Can a host in a public network communicate with a host in a private network, by layer 3 alone?

Question

Suppose a private network and a public network are connected by a router or some other device.

After a host in the private network sends a message (e.g. a HTTP request) to a host in the public network,

• is it correct that the second host can't send a message (e.g. a HTTP response) back to the first host, by only using layer 3 (IP address and network address translation device), because all the private IP addresses in the private network are mapped to the same public IP address?

• is it correct that the second host can only send a message (e.g. a HTTP response) back to the first host, by using the layer 4 (port and some (network and) port address translation device)?

Thanks.

Answer 1

There is nothing inherent about the IP protocol that separates public and private addresses. To the computer or router, they are all the same. We agree that as a policy, we define certain addresses ranges as private-- meaning they will not be routed over the public Internet so they do not have to be globally unique.

is it correct that the second host can't send a message (e.g. a HTTP response) back to the first host, by only using layer 3 (IP address and network address translation device), because all the private IP addresses in the private network are mapped to the same public IP address?

Your question doesn't really make sense. An HTTP response is encapsulated in a TCP segment, so I don't know how one can send a response using "only layer 3"

The most common form of address translation (and the one you are referring to) is Network and Port Translation (NAPT). both the source address and port are translated to another address/port (usually a single IP address, but unique port). The NAPT device keeps track of the translations so it can forward return traffic.

When NAT does not include port translation, then there is always a one-to-one relationship between the original address and the translated address, never many-to-one.

Answer 2

As Ron says, as far is the IP protocol itself is concerned there is no real difference between public and private addressees. It is just a matter of policy and convention that private addresses are not used to exchange traffic publicly on the Internet.

The internet is a network of networks. It is up to each individual network how they design things internally as long as what they expose to the outside world follows convention.

One network designer may choose to have a hard border between their "public" and "private" networks with the "public" network having no knowledge of the private part except it's external IP addresses and all traffic from the private part to the public part running through a network address translator.

Another network designer may choose to have a single network, with public and private subnets that are able to reach each other directly. They may decide that the machines with private addresses do not need to talk to the outside world.

Yet another network designer may decided to have separate public and private networks, but give some machines multiple (real or virtual) network adapters so they can have a presence on both networks.

Furthermore, NAT can be divided into "one to one" and "one to many". A "one to one" NAT maps a single private address to a single public addresses. It has no need to modify transport layer port numbers or include them in it's mapping tables. It does however need to modify transport layer checksums as these checksums often cover the .

Answer 3

Communication between public IPv4 and private IPv4 requires a form of NAT working in both directions. However, you can destination NAT the public IP address of a router to the private IP of a specific LAN host by address alone, ie. on the network layer.

In the reverse direction (private to public source NAT) you'd need to have a 1:1 address relationship as well - the NAT router could provide Internet access for just a single private client. Without looking at the transport layer, the router wouldn't be able to map responses from the Internet back to the correct initiator if there were more than one.

Essentially, source and destination NAT become the same thing: the NAT router substitutes its public address for the (single) private source address for outgoing packets. For incoming packets, it replace its public address by the private address it maps to.

For completeness, there may be scenarios where you don't need any translation between public and private address space, e.g. with a DMZ running in public address space. Since the only difference between private and public addresses is convention, the DMZ router just needed a working route for the private network and vice versa.

Regarding communicate ... by layer 3 alone: Host applications communicate using application-layer protocols encapsulated by transport-layer protocols (encapsulated by network-layer protcols, ...). They cannot communicate "by layer 3 alone". (Depending on your definition of "communicate".)