1

Is it possible, from a private network, to access to a public server (i.e., a server with a public IP address) without a NAT? In other word, can an Intranet provide public services, if I give public addresses to server and private addresses to hosts in the Intranet?

2 Answers 2

4

No.

The private network will most likely be able to send a packet out to the public IP addresses (assuming the private network has a properly configured router with an interface both on the public internet and the private internal network). But the server on the public internet will not be able to send a reply back to the not-NAT-ed private network, quite simply because the server will have no idea where to send that response data.

For computers to speak IP to one another on a network they have to know the IP address of the other person they're talking to, and what the next step is for getting to that IP address. If the IP address is in the same subnet, then your computer will just ask "who has IP address w.x.y.z" on the local subnet and then will talk directly to the computer that responds. If the IP isn't on the same subnet, then the computer will follow the instructions in its routing table (normally, send the packet to the local router listed as the "default gateway" in the IP configurations).

Each inter-networking node (normally a routers at this point) that receives the packet will look at the destination IP address and make a similar determination of who is the next hop in the chain that will deliver this packet to the final destination. On and on, until it finally arrives where it is supposed to.

But that all relies upon the destination being listed in the packet header (as is required in the IP protocol) and that the gateways & routers know how to send data to the network that IP belongs to. If you have a non-NAT-ed private IP address, then those routers won't know how to deliver the packet, and they'll discard it. It becomes the electronic equivalent of a "dead letter" that just disappears forever.

What a NAT does is use a public IP address (or addresses) as a front-man to broker the communications for your private network. When it sees outbound traffic, it alters the "reply to me at this address" portion of the headers to use its own public IP; and the NAT device keeps a lookup table of who it is relaying communications for so that when the responses come in he can forward them on to the proper IP on the private network. Without that address translation function, a computer on a private network cannot talk TCP/IP with a computer on the public internet.

0

Save for the "no" at the top @Ruscal answer is correct but incomplete.

The answer is an extremely qualified "yes, sometimes, in a limited capacity depending on how it is set up".

There are at least 2 workarounds - but all of them require a system which can be reached on a private IP but which in turn has internet access, eg a second Interface with a public IP - this is common on routers and not unheard of on servers (but not common)

In the above case workarounds include :

  1. Using that system as a proxy.
  2. Setting up a VPN between that system and the external one, then using a VPN or tunnel through that system.
2
  • 1
    Also remember: NAT does not really exist in the IPv6 world. What would the point be to have a NAT between two public IPv6 adresses? Remember NAT is not a firewall, though consumer grade routers contains both NAT and firewall features. Jan 15, 2020 at 8:04
  • @LasseMichaelMelgaard with respect of IPV4 I agree that technically NAT is not a firewall, but the way it is deployed in SOHO devices has the same net effect - and its not because of firewall festites, its because it blocks incoming connections not related to an outbound connection. Even were I to only use iptables nat features with default allow rules, it would still have the effect of a firewall suitable for a home/typical small business.
    – davidgo
    Jan 15, 2020 at 8:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .