5

suppose having a LAN which contains :

  • FTP server (10.0.0.1)
  • HTTP server (10.0.0.2)
  • SSH server (10.0.0.3)

the LAN use NAT overloading and it has a single public IP (1.2.3.4), now if I ping on 1.2.3.4 which server will reply ?

5

Neither.

"Overload", or Dynamic PAT, is unidirectional. The connection will only work if the Inside hosts initiate the connection.

If you ping from the Internal hosts, an entry in the connection table will allow the response back through.

If you ping from an external host, there will be no entry in the connection table, and no way for the NAT device to know what internal host was the intended recipient... so the result: the packet is dropped.

| improve this answer | |
  • do you mean that the server should have his own public ip so we could ping on it ? or in other words; all web servers in which we can ping are not using PAT ? – Reda LM Sep 1 '17 at 22:29
  • 2
    From a learning perspective, correct. In reality, however, most web-servers you are making requests to are sitting behind a Load Balancer that is doing the "Dynamic PAT" (among other things) so that many internal web servers can share a single public IP address. Often, in those cases, the Load Balancer itself is "smart enough" to simply respond to ping requests as opposed to trying to forward it to a server. – Eddie Sep 2 '17 at 0:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.