4

If I have NAT or PAT applied on edge router, Would it matter if I use IP addresses from public block in my LAN? And how?

Improve this question
3
  • 2
    Are they from a block you own and that's routed to your LAN? Then it would possibly make sense and you do not need NAT to route the IPs.
    – allo
    May 3, 2019 at 11:30
  • No, well, not owned. I see you answer below.
    – NisaarDeenAzeem
    May 10, 2019 at 10:49
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 20:03

2 Answers 2

Reset to default
17

EDITED

I'm assuming you're considering using an IP block that is not registered to you. Otherwise, skip to the last paragraph.

Besides being a very poor practice, if you use public addresses on your internal network, that means that you can never reach hosts that use those real addresses. You may think you'll never need to reach servers in some other part of the world, but you'd be surprised at how often that happens.

BTW, if you don't use NAT, you're essentially hijacking someone else's addresses, and your ISP may disconnect you from the Internet (among other things).

The RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) should provide plenty of address space for your internal network.

If you are using your own IP block, then there's nothing wrong with using those addresses internally. It may possibly increase your security risks, but those can be mitigated by other means.

Improve this answer
7
  • 2
    Also note that non-RFC1918 addresses used inside your network wreak havoc with many security monitoring/intrusion detection systems. As far as the appliances are concerned, those are internet addresses which means those are internet originated packets bouncing around your LAN. Alarm bells ensue.
    – drxzcl
    May 2, 2019 at 20:42
  • 2
    There's also the issue of reverse DNS lookups. For example, if you gave one of your computers the IP address 172.217.14.196, it'll show up in various places with the name sea30s01-in-f4.1e100.net.
    – Mark
    May 2, 2019 at 20:52
  • 2
    Even if you use NAT, it's very possible to have a router/NAT/firewall configuration that will send your LAN packets using public addresses out to the internet.
    – mtraceur
    May 2, 2019 at 21:24
  • 2
    And of course, the fact that you can't access those hosts on the Internet is the reason it's a very poor practice.
    – user253751
    May 2, 2019 at 23:14
  • 2
    Although it's extremely unusual, there is a special case where this would be legitimate: your network has properly assigned "public" IP addresses and those are what you are using. And for some reason you're also using PAT/NAT, perhaps to cloak your internal structure, perhaps to merge with another organisation's addressing. I've never seen this, and don't expect to!
    – jonathanjo
    May 3, 2019 at 7:58
1

It matters in the situation that you do not need/want to reach those public IPs used.

If you use such IPs and then you, for example, want to access a site that has one of the IPs, it will not work, because your IP will resolve locally instead of going through your edge router and forward.

My company also uses such a system (it was implemented this way to be able to connect to other partner locations via EIGRP) and the corresponding IPs are assigned to China, so things should be fine as the company does not deal anything directly with something in hosted in China.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.