How It Works
When using connection sharing, a single Windows 2000 computer is configured with a public IP address that's accessible to computers outside the organization over the Internet. Computers inside the company's private network communicate with hosts on the Internet by sharing that single connection. Addressing is translated at the connection point between the internal, private IP addresses and the single external public address.
There are a number of benefits to using this type of configuration, including these:
-
Increased security. Connection sharing offers a bit of security to your network in that your internal IP addresses are hidden from hosts on the outside world. This isn't a robust security scheme, but it provides some measure of security by protecting access to specific internal IP addresses.
-
Efficient use of public IP addresses. Companies allotted only a small number of public IP addresses will find that connection sharing allows them to conserve that address space by sharing a single public IP address among many internal hosts.
Windows 2000 connection sharing comprises the following components:
-
Translation. The connection sharing translation process builds a table of translated IP addresses mapping the public IP address as well as higher-level port number with the internal IP address appropriate port.
-
Addressing. The addressing process uses a DHCP protocol to allocate a subnet mask, default gateway, and DNS server address to each host on the internal network.
-
Name resolution. Name resolution requests sent out by hosts on the internal network are received by the connection sharing computer that performs the resolution and returns the appropriate IP address.
-
NAT Editor. The NAT Editor is a component that allows the connection sharing computer to modify IP packets beyond simply changing the IP address and higher-level port number. This ensures that higher-layer protocols such as FTP operate properly.
NOTE
The default gateway is always 192.168.0.1. The private interface of the connection sharing computer and the DNS server is also 192.168.0.1. This is not configurable, as connection sharing limits the computers that can share a connection to the same physical subnet as the connection sharing computer.