2

I have a device on another network, say it's IP is 10.1.1.1

I want to ping it from my own network, say host 192.168.1.1, but I want to ping an address in my local segment to do so,so 192.168.1.2.

Is it possible with NAT for 192.168.1.1 to ping 192.168.1.2, but for 10.1.1.1 to be actually pinged ?

the two networks would be directly connected to each other by the same router.

Improve this question
4
  • 1
    If they're directly connected you don't need to introduce NAT - you'd just have proper routes to forward the traffic through each connected interface. For example, a route on your workstation to say something like 10.1.1.1 255.255.255.255 192.168.1.254 or whatever the gateway is for your 192.168.1.x network) and then a route on the other side to know how to reach the 192.168.1.x network from the 10.1.1.x network.
    – Jesse P.
    Jun 24, 2019 at 23:00
  • I know that, but i want a ping from the 192 network to ping the 10.1.1.1 address with a source address of the 10.0.0.0 network
    – user10021657
    Jun 24, 2019 at 23:03
  • If you can provide sanitized configs for both sides, we can answer. Without that, there are too many variables to be able to say either way.
    – Jesse P.
    Jun 24, 2019 at 23:07
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 15, 2019 at 4:18

1 Answer 1

Reset to default
3

Your actual question:

Is it possible with NAT for 192.168.1.1 to ping 192.168.1.2, but for 10.1.1.1 to be actually pinged ?

and your comment:

i want a ping from the 192 network to ping the 10.1.1.1 address with a source address of the 10.0.0.0 network

are two very different things.

First, we must make sure that you understand what happens when one host sends a packet to another host:

When a source host sends a layer-3 packet, it will build a layer-2 frame, so it needs to relate the layer-3 destination address to a layer-2 destination address in order to build the frame. With IPv4 and an IEEE LAN protocol (ethernet, Wi-Fi, etc.) it will use ARP (Address Resolution Protocol) to get the layer-2 destination address for the layer-3 destination address.

The source host first needs to determine if the destination host is on the same layer-3 network as itself. It does that by masking both the layer-3 source and destination addresses with its configured network mask. If the results are the same, the source host will know that the destination host is on the same network as itself, and it will use ARP to directly find the destination layer-2 address. If the results are different, then the source host knows the destination host is on a different network than it is, and it will use ARP to find the destination layer-2 address of its configured gateway. In either case, the layer-2 frame is built with the layer-2 address (either the destination host, or the gateway to get to the destination host) returned by the ARP process.

ARP works by first looking in the host's ARP table to see if it contains an entry for the destination layer-3 address. If so, it uses the layer-2 destination address related to the entry for the layer-3 destination address. If not, it sends a broadcast ARP request that asks, "Who owns this layer-3 address, and what is your layer-2 address?" It will wait for a reply, eventually timing out if it gets no response, and it will pass an error back up the network stack to the application.

Also remember that ping is a bidirectional application that uses ICMP echo requests to solicit ICMP echo replies, so it is not enough that a ping ICMP echo request reach the destination host, but the ICMP echo reply must also be able to get back to the source host, meaning the destination (now source) host must also be able to send packets to the source (now destination) host, too.

Looking at your question, there are some possibilities how this will play out:

  • If there is already a host on the source network with the destination layer-3 address of 192.168.1.2. That host will reply to the source host (192.168.1.1) with its layer-2 address, and the source host will end up pinging its neighbor on its own network.
  • If there is no host on the source network with the layer-3 destination address, the ARP request will time out, and an error will be sent back up the network stack to the ping application, resulting in a destination unreachable error message.
  • Another possibility is that you have a router that can be configured for Proxy ARP (a security problem), and that it can be configured to send traffic destined for the same network on which it was received to a different network, and also perform an address translation (NAT) on the layer-3 packet destination address, translating 192.168.1.2 to 10.1.1.1. The destination host would then receive a packet with the source host of 192.168.1.1 and a destination address of 10.1.1.1, and it will be able to normally reply to the ping.

Looking at your comment, the source host can send packets to the real destination, but have the destination router (the router connected to the destination network) use a common source NAT to change the source layer-3 address to that of the router interface in the destination network.

Doing both scenarios at the same time will require both techniques.

In any case, what you want seems to be a giant kludge for which you should have a valid reason with no other alternative. Routers route packets between networks, and if you have two different networks, then simple routing will send packets between the networks, and you avoid all the problems inherent in NAT.

Improve this answer
7
  • thanks for the detailed response.... the idea I'm trying to implement is The aim is that anyone on the 192 network will only send traffic to a 192 address (not just a default gateway, a 192 host address). But with a specific 192 address, it will be forwarded to the 10 host, and visa versa.
    – user10021657
    Jun 25, 2019 at 11:38
  • That actually makes no sense. Network (layer-3) addressing is designed to go from network to network. Otherwise, we would just use layer-2 addressing. What you want is a specific gateway (a host on your network that knows how to reach other networks) on you network to get to the other network. The big question then is that if you send traffic to it, how does it know which host on the other network should get the traffic if traffic for all the hosts on the other network are sent to its one address?
    – Ron Maupin ♦
    Jun 25, 2019 at 13:11
  • is that not where NAT comes in? packet sent to 192.x.x.x.. router sees this, translates destination ip to 10.x.x.x
    – user10021657
    Jun 25, 2019 at 13:14
  • 1
    Not really. You can have an entire network behind a single address with NAPT, but then you can only originate traffic from the network behind the NAPT, not to the single address. NAT breaks the IP premise of end-to-end connectivity. Do you have a valid reason with no alternative for this idea? Maybe you are looking at an X-Y problem.
    – Ron Maupin ♦
    Jun 25, 2019 at 13:22
  • @user10021657 Don't use NAT. What you need is a router connecting 192.168.1.0/24 and 10.1.1.0/24. On that router you configure an ACL (or a firewall policy) to permit traffic from 192.168.1.1 to 10.1.1.1 and back while denying everthing else.
    – Zac67 ♦
    Jun 25, 2019 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.