3

This is from the NAT RCF:

The following is a description of the properties of realms supported by Twice-NAT. Network address of hosts in external network are unique in external networks, but not within private network. Likewise, the network address of hosts in private network are unique only within the private network. In other words, the address space used in private network to locate hosts in private and public networks is unrelated to the address space used in public network to locate hosts in private and public networks. Twice NAT would not be allowed to advertise local networks to the external network or vice versa.

I'm confused about the last sentence, why can't the external network be advertised to the private network? Is it because

Network address of hosts in external network are unique in external networks, but not within private network.

Meaning that the private network might be using an external network address?

Improve this question

2 Answers 2

Reset to default
3

You did not read the entire section on Twice-NAT in the RFC. It has this:

Twice NAT is necessary when private and external realms have address collisions.

That means that the internal addressing is not unique to the external addressing.

Unfortunately, people use Twice-NAT as a substitute for routing, but NAT is not a substitute for routing, and it can cause problems because the outside cannot directly address hosts on the inside.

Remember that there are two cases for NAT: public<->private or overlapping addressing. You can get overlapping addressing when two companies using the same private address range either merge or connect with an extranet. The weakness in IPv4 private addressing is that the same private addressing is used by all that use private addressing. Also, some companies have used previously unassigned public IPv4 address space, but it is now in use on the public Internet, causing the companies problems with trying to serve to that address space on the public Internet.

IPv6 restores the IP paradigm where every host can have a globally unique address, eliminating the need for NAT. IPv6 also has ULA (Unique Local Addressing), where the "private" addressing is supplemented by a 40-bit randomly chosen Global ID, giving a good chance of having a unique address range. When companies use that and merge or form an extranet, it is unlikely that they use the same ULA addressing.

Improve this answer
3
  • In twice NAT, why is an external network not routable withing a private network? What does routable even mean?
    – user86942
    Dec 30, 2022 at 17:52
  • 1
    When an internal host tries to communicate with an external address that is duplicate of an internal address, then the traffic will never leave the internal network (and vice versa), and communication with the external network will not be possible unless you use NAT. Remember that a host will check to see if the destination address is on the same or a different network. If on the same network, it tries to send a layer-2 frame directly to the destination. If they are on different networks, the source will send the layer-2 frame to its configured gateway (router).
    – Ron Maupin ♦
    Dec 30, 2022 at 18:07
  • @user86942, routing is where a host (router) looks up the packet destination address in its routing table and forwards the packet to a different network. IP (both IPv4 and IPv6) is about forwarding packets between different networks. You route between networks, but you bridge (switches are bridges) on the same network.
    – Ron Maupin ♦
    Dec 30, 2022 at 18:11
1

Meaning that the private network might be using an external network address?

Yes. The external addresses are always unique, but the "private" addresses are not. That's what makes them private.

Improve this answer
2
  • That doesn't answer my question. If the external addresses are unique, then why can't Twice NAT advertise them to the local network? Last sentence of the text: "Twice NAT would not be allowed to advertise local networks to the external network or vice versa."
    – user86942
    Dec 30, 2022 at 17:41
  • 1
    Because the external addresses are unique only in the external realm. The private network could be using the same space.
    – Ron Trunk
    Dec 30, 2022 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.