4

NAT typically refers to router translating an IP address from a private network to a public IP address so that the node on the private network can access public Internet.

Is there a valid scenario where a router* is used to translate an address from a public IP address to another public IP address?

*note: I am talking about router only, not a proxy.

  • Are you limiting only to IPv4? I've used NAT to implement internal IPv6-only networks with translation to external IPv4. – chrylis Oct 1 '17 at 5:22
4

One scenario that fits your description of "translate an address from a public IP address to another public IP address" happens every time I access StackExchange.

Even though every computer on my network has public IP addresses I cannot access StackExchange directly because StackExchange only supports IPv4. So this answer is being sent through a NAT64 which translates public IPv6 addresses into public IPv4 addresses.

Cases of translating between different public IP addresses within the same protocol also happens. I have come across a company which had a /8 of IPv4 space and assigned addresses from that range to internal hosts. But they still used a NAT to translate the addresses such that externally traffic would be seen originate from an IPv4 address outside of that /8.

I don't know why that company chose to use a NAT when they in fact had enough IPv4 addresses to not need it. I think every such deployment could work better without the NAT, but I can't say that with absolute certainty since I obviously don't have intimate knowledge of what happens behind every NAT in the world.

  • 3
    At my company, for some reason we treat 11.x.x.x as private space, even though it isn't ours. Of course, traffic to the wider Internet from that space go through NAT like from any other private address. So that's another public-to-public translation. (I hope we don't need to use any servers in that range!) – immibis Oct 1 '17 at 5:08
  • Ah, continuing the great tradition of borrowing US DoD's address space... It's bad, but luckily that address range is not reachable from the public Internet (and probably will never be). It can confuse Windows systems if 6to4 wasn' disabled, though. – grawity Oct 1 '17 at 11:02
  • @grawity I can imagine there also exist systems which will try to use RFC 6598 addresses with 6to4. Since 6to4 is older than RFC 6598 you can't expect implementations to know it won't work. The same problem could happen with any setup using public IP addresses behind a NAT, even if you are using addresses that have actually been assigned to you rather than squatting on somebody else's. – kasperd Oct 1 '17 at 11:15
  • That's protocol translation. No amount of replacing addresses can make a v6 packet into a v4 packet, or v.v. – Ricky Beam Oct 3 '17 at 0:25
  • @RickyBeam Yes obviously it has to replace the entire IP header not just the address. However figuring out the addresses turns out to be the hardest part of replacing the IP header. Replacing all the other IP header fields is a trivial manipulation in comparison. – kasperd Oct 3 '17 at 7:03
5

Yes. Port mapping/destination NAT may also use a public destination IP. Imagine a load-balancing/fail-over scenario where you map virtual/balanced IP addresses to dedicated server addresses. Often this is done with private addresses but there's no reason not to use public addresses.

4

NAT is used to translate network addresses, either source, destination, or both. IP and NAT do not know anything about public or private addresses, which were arbitrarily assigned. There is nothing inherent in IP that defines public or private addresses. Simply put, the ISPs have agreed to not forward traffic based on some address ranges, but it has nothing to do with IP or NAT. It is entirely possible to use NAT to translate Private-to-Private, Private-to-Public, Public-to-Private, or Public-to-Public addresses.

Having said that, NAT should be avoided if at all possible. Since private addressing cannot be used on the public Internet, that would be a scenario where you would want to use NAT. It is entirely possible that someone will use NAT to translate any of the other scenarios, but there should be a good reason to do it because NAT breaks the end-to-end IP paradigm.

  • 2
    A simple example of the problem: All the headaches that programs must go through to allow them to listen for connections when they are behind a NAT. – Loren Pechtel Oct 1 '17 at 3:41
  • 1
    Also the non-deployment of protocols like SCTP, which can't be used if your NAT router doesn't speak them. (Normal routers don't need to care) – immibis Oct 1 '17 at 5:06
2

I can think of a few use cases

  • Network administration chooses to configure all systems with 8.8.8.8 and 8.8.4.4 for DNS servers, and then uses NAT to send requests to whatever approved servers ... just an example of patching over a commonly-used service with networking
  • Dealing with antiques: before RFC 1597 (now 1918), many computers had badly-chosen addresses. Sun workstations, for example, were almost always in 192.9.200.0/24

I suppose these and similar all come under the general idea that those responsible for networking might not have responsibility for servers but might nonetheless have to make the networks function.

Jonathan

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.