1

Suppose I have two computers in a LAN, and they connect to a router to share a public IP address. One has port 22 forwarded to it by the router. If the second one connects to it using its private IP address (e.g. ssh [email protected]), is it the same as connecting to it using its public IP address (e.g. ssh [email protected])?

By "the same", I mean that the packets are routed exactly the same. I know that the server will see the host as 71.177.17.58 when connecting using the public IP address and 192.168.1.2 when connecting using the private IP address, but does this mean that the packets go outside the LAN in the former case? Or do the routing hardware resolve to the shortest path (through LAN only) first?

2
  • What router? most routers do recognize that the destination address is on the same network and route directly, on other hand I've personally seen the traffic being routed out one hop and back in.
    – Tyson
    Aug 2, 2014 at 18:42
  • I was referring to an average home router. I thought they'd all operate similarly.
    – sudo
    Aug 2, 2014 at 19:03

2 Answers 2

1

The routing is quite different. When you are using the local address, the router just passes the packets back and forth with no translation. This would work if you just wired the two computers together with a crossover cable. You need the router for the external IP address to work.

If you use external address, the router will translate the destination before forwarding the packet. This is known as NAT (Network Address Translation). In this case you would be using DNAT (Destination NAT). Unless the router the router supports hairpin NAT you won't be able to connect to the external IP address from inside your local network. When you are using NAT the router needs to do more work and there may be a noticeable decrease in the speed of the connection.

Assuming your source computer is on 192.168.2.8 and your router is 192.168.2.1 you get:

        Computer 1                    Computer 2
  Source IP   Destination IP   Source IP    Destiantion IP
192.168.2.8 -> 192.168.2.2    192.168.2.8 -> 192.168.2.2   Local address (Direct)
192.168.2.8 -> 71.177.17.58   192.168.2.1 -> 192.168.2.2   External Address (NAT)
                Source IP    Destination IP
                         Router

For returning packets the source and destination IP addresses get reversed.

For connections from the Internet, the type of NAT used depends on the where the connection originates.

        Local Computer                       Internet 
  Source IP    Destination IP       Source IP     Destination IP
192.168.2.2 -> xxx.xxx.xxx.xxx    72.177.17.58 -> xxx.xxx.xxx.xxx   Outgoing (SNAT)
xxx.xxx.xxx.xxx -> 192.168.2.2    xxx.xxx.xxx.xxx -> 72.177.17.58    Incoming (DNAT)
                     Source IP    Destination IP
                             Router
1

Barring some sort of client isolation, with traffic on the local network, the two hosts will communicate directly with each other and will not involve the router at all.

As for accessing the public IP, this will entirely depend on the router. Some routers will allow this traffic and translate it to the internal to the IP. Others will not allow it at all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .