two IP addresses over our PPP link as isolated addresses that don't belong to any subnet? If my understanding is correct, this would allow them to effectively double the amount the number of "address couples" they can sell.
  • A public subnet is used for the PPP link. Why is this the case? Since these IP addresses aren't publicly routed anyway, but only used by the two routers for the PPP link, isn't this a waste of the public address space?
Improve this question
5
  • You did not use one IP address for NAT and another for remote router access as you have only 1 usable IP address. Please correct your facts.
    – Ronnie Royston
    Sep 23, 2016 at 1:24
  • 2
    What do you not understand exactly? There are two subnets, one for the PPP (not publicly routed, one IP for the remote ISP router, one IP for my location's router) and one publicly router subnet at my disposal (one IP for the NAT, one IP for router management and port forwarding). Could you stop downvoting everything for you own personal lack of understanding? That's just immature.
    – rrrrrrrrrrrrrrrr
    Sep 23, 2016 at 5:47
  • Riccardo, now you got me confused as well: the question says A public subnet is used for the PPP link but your comment says one [subnet] for the PPP (not publicly routed) ? Maybe it would help a lot if you could add a visual network diagram.
    – hertitu
    Sep 23, 2016 at 8:27
  • I'm in Paris from the weekend, I'll do that as soon as I'm home. Anyway, what I mean is that the PPP subnet uses addresses from a public range, but they are not publicly routed (i.e. you can't ping one of those addresses from the Internet, they are just in use for the PPP link subnet).
    – rrrrrrrrrrrrrrrr
    Sep 23, 2016 at 10:14
  • @RiccardoBestetti Your question is no good as it is and deserves to be downvoted. Don't take it personally. You can edit the question and, ... who knows how many upvotes it could get.
    – Ronnie Royston
    Sep 23, 2016 at 14:56

2 Answers 2

Reset to default
2

A /30 subnet is used for the two public IP addresses. Couldn't they just route our two IP addresses over our PPP link as isolated addresses that don't belong to any subnet? If my understanding is correct, this would allow them to effectively amount the number of "address couples" they can sell.

Well the way I see it is that they route 4 public IP addresses to you, and you decide whether to use them as one /30 subnet or as two /31 subnets or as 4 individual (/32) IP addresses - or even a combination of one /31 and two /32.

In other words if your ISP says they're routing the 10.0.0.0/30 subnet to you then they actually mean that they're routing the ip address range 10.0.0.0-10.0.0.3 to you.

Edit: adding an example to (hopefully) clarify further for those that do not understand. Assume this scenario:

ISProuter (a.b.c.1) ----- (a.b.c.2) MyRouter

ISProuter has a route for x.y.z.4/30 with next-hop a.b.c.2

Then on MyRouter I have roughly 4 options:

  1. I configure x.y.z.5 on one of my interfaces, with a /30 subnet mask. In that case I can only use x.y.z.6 on another device (since .4 and .7 are the network and broadcast addresses in this scenario)
  2. I configure 4 loopback interfaces with x.y.z.4, x.y.z.5, x.y.z.6 and x.y.z.7, each with a /32 subnet mask
  3. I use x.y.z.4/31 and x.y.z.6/31 on 2 point-to-point links.
  4. I route x.y.z.4/30 to another router, and on that router I have again the same 4 options.

Note: there are also combinations possible, e.g. I could use x.y.z.4/32 on a loopback, route x.y.x.5/32 to another router, and use x.y.z.6/31 on a p2p link. And depending on the features available on MyRouter (which could also be a load balancer, or a firewall, or...) the addresses could also be used without actually configuring them on an interface, but the result would be very similar to using them as /32's on a loopback.

A public subnet is used for the PPP link. Why is this the case? Since these IP addresses aren't publicly routed anyway, but only used by the two routers for the PPP link, isn't this a waste of the public address space?

You would need to ask the ISP, we can only guess. I guess most ISPs consider it best practice to use public IP addresses for public links. Private IP address might break stuff like PMTUD as ICMP from the 2 PPP endpoints would probably get dropped in a lot of places. But as @RonMaupin mentioned, they could have used a public /31 instead to save some address space.

