0

We have a network with complex network sharing. It is complex to me because I want to understand how it works. Here are the details:

  1. Macbook A connected to the gateway over Ethernet and sharing the connection to Macbook B over Wi-Fi.
  2. Macbook B connected to Wi-Fi with Macbook A and sharing the connection to Windows PC C over Ethernet.
  3. Windows notebook D connected to Wi-Fi with Macbook A.

So I am very confused with this network. How does this work?

  • How are IP addresses assigned to each system?
  • How do we know which system is in which network and which computers can access which other computers?
  • How does a network response reach the correct destination?

2 Answers 2

5

There are two types of "internet sharing" (there may be other types but I am simplifying for the purpose of clarity):

  • Bridging is a technology that basically brings a computer inside an existing Local Area Network (LAN) by using the host computer's Internet connection as a gateway to forward packets on to the LAN. In a bridged configuration, the computer(s) that connect to the bridge are assigned IP addresses within the same subnet (LAN) as the host computer is connected to. For example, if Macbook A were a bridge gateway with an IP address of 192.168.1.2, Macbook B could join the bridged network and obtain an IP address such as 192.168.1.3. They would "be on the same subnet", just as if you physically plugged an ethernet cable into the router or whichever computer/device "owns" (hosts) the LAN.

  • Masquerading is a technology that, essentially, forms the basis of what exactly a LAN is. The terminology is foggy and there are many terms referring to the same thing. In essence, the terms "NAT" (Network Address Translation), "IP Masquerading", and "LAN" (Local Area Network) all involve the same set of technologies. The basic idea is that the machine that "hosts" the NAT is called a router or gateway, and this router/gateway defines a private subnet, for example 192.168.1.x or 192.168.0.x (among others), which other computers can connect to. When the gateway communicates upstream (to another NAT that the gateway itself is underneath, or to the public Internet itself), it translates the IP addresses of computers connected to its NAT into its own IP address, essentially speaking on behalf of those computers to and from the Internet or the upstream NAT.

LANs (NATs or private subnets) can be nested, which means that you can have a long "chain" of NATs. For example, if every one of your computers sharing an internet connection is using Masquerading rather than just creating a bridge, then you could have a NAT structure as follows:

  • A router or cable modem creates NAT 1, which is, say, 192.168.0.x, and forwards traffic "upstream" to the public Internet, which we could say is NAT 0 or the highest layer NAT because it covers all public IP Addresses in the world
  • Macbook A creates NAT 2, which is, say, 192.168.1.x, and forwards traffic "upstream" to NAT 1
  • Macbook B creates NAT 3, which is, say, 192.168.2.x, and forwards traffic "upstream" to NAT 2
  • Windows PC C connects to NAT 3 and Windows notebook D connects to NAT 2

In general, without specific port forwarding configurations, inbound connections (connections to listening services) can only be made up the NAT chain, not down it.

For example, a computer such as Windows notebook D, which is within NAT 2, can directly access an HTTP (Web) or SMB (File) server on any computers within NAT 2, NAT 1, or NAT 0 (the Internet). But it cannot access anything on NAT 3 because it is not visible or routable to it.

Since I do not know the details of exactly how your Internet connections are shared, I do not know for a fact that you have this many NATs actually in place. If one or more of the computers are actually creating a bridge rather than a NAT, then the number of NATs decreases, and the complexity of the network decreases. For example, if Macbook A is actually bridging all the devices beneath it into the router's network, then the NAT structure "collapses" by one layer, as follows:

  • A router or cable modem creates NAT 1, which is, say, 192.168.0.x, and forwards traffic "upstream" to the public Internet, which we could say is NAT 0 or the highest layer NAT because it covers all public IP Addresses in the world
  • Macbook A is a bridge, and forwards traffic "upstream" to NAT 1
  • Macbook B creates NAT 2, which is, say, 192.168.1.x, and forwards traffic "upstream" to NAT 1
  • Windows PC C connects to NAT 2 and Windows notebook D connects to NAT 1

In this case, Macbook A would have an IP address in the 192.168.0.x range, Macbook B would have an IP address in the 192.168.0.x range (and create the 192.168.1.x range), and Windows PC C would have an IP address in the 192.168.1.x range. This is one layer of indirection less.

So as you can see, the more NATs you have, the more isolated your network is, and the harder it is to initiate connections from one computer to another. The most unambiguous network for peer-to-peer communications between computers on the network is to set them all up under one NAT, and have all cross-computer communications involve bridging and not masquerading. The only device that would do masquerading, ideally, is the very last computer/device before the public Internet itself, which is usually a cable modem, router, or DSL modem of some kind. That would put all of the devices on the same IP subnet, such as 192.168.0.x, and they could directly ping each other and access services on each box seamlessly.

If you're confused, here's a visual analogy.

You have two soap bubbles. They bump into each other.

If it's Bridging, the two soap bubbles merge into one, larger bubble.

If it's Masquerading, one soap bubble becomes contained within the other (like drawing a circle inside another circle on paper). This "inner" bubble has the special property that connections can be initiated from within the bubble, destined for anywhere outside the bubble; but, connections cannot come from outside the inner bubble, into a point within that bubble. Well, they can, but that's called port forwarding, and it requires specific, manual configuration, or alternatively, technologies such as UPnP (which is often seen as insecure and disabled).

5

Generally with Windows Network Sharing computer that shares its access acts as a simple gateway, while all clients have automatic configuration to route all IP packets to this default gateway. You can recreate this automatic setup with route add in command-line.

Gateway computer is forced to a fixed IP on this automatic configuration on adapter that provides the sharing and runs simple DHCP service to provide IP and DNS configuration to "clients".

More details are available in Microsoft's own description of this feature.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .