My question in short: "Which is better? To assign private IP addresses to public servers and do NATing, or to assign public IP addresses to them without the need for NATing"?
The NATing can be useful for users to allow many users to access the Internet using a small pool of public IP addresses (can be just one IP). This is called PATing also.
I am discussing NATing the IP addresses of public servers such as: DNS, Web servers, Email servers, etc. NATing of public servers should be done using static NAT. So, someone can think of eliminating the NATing process and assigning the public IPs on the servers. Here is a comparison of the two scenarios.
With NATing:
+ The public IP addresses are managed and used on the gateway as desrired.
+ The public IPs are preserved and can be used as efficiently as possible.
- A little overhead will be added on the gateway router / firewall.
- The private IP addresses may be exposed to the outside (for example, in emails headers, or in a misconfiguration).
- We need to create two views for the DNS servers (private for internal users and public for external users).
Without NATing:
- Assigning more than one IP address for a server should be done on the server itself. The application/service should be aware to use all the IPs for the outgoing traffic.
- The public IP addresses are assigned to the servers directly. So, some IPs may be wasted (not used) such as the case of cluster and VIP.
+ The routing/forwarding will be a bit faster as we are not doing NATing (less overhead).
+ All communications will be done using the public IPs.
+ One DNS view will be enough as we are using the same IPs from internal and external.
Any other ideas/suggestions??