1

Suppose a private network and a public network are connected by a router or some other device.

After a host in the private network sends a message (e.g. a HTTP request) to a host in the public network,

  • is it correct that the second host can't send a message (e.g. a HTTP response) back to the first host, by only using layer 3 (IP address and network address translation device), because all the private IP addresses in the private network are mapped to the same public IP address?

  • is it correct that the second host can only send a message (e.g. a HTTP response) back to the first host, by using the layer 4 (port and some (network and) port address translation device)?

Thanks.

  • 4
    This is a weird question... Could you elaborate where your problem is? – Zac67 Mar 19 '19 at 14:33
  • I would like to separate responsibilities of different layers (layer 3 and higher layer(s) here) – Tim Mar 19 '19 at 15:00
  • 1
    Responsibilities are separated between layers, that's the whole point of a layering model. NAT messes that up, but it's an ugly hack anyway. – Zac67 Mar 19 '19 at 18:11
2

There is nothing inherent about the IP protocol that separates public and private addresses. To the computer or router, they are all the same. We agree that as a policy, we define certain addresses ranges as private-- meaning they will not be routed over the public Internet so they do not have to be globally unique.

is it correct that the second host can't send a message (e.g. a HTTP response) back to the first host, by only using layer 3 (IP address and network address translation device), because all the private IP addresses in the private network are mapped to the same public IP address?

Your question doesn't really make sense. An HTTP response is encapsulated in a TCP segment, so I don't know how one can send a response using "only layer 3"

The most common form of address translation (and the one you are referring to) is Network and Port Translation (NAPT). both the source address and port are translated to another address/port (usually a single IP address, but unique port). The NAPT device keeps track of the translations so it can forward return traffic.

When NAT does not include port translation, then there is always a one-to-one relationship between the original address and the translated address, never many-to-one.

| improve this answer | |
  • "When NAT does not include port translation, then there is always a one-to-one relationship between the original address and the translated address", so can the host outside send a response to the original host inside, using layer 3 alone? – Tim Mar 19 '19 at 16:11
  • I'm not sure what you mean by "layer 3 alone." – Ron Trunk Mar 19 '19 at 16:13
  • "When NAT does not include port translation, then there is always a one-to-one relationship between the original address and the translated address, never many-to-one." Do you mean there are multiple public IP addresses available for the NAT to translate the private IP addresses to? – Tim Mar 19 '19 at 21:42
  • Yes, precisely. – Ron Trunk Mar 19 '19 at 22:11
  • I believe @Tim is asking whether NAPT requires the use of a layer-4 protocol that the NAPT device understands. To which the answer is, it does. – user253751 Mar 20 '19 at 7:17
1

Communication between public IPv4 and private IPv4 requires a form of NAT working in both directions.

Host applications communicate using application-layer protocols encapsulated by transport-layer protocols (encapsulated by network-layer protcols, ...). They cannot communicate "by layer 3 alone". (Depending on your definition of "communicate".)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.