0

Similar to this question, I'm wondering how resources in my public subnets communicate with those in my private subnets - when there is a NAT service present.

My impression is that a self-managed NAT Server obscures all private assets (resources we own) and all external communication is initiated by the NAT server, which is doing the “address translation.” Having private subnets without any NAT Server (managed as NAT Gateway or otherwise) and applying arbitrary IPs from the RFC ranges is not the same as having those ranges translated by the NAT Server (or NAT Gateway); the fact that the RFC ranges are canonically “private” is in no way enforced in that case, there’s nothing special about those typically private ranges. The full implications of that are not really clear to me, since it’s not something I’ve seen or used much.

Additionally, my impression is that a NAT server (managed or otherwise) and private IP ranges aren't just for protecting internal resources from external communications, and that even things inside my VPC's public subnets have to route through the NAT server. Anything that wants to send packets to those RFC ranges must first communicate with the NAT server, via its public IP given by the IGW. Thus the whole mechanism enforces routing through at least 2-3 AWS managed services, even for internal, public-private communications.

Is that (all?) correct?

2
  • "my impression is that a NAT server (managed or otherwise) and private IP ranges aren't just for protecting internal resources from external communications" That has nothing to do with IPv4 Private addressing or NAT. NAT is a kludge to extend the life of IPv4 until IPv6 is ubiquitous, restoring the IP end-to-end paradigm where each host gets a unique address. In fact, IP, itself, has no concept of public or private addressing. It is only that ISPs have agreed to not allow IPv4 Private addresses on the public Internet.
    – Ron Maupin
    Jul 30, 2023 at 16:21
  • @RonMaupin aren't we in agreement (at least on that last sentence) - I said "the fact that the RFC ranges are canonically “private” is in no way enforced in that case, there’s nothing special about those typically private ranges."
    – d8aninja
    Jul 30, 2023 at 16:29

1 Answer 1

3

Is internal network traffic sent to private subnets via their NAT Server?

Internal traffic should never be NATted. NAT is a necessary translation between incompatible addressing schemes like sending traffic originating from a private address over a publicly addressed network (source NAT), or forwarding public-address traffic to a destination with a private IP address (destination NAT).

NAT breaks the general end-to-end paradigm of TCP/IP and is costly on resources (the NAT server is not stateless but needs to track sessions). It should generally be avoided unless it's absolutely necessary.

I'm wondering how resources in my public subnets communicate with those in my private subnets

That's for you to define. By default they don't, unless you create some mechanism to make it work (destination NAT mapping aka port forwarding, a proxy, ...).

Alternatively, in your public subnets you can actually use private destination addresses to forward into your private network. There's nothing stopping you.

a self-managed NAT Server obscures all private assets (resources we own) and all external communication is initiated by the NAT server, which is doing the “address translation.”

A NAT router isn't a proxy, so it doesn't initiate any communication.

a NAT server (managed or otherwise) and private IP ranges aren't just for protecting internal resources from external communications

A NAT router doesn't protect anything. It's your firewall's job to do that.

the fact that the RFC ranges are canonically “private” is in no way enforced in that case, there’s nothing special about those typically private ranges.

What's special for RFC 1918 address ranges (and some other reserved ranges) is that they are not and cannot be routed over the open Internet.

NAT is a 'necessary evil' that was introduced to enable communication between public and private addresses more easily than with proxies.

Private addressing was created to delay the foreseeable exhaustion of public IPv4 addresses, which it quite successfully did.

3
  • That means that if a malicious actor can get into the public subnet, they have LOCAL routes to anything in the entire VPC, private or public - or? I would have thought that any communication with addresses in the RFC 1918 range have to first get the public IP (from the IGW) of the NAT router (if there is one) so that the NAT router can conduct its mapping procedure and return the private IP to the pertinent private resource. Why have DMZ networks and JBs and such if you can access private resources once inside a VPC or VNet? (Obviously there "should" also be SGs / firewalls etc setup, but...)
    – d8aninja
    Jul 30, 2023 at 17:16
  • Well, it's your network, so better keep malicious actors out, hmm? I would have thought that any communication with addresses in the RFC 1918 range have to first get the public IP (from the IGW) of the NAT router (if there is one) so that the NAT router can conduct its mapping procedure and return the private IP to the pertinent private resource. - no, not at all. Private addresses within a private network are fine w/o NAT. A DMZ is a security zone which doesn't mandate any kind of addressing.
    – Zac67
    Jul 30, 2023 at 17:26
  • All true; I guess I had always considered the "address translation" function of the NAT router as synonymous with obscuring the "translated" address space, so that when there is a NAT it must be transited in order to establish communication with the private asset.
    – d8aninja
    Jul 30, 2023 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.