If I have NAT or PAT applied on edge router, Would it matter if I use IP addresses from public block in my LAN? And how?
-
2Are they from a block you own and that's routed to your LAN? Then it would possibly make sense and you do not need NAT to route the IPs.– alloMay 3, 2019 at 11:30
-
No, well, not owned. I see you answer below.– NisaarDeenAzeemMay 10, 2019 at 10:49
-
Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.– Ron Maupin ♦Jan 5, 2021 at 20:03
2 Answers
EDITED
I'm assuming you're considering using an IP block that is not registered to you. Otherwise, skip to the last paragraph.
Besides being a very poor practice, if you use public addresses on your internal network, that means that you can never reach hosts that use those real addresses. You may think you'll never need to reach servers in some other part of the world, but you'd be surprised at how often that happens.
BTW, if you don't use NAT, you're essentially hijacking someone else's addresses, and your ISP may disconnect you from the Internet (among other things).
The RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) should provide plenty of address space for your internal network.
If you are using your own IP block, then there's nothing wrong with using those addresses internally. It may possibly increase your security risks, but those can be mitigated by other means.
-
2Also note that non-RFC1918 addresses used inside your network wreak havoc with many security monitoring/intrusion detection systems. As far as the appliances are concerned, those are internet addresses which means those are internet originated packets bouncing around your LAN. Alarm bells ensue.– drxzclMay 2, 2019 at 20:42
-
2There's also the issue of reverse DNS lookups. For example, if you gave one of your computers the IP address
172.217.14.196
, it'll show up in various places with the namesea30s01-in-f4.1e100.net
.– MarkMay 2, 2019 at 20:52 -
2Even if you use NAT, it's very possible to have a router/NAT/firewall configuration that will send your LAN packets using public addresses out to the internet.– mtraceurMay 2, 2019 at 21:24
-
2And of course, the fact that you can't access those hosts on the Internet is the reason it's a very poor practice. May 2, 2019 at 23:14
-
2Although it's extremely unusual, there is a special case where this would be legitimate: your network has properly assigned "public" IP addresses and those are what you are using. And for some reason you're also using PAT/NAT, perhaps to cloak your internal structure, perhaps to merge with another organisation's addressing. I've never seen this, and don't expect to! May 3, 2019 at 7:58
It matters in the situation that you do not need/want to reach those public IPs used.
If you use such IPs and then you, for example, want to access a site that has one of the IPs, it will not work, because your IP will resolve locally instead of going through your edge router and forward.
My company also uses such a system (it was implemented this way to be able to connect to other partner locations via EIGRP) and the corresponding IPs are assigned to China, so things should be fine as the company does not deal anything directly with something in hosted in China.