Improve this answer
12
  • That makes sense, I hadn't thought of it that way before. I guess that's because the ISP is managing my router, and they just set it up to route the IPs as a /30 subnet, and they set up NAT to the local network on the second IP and router management and the 4000-5000 port forwarding on the third. Out of curiosity, how should I ask them to configure the router if I wanted, for example, to be able to route the four single IPs myself with a firewall setup such as pfSense? (i.e., configure the router in such a way that the pfSense machine would "have" those four IPs on its network interface)
    – rrrrrrrrrrrrrrrr
    Sep 22, 2016 at 21:02
  • Ok I partly misunderstood the setup then, I thought you were in control of the router. It depends on how they have configured it exactly. If they just have used 2 addresses for NAT, they should be able to create two /32 routes to your firewall for the 2 unused addresses. If you want them to remove the config using the 2 addresses then they can just route the /30 to your firewall (and it's up to you whether to treat it as a /30 or as 4 individual addresses), however then the last leg of the public path (outside the firewall) will be using private addressing (which would work,but see question2).
    – hertitu
    Sep 22, 2016 at 21:39
  • So - if I'm understanding correctly - the ISP's router and my firewall should be in a privately routed subnet (possibly with public addresses, like they do it for the PPP link), with e.g. addresses 10.0.0.1/30 and 10.0.0.2/30, and the router would need to be configured to statically route my publicly routed /30 to 10.0.0.2/30, and my firewall should be configured to NAT inbound from my publicly routed /30 (possibly using it as four indipendent /32s) to whatever local addresses/ranges I need, and to NAT outbound using 10.0.0.1/30 as the gateway, right?
    – rrrrrrrrrrrrrrrr
    Sep 22, 2016 at 21:57
  • @hertitu your statement "they route 4 public IP addresses to you, and you decide whether to use them as one /30 subnet or as two /31 subnets or as 4 individual IP addresses." is wrong. The broadcast address and the network address in a /30 mean you have 2 usable IP's.
    – Ronnie Royston
    Sep 23, 2016 at 1:16
  • 1
    That's not true, that's exactly what hertitu was trying to explain. The subnet is routed entirely to my router, without any concept of network address or broadcast address. Now, let's say this subnet is 20.20.20.0/30. If I physically route that subnet to a network of four interfaces assigning 20.20.20.0/30, .1/30, .2/30 and .3/30, the first and the last will not make sense and the middle two interfaces will receive packets for .3/30. But if you assign the four addresses as /32s to the interfaces, there will be no network and broadcast addresses at all and everything will work fine.
    – rrrrrrrrrrrrrrrr
    Sep 23, 2016 at 5:36
-4

The public IP addresses issued by the ISP's enable customer to have Internet routing, for example Skype or gaming - types of communication where endpoints need to communicate directly with one another.

The /30 preserves public IP addresses.

Improve this answer
14
  • 1
    Actually, /30 wastes half the public addresses compared to using /31, which has been around since the year 2000 in RFC 3021 for point-to-point links.
    – Ron Maupin ♦
    Sep 22, 2016 at 19:57
  • If think you are confusing "public IP address" with "publicly routed IP address". IP addresses for the PPP link don't enable customers to do anything. They are a technicality that allow PPP to be used as a tunnel between two routers. This is why I'm wondering why they are using public IP addresses instead of private ones. Publicly routed IP addresses, instead, enable customers to have Internet routing, which by the way it isn't at all required by Skype or gaming, a NAT setup is enough for that. What I don't understand is why my ISP implements this service in a way that seems wasteful to me.
    – rrrrrrrrrrrrrrrr
    Sep 22, 2016 at 20:35
  • ISP is not doing your NAT for you, they provide you a public IP address. You can NAT it, or if you want several devices to have Internet access in your home, you can PAT it. PPP provides a mechanism for security purposes.
    – Ronnie Royston
    Sep 22, 2016 at 21:21
  • Why is my answer wrong / downvoted? I am eager to learn! What's wrong with the answer?
    – Ronnie Royston
    Sep 23, 2016 at 1:04
  • @RiccardoBestetti your comment that "Internet routing, which by the way it isn't at all required by Skype or gaming," is wrong. Also, "IP addresses for the PPP link don't enable customers to do anything." is wrong. Also, "They are a technicality that allow PPP to be used as a tunnel between two routers." is wrong. Pretty much everything you have said is wrong and I answered your question.
    – Ronnie Royston
    Sep 23, 2016 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.