I operate a relatively small ISP (around 1k households). We have passed the stage where a single router does not cut it anymore. As a corollary, we have to link routers to each other.

For this, we've used /30 CGNAT addresses on router-to-router links. Is that the way to go about it? Or is there an address space specifically reserved for this? Or should we flat out use public IPs (we have a /23 from APNIC)?

Our topology is fairly straightforward at the moment. Each router-router link has a /30 CGNAT network.

Clients -> CGNAT/Shaping ────────────┬──────┐
             Router                  │      │    ┌──► Edge 1 ──► Transit 1
                                     ▼      │    │    ▲
                             ┌────► Core ───┼────┤    │
                             │       ▲      │    │ ┌──┘
Clients -> CGNAT/Shaping─────┤  ┌────┘      │    │ │
             Router          │  │           ▼    └─┼──┐
                             │  │   Core Backup    │  ▼
                             └──┼──► (Planned)─────┴─►Edge 2 ──► Transit 2
                                │         ▲
Clients -> CGNAT/Shaping ───────┴─────────┘

2 Answers 2


CG-NAT uses the reserved address space (RFC 6598) or instances with DS-Lite (RFC 6890). You don't use those between your internal routers- not sure if I understand you correctly - but only with the client routers (between CPE and COE).

Depending on your address topology (can't see that from your diagram), you'd use any private addresses from RFC 1918 or some of your public addresses between your routers (/31 for P2P).

  • Because of this question, we don't have a solid address topology yet. What we currently have is we've split into /16 blocks, and reserved for "technical use". If I enter a household and do a traceroute it would be[public internet]. The reason we haven't used RFC1918 yet is due to that traceroute. Would having RFC1918 in the path cause issues if a client network also uses that (e.g. Client uses and one of my links happen to use
    – Aloha
    Jan 10 at 12:29
  • That's the point of defining a CG-NAT address space - it's a space that makes sense to both the client LAN and the ISP. The RFC 1918 ends on the client router though (RFC 6598 doesn't), so you could reuse the 1918 addresses with in your internal address domain. An address topology or address domain map defines which addresses are used and what their exact scope/reach is.
    – Zac67
    Jan 10 at 12:40

Anything visible to/from the internet (i.e. not behind NAT) MUST have a routable internet address. If either of your Core or Edge routers generate and forward an ICMP error using a non-routeable address, your transit providers should drop it. (And everyone beyond your transit should as well.) I understand how limited IPv4 addresses are, but you really can't escape using them here.

(As for a numbering plan... everybody does whatever works for them, so we could only offer opinion. But I'd recommend planning ahead -- make a plan that works both today and tomorrow.)

  • In my diagram, NAT is only running on the shaping routers. Everything from there to the edge/border router runs OSPF. On the edge, we have a filter so only our public IP is BGP advertised. Your answer does make sense - I've studied every major ISP locally and all of them have publicly reachable routers. At most, I only see one private hop via CGNAT.
    – Aloha
    Jan 10 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.