How can multiple devices share an IP across the internet?

Question

I do realize that most LANs sit behind a device running NAT, which translates the users private IP address to a public IP address. My question is still if you are trying to connect to a private device, how does the internet know which private IP you are connecting to, since many LANs have the possibility of using that IP address? Is it that you can only connect using the public IP address?

Answer 1

In order for some device on the internet to connect inbound to a device on your private network you must use a NAT configuration. On residential equipment like a cable modem/router this is often referred to as port-forwarding. Think of it this way. If you are using a single public IP address and sharing it between several private addresses, you must tell the cable modem/router that if I receive a connection on the public IP address on TCP port 80, then that should go to the private address of x.x.x.x on port 80 (or any port you want really). This gives the modem/router enough information to successfully deliver the packets to the internal device from a device out on the internet.

Answer 2

Is it that you can only connect using the public IP?

Basically, yes. Every IP address connected to the public Internet should be unique*. One of the premises of IP is that every device has a unique IP address and end-to-end connectivity. NAT breaks that in order to try to stretch IPv4 until IPv6 is ubiquitous, which will restore unique addressing and end-to-end connectivity.

---

*There are also reasons to share public addresses. Anycast uses this to provide more localized services by having multiple devices with the same address in different locations. IP routing will direct packets to the nearest (according to the network protocol) device.

Answer 3

When considering internet traffic from private LAN prospective . It is outbound traffic (inside to outside) .

NAT overload or port address translation is configured for translating many private IP address to ISP provided public IP address

Assuming LAN subnet is 10 213.0.0/21

Router(config)#access-list 101 permit IP 10.231.0.0 255 .255.248.0 0 Any

Router(config)# IP NAT inside souce list 101 overload F0/1 interfàce

F0/1 is egress interface where ISP link is connected .

When users from LAN is accessing google . Private ip address of PCs is souce translation happens to allocated public ip address . Randomly generated source port is generated in saved in NAT table . This source port is used for return traffic to destine to correct source PCs verifying NAT table souce port .

Answer 4

Neither of the other answers are correct. To launch a connection from an external PC, you must have the public IP address. An IP address looks like this 111.222.333.444 nothing else exists, and if you did a DNS lookup, this is all that you get given.

However, it is possible for a local device to run multiple programs, each of which can be attached to a port number - so for a webserver, the program ALWAYS runs on port 80, which is shown by adding :80 after the IP address.

So the clever bit is to use your router to understand ports - so John's PC could have a private IP address (eg 10.0.0.1), which can be reused at every house or office. The router changes this by altering it to the public IP address and adding a random number to the end as a port eg 10.0.0.1 = 123.0.0.456:99999 It send the info out. When the reply comes back, the port # is still attached, router knows where to send the IP packet which was the reply. This is what NAT does.

Here the software automatically allocates the Port #. It doesn't work in reverse though because the router (using NAT) has to allocate the port number. If a external human entered the IP address plus gave a random port number, the router wouldn't know what to do with the incoming packet.

What we can do though is to pre-program the router (ie a human does this) to know that these two addresses match-up. Once done, it spots the trailing Port# on the packet, knows which internal (private) IP address to send the external incoming packet to; this is called Port Forwarding.

A simple use is for a webserver - the public content appears on port 80, the management backend on port 8080. Both programs are running on the same computer. The administrator simply adds :8080 when connecting to the admin panel