How is traffic separated between internal and external IPs?

Question

If I ping 192.168.0.X from my home network then it will attempt to look within my network for that address and not the external WAN IP. However I can ping 74.125.224.163 and it will ping google.com.

I can set my internal network to be 74.125.224.X and then if I try and ping, it would again look only within my network but I imagine (I haven't attempted changing it) that I could still communicate with Google's server on the same IP address.

At what level is this separated? How will the packets know that the destination of the IP address is to go out to the WAN instead of the LAN?

Answer 1

The packets do not know anything – they only carry the destination address; the path travelled is decided by routing tables that are kept in your computer, your router, and other routers in the Internet.

When a packet is sent from your computer...

1. The OS first checks if the destination address is assigned to any network interface in your computer. If yes, the OS consumes it itself – the packet doesn't go anywhere outside your computer.

2. Otherwise, it looks in the routing table for all routes matching the destination address. There might be several – the OS picks the one with the longest matching "prefix".

3. If there's no route that would match the destination address, the packet is dropped.

For example, if your own address was 192.168.1.1...

• your computer's routing table might look like:

  • 10.11.12.0/24 can be reached directly over ppp0 interface
  • 192.168.1.0/24 can be reached directly over eth0 interface
  • 10.42.0.0/16 can be reached by going through 10.11.12.50
  • 0.0.0.0/0 can be reached by going through 192.168.1.254

  The number after / tells how many bits to compare; see CIDR notation. E.g. if it's /16, then the first 16 bits of both addresses (starting from the leftmost bit) must be equal. If it's /0, nothing is compared, so the route will match any address – this is the "default route".

  Real routing tables also have metrics – for example, if you connected a laptop to your LAN over both Ethernet and WiFi, then it would have two identical routes to the same network, but the Ethernet route would have lower metric since it is faster than WiFi. I have omitted metrics here for simplicity.

• if you pinged 192.168.1.5, the OS would:

  1. look for routes to 192.168.1.5
  2. find routes 192.168.1.0/24 and 0.0.0.0/0
  3. pick route 192.168.1.0/24, since it has a longer prefix (24 > 0)
  4. see that the route points to the eth0 interface
  5. send the packet over the eth0 cable

  The packet would go through Ethernet (or WiFi, or...) directly to the destination computer.

• if you pinged 74.125.224.163, the OS would:

  1. look for routes to 74.125.224.163
  2. find route 0.0.0.0/0
  3. see that the route has gateway 192.168.1.254
  4. look for routes to 192.168.1.254 that also are reachable directly (without going through a second gateway)
  5. find route 192.168.1.0/24
  6. see that the route points to the eth0 interface
  7. send the packet over the eth0 cable

  The packet would go through Ethernet (or WiFi, or...) to 192.168.1.254 (your home router), which would then repeat the same process using its own routing tables and send the packet to the next hop (your ISP's routers).

(So if you had the same network as Google, you could not reach Google anymore, since the route to your own network would always be chosen first.)

Answer 2

No, your computer will not first attempt to look within your home network for that address. It will look at the routing table.

That table contains rules for the following things

1. Does the IP match an explicitly IP (added with route add -net). Then send it out via this interface
2. Does the IP belong to a network range listed, then send it out over a specific interface.
3. If all fails, then send it out to the default gateway via specified interface.

There is no specific 'internal' vs external' network here in the table.

Typical setups with a single NICm switch and router however usually fill those tables as follows:

1. If it is for myself (localhost 127.x range or own IP) then send it 'out' via the loopback device.
2. If it is for the local network (which it knows since you set up a NIC with both IP address and network mask) then send it out via the local ethernet.
3. If it does not match that then send it to the default gateway (aka your router on the local network).

The computer does not care how the packet arrives at its destination. All it knows, and all it needs to know is what to do locally and delegate the rest.

This might resemble your question a lot, but it is not the packet which know how to travel. It is the local computer, using local routing tables, which decides what should be done with the packet.

---

Now if you set your internal network to 74.125.224.X and try to ping (with updated routing tables) the network stack would recognise you are trying to ping your own IP. You would get an answer to the ping from your own computer. Since you are not google you can forget googling around for answers via the search engine. It would never reach the real google computers.

Communication with them would be impossible, since packets for them would never leave your computer. Instead they will be routed right back via loopback.

Should you disable loopback or tell your computer explicitly to push those packets towards the default router and the internet then you would not get an answer. All other computers still forward their package to the real computer at google, and not toward your network.

Answer 3

Your computer has a subnet mask as well as an IP address. Your networking software uses the subnet mask to determine if an IP address is on your local subnet (and so can be contacted directly) or is on another network (and so must be contacted via your default gateway).

If you change your IP address so that a Google server is in the same subnet as your computer, as defined by the subnet mask, then you won't be able to communicate with that Google server.