- Introduction
- RFC-1918 and Link Local Addresses
- How NAT Works in FireWall-1
- Implementing NAT: A Step-by-Step Example
- Limitations of NAT
- Troubleshooting NAT
- Summary
- Sample Configurations
This chapter is from the book
This chapter is from the book
This chapter is from the book
RFC-1918 and Link Local Addresses
RFC-1918 (which was originally described in RFC-1597) sets aside specific ranges of IP addresses that cannot be used on the Internet. Instead, these addresses are to be used internally within an organization or network. If hosts with RFC-1918 addresses want to communicate with a network like the Internet, they must go through some form of NAT, as no host on the Internet will know how to route RFC-1918 addresses. The addresses assigned by RFC-1918 are as follows:
10.0.0.0/8 (net mask 255.0.0.0)
172.16.0.0/12 (net mask 255.240.0.0, which covers 172.16.0.0– 172.31.255.255)
192.168.0.0/16 (net mask 255.255.0.0)
Another set of address space that can be used for NAT is 169.254/16 (net mask 255.255.0.0). This address space is specified in an Internet Draft called "Dynamic Configuration of IPv4 link-local addresses," which is available at http://www.ietf.org/internet-drafts/draft-ietf-zeroconf-ipv4-linklocal-04.txt. Essentially, Microsoft Dynamic Host Configuration Protocol (DHCP) clients use this method to assign an address when they are unable to communicate with a DHCP server. This address space is reserved specifically for this purpose, so it will not be in use anywhere on the Internet and is thus safe to use for NAT.
If your situation requires the use of NAT, it is highly recommended that you use address space within the recommended ranges. If you are using someone else's address space within your internal network and you need to communicate with an Internet host that happens to use the same address range, you may find yourself not being able to do so, as the network traffic may never leave your internal network.