up vote 2 down vote favorite
share [g+] share [fb]

In one of the previous organizations I worked, all of our ip addresses were in public IP range. So, is there any advantage of having public ip addresses for private network?

link|improve this question
feedback

4 Answers

up vote 9 down vote

Advantages of public IP addresses:

  • Your routers don't need to handle NAT (Network Address Translation).
  • Your applications don't need to deal with the protocol issues that arise from NAT.
  • Any device can provide services to the internet without configuring port forwarding rules (subject to any firewalls in place).

Disadvantages of public IP addresses:

  • You don't get the built-in security of NAT -- that is, if devices don't have a public address, they can't be accessed from the internet (without specific port forwarding rules).
  • IPv4 addresses are a limited and increasingly expensive resource.
link|improve this answer
@Tom: I agree with your answer except for the part about acccessing internal hosts from the outside. Using routable addresses internally doesn't make those hosts any more accessible from the internet without specific forwarding rules then when using RFC 1918 addresses and NAT. – joeqwerty May 26 '11 at 11:03
@joeqwerty: Interesting - what makes you say that? – Tom Shaw May 26 '11 at 11:11
1  
I agree with everything you say, so maybe I was ambiguous about what I meant by talking about forwarding rules without mentioning firewall rules. I'll try and make it clearer. – Tom Shaw May 26 '11 at 13:26
1  
@mfinni: Gotcha. I assumed too much when reading the question. – joeqwerty May 26 '11 at 16:21
1  
@Joe - it's like a Microsoft exam question :-) Don't fill in the gaps with best practices, just stick with the scenario given, as unlikely as it might be. – mfinni May 26 '11 at 16:39
show 4 more comments
feedback
up vote 3 down vote

No. And in fact it can be a problem if you want to access public resources that have the same address as a machine on your private network.

Now if the machines truly were connected directly to the Internet via a public address then protocols that normally wouldn't work well over NAT would work properly.

link|improve this answer
1  
Only a problem if the organization does not own the public IP addresses. Some old and big organizations have large IP address spaces but still route some of those only internally and they are not contactable from the outside. – user53747 May 26 '11 at 6:58
1  
Even some not-so-big ones... we got a Class C back when they were class C's and it's still assigned to us. I used to boast about having a single digit in my NIC handle and that still lives on at ARIN. So the "old" part of your is correct! – Ward May 27 '11 at 3:09
feedback
up vote 3 down vote

To expand a bit on Tom Shaw's answer. The end-to-end principle is a fundamental design paradigm of IP networking. The idea is that the "intelligence" in connectivity is aggregated at the end-points of a connection an the all the stuff, the switches, routers, etc. in between are "dumb" in an attempt to limit the amount of things that can break. The IP protocol and its stateless nature is an example of this. The old MaBell telephone infrastructure is example of the opposite approach. The end-points are "dumb" and the infrastructure has the "intelligence".

NAT utterly breaks this principle by creating and holding state, translating IPs and doing a number of other things. Some application protocols will handle this gracefully, others will not (for example: FTP, SIP/RTP and some Peer-to-Peer protocols). NAT also adds another layer of complexity to building and managing your edge devices.

There's nothing intrinsically wrong about using public IP addresses for a private network (I have worked with few state governmental agencies that do this), provided they are actually allocated and assigned to you or your organization.

link|improve this answer
feedback
up vote 1 down vote

If you and one or your vendors (for example), use the same internal IP scheme, then creating site-to-site ipsec vpns can be tricky, especially when using vpn equipment made by different vendors. One way around this is to use a public ip address (that you own) internally to avoid these types of conflicts.

link|improve this answer
I agree with the idea (I've seen the same problem in corporate mergers: overlapping address spaces), but didn't you mean to say that companies should use public IP addresses for this reason? You can't own a non-public address. – Tom Shaw May 26 '11 at 14:13
Thanks Tom! I fixed my comment. :-) – jftuga May 26 '11 at 21:06
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.