Subject: Re: (NAT) NAT operational issue

From: Steve Bellovin <[email-masked]>
Date: Wed, 03 Mar 1999 10:27:59 -0500

In message <[email-masked]>, Brian E Carpenter writes:
> I can't see why it won't work, except that it will confuse
> users of ping, traceroute and other operational
> tools. It could also cause a problem if two ISPs doing this
> happen to merge their networks. And if the ISP wants to run
> servers inside its domain, it will need NAT/ALGs to make those
> servers reachable from outside, and 2-faced DNS. And as we have 
> seen there is a real practical possibility of leakage.
> Altogether a messy situation.

I've seen it done where only the routers have 1918 addresses, or perhaps
those and low-value internal servers, such as netnews.  The idea of
the latter is to keep non-customers from using your resources.  There's
no need for DNS games, and externally-visible servers, such as for inbound
mail and DNS, use global addresses.
-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.