4

NAT typically refers to router translating an IP address from a private network to a public IP address so that the node on the private network can access public Internet.

Is there a valid scenario where a router* is used to translate an address from a public IP address to another public IP address?

*note: I am talking about router only, not a proxy.

Improve this question
1
  • Are you limiting only to IPv4? I've used NAT to implement internal IPv6-only networks with translation to external IPv4.
    – chrylis -cautiouslyoptimistic-
    Oct 1, 2017 at 5:22

4 Answers 4

Reset to default
5

One scenario that fits your description of "translate an address from a public IP address to another public IP address" happens every time I access StackExchange.

Even though every computer on my network has public IP addresses I cannot access StackExchange directly because StackExchange only supports IPv4. So this answer is being sent through a NAT64 which translates public IPv6 addresses into public IPv4 addresses.

Cases of translating between different public IP addresses within the same protocol also happens. I have come across a company which had a /8 of IPv4 space and assigned addresses from that range to internal hosts. But they still used a NAT to translate the addresses such that externally traffic would be seen originate from an IPv4 address outside of that /8.

I don't know why that company chose to use a NAT when they in fact had enough IPv4 addresses to not need it. I think every such deployment could work better without the NAT, but I can't say that with absolute certainty since I obviously don't have intimate knowledge of what happens behind every NAT in the world.

Improve this answer
5
  • 3
    At my company, for some reason we treat 11.x.x.x as private space, even though it isn't ours. Of course, traffic to the wider Internet from that space go through NAT like from any other private address. So that's another public-to-public translation. (I hope we don't need to use any servers in that range!)
    – user253751
    Oct 1, 2017 at 5:08
  • Ah, continuing the great tradition of borrowing US DoD's address space... It's bad, but luckily that address range is not reachable from the public Internet (and probably will never be). It can confuse Windows systems if 6to4 wasn' disabled, though.
    – user1686
    Oct 1, 2017 at 11:02
  • @grawity I can imagine there also exist systems which will try to use RFC 6598 addresses with 6to4. Since 6to4 is older than RFC 6598 you can't expect implementations to know it won't work. The same problem could happen with any setup using public IP addresses behind a NAT, even if you are using addresses that have actually been assigned to you rather than squatting on somebody else's.
    – kasperd
    Oct 1, 2017 at 11:15
  • That's protocol translation. No amount of replacing addresses can make a v6 packet into a v4 packet, or v.v.
    – Ricky
    Oct 3, 2017 at 0:25
  • @RickyBeam Yes obviously it has to replace the entire IP header not just the address. However figuring out the addresses turns out to be the hardest part of replacing the IP header. Replacing all the other IP header fields is a trivial manipulation in comparison.
    – kasperd
    Oct 3, 2017 at 7:03
5

Yes. Port mapping/destination NAT may also use a public destination IP. Imagine a load-balancing/fail-over scenario where you map virtual/balanced IP addresses to dedicated server addresses. Often this is done with private addresses but there's no reason not to use public addresses.

Improve this answer
5

NAT is used to translate network addresses, either source, destination, or both. IP and NAT do not know anything about public or private addresses, which were arbitrarily assigned. There is nothing inherent in IP that defines public or private addresses. Simply put, the ISPs have agreed to not forward traffic based on some address ranges, but it has nothing to do with IP or NAT. It is entirely possible to use NAT to translate Private-to-Private, Private-to-Public, Public-to-Private, or Public-to-Public addresses.

Having said that, NAT should be avoided if at all possible. Since private addressing cannot be used on the public Internet, that would be a scenario where you would want to use NAT. It is entirely possible that someone will use NAT to translate any of the other scenarios, but there should be a good reason to do it because NAT breaks the end-to-end IP paradigm.

Improve this answer
2
  • 2
    A simple example of the problem: All the headaches that programs must go through to allow them to listen for connections when they are behind a NAT.
    – Loren Pechtel
    Oct 1, 2017 at 3:41
  • 1
    Also the non-deployment of protocols like SCTP, which can't be used if your NAT router doesn't speak them. (Normal routers don't need to care)
    – user253751
    Oct 1, 2017 at 5:06
3

I can think of a few use cases

  • Network administration chooses to configure all systems with 8.8.8.8 and 8.8.4.4 for DNS servers, and then uses NAT to send requests to whatever approved servers ... just an example of patching over a commonly-used service with networking
  • Dealing with antiques: before RFC 1597 (now 1918), many computers had badly-chosen addresses. Sun workstations, for example, were almost always in 192.9.200.0/24

I suppose these and similar all come under the general idea that those responsible for networking might not have responsibility for servers but might nonetheless have to make the networks function.

Jonathan

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.