Home / server / Questions / 204835
Accepted
CT.
Asked: 2010-11-23 11:30:36 +0800 CST

Help me understand Public/Private IP space and NAT

  • 772

I just started working at a small-medium sized business after graduating school. So much of my knowledge is high level concepts without a lot of hands on.

My understanding that according to rfc1918 only the following IP ranges are for private IPs:

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

How does this concept work with NAT firewalls? Does it not apply to internal IP addresses behind a NAT firewall?

The reason I ask is because our internal network is on 199.5.83.0/24. My first thought when seeing this is that isn't private IP space. This internal network is behind a NAT firewall with an external IP of 74.4.9.x.

Does this setup make sense? Does it go against best practices? Can someone try and give me a brief explanation to firm up these concepts for me? Any links to relative reading would also be appreciated.

firewall nat ip rfc tcpip

5 Answers

  1. Nat firewalls translate your external ip address to your internal ip address. Have a look at the accepted answer on this now famous question about subnetting, which should answer your questions.

    Private IPs, in the ranges that you show in your question, are not publicly routable so need an external address to make it out onto the internet, hence NAT

    • 5

  2. There is nothing saying that only the private address ranges can be used with NAT. Any address range is fine.

    • 3

  3. If you're routing, then you're going to have problems. I have had a customer that had selected a range at random, they called one saying they could not access ibm.com for software updates. Guess what? They had selected an internal subnet which was the same as ibm's routable address range. Any machine on that network thought that the machine it was trying to reach was on the LOCAL subnet. Why has this answer been accepted it's just wrong?

    try setting your local subnet to the ip address of serverfault.com :-(.

    If you're using nat, and you're connected to the internet, use rfc 1918 address, because they are not defined so you can use them, the are defined so that the internet can't ;-).

    • 1
  4. Best Answer

    Off the top of my head, the only problem you'll face is when you try to access resources that truly own addresses within that public range. Otherwise, it shouldn't be an issue - you're router will know how to route to that "private" range and should handle NAT properly.

    You might want to put a project together to address that at some point though.

    • 1

  5. Your IP range is public, and should not need NAT translation support. Current practice is to use public addresses only for servers in the DMZ. Many organizations have migrated their internal network onto the private ranges.

    The private ranges provide some security from the Internet as they are only reachable with NAT support from the firewall. They do require NAT support to reach the Internet as well.

    • 0