2

Assume the IP address of Google HTTP server is 111.111.111.111, and my computer is assigned with this IP address inside a LAN.


I know that if I visits localhost, the computer knows it's visiting itself, and probably not go ask the router/gateway I think?

But what's going to happen if I visit the LAN IP address assigned by the network administrator, compared to visiting localhost?

Will it go ask the router/gateway about who e.g. 111.111.111.111 is? And could the router fool/tell it that 111.111.111.111 is outside the LAN and tell it go out to find it? More precisely, can NAT routes LAN 111.111.111.111 to the public, real 111.111.111.111?


I am asking this because I think my ISP gives me a public IP as LAN IP address (less possible that I truly connect to that public IP), so I want to know the detail about what I describe above and whether what I ask is achievable.

2

But what's going to happen if I visit the LAN IP address assigned by the network administrator, compared to visiting localhost?

Will it go ask the router/gateway about who e.g. 111.111.111.111 is?

No. Generally, the OS will realize that it owns the destination address, and will not send the packets anywhere outside.

For example, on a Linux system, this happens through the routing table – if you look at the local table, you'll see all assigned IP addreses having /32 routes pointed at the 'lo' interface.

In other OSes such as Windows or BSDs, the mechanism may be more opaque, but the end result is nevertheless the same. (The only exception is when using "jails", "containers", "network namespaces", or "VRFs" – each instance only recognizes its own IP addresses, and not those belonging to other jails/containers.)

Whether the address is "public" or "private" does not matter.

And could the router fool/tell it that 111.111.111.111 is outside the LAN and tell it go out to find it? More precisely, can NAT routes LAN 111.111.111.111 to the public, real 111.111.111.111?

If it exactly matches your computer's IP address – no. The computer won't even contact the router in the first place.

If it's in the same subnet as your computer's IP address – possible, but with difficulties. The router would need Proxy-ARP in addition to NAT. It should be doable with Linux iptables in theory, but I'm not sure if any end-user routers have that feature built in.

I am asking this because I think my ISP gives me a public IP as LAN IP address (less possible that I truly connect to that public IP)

It is normal that ISPs issue public IP addresses, and that's because ISPs do not generally issue LAN IP addresses: that's the job of your router. The ISP only provides initial configuration for that router (and only if the device itself is ISP-provided). The router itself, of course, gets its address from the ISP.

It is possible that the provided device is actually just a bridge (or a router in bridge mode), in which case receiving public IP addresses is completely normal.

That said, some ISPs are known for "borrowing" previously-unused IP space. For example, the range 1.0.0.0/8 sat nearly-unused for many years (until CloudFlare picked it up), so various network admins sometimes decided to use it as an extension of the standard private address ranges. In those situations, best to contact customer service and submit a specific complaint that you're unable to reach some specific service at the overlapped addresses.

(Note that the range 100.64.0.0/10 is not public, quite the opposite. It's a private range meant to be used strictly between the ISP and its customers, in situations where they don't have any public IP address.)

| improve this answer | |
  • 1
    Note: cloudflare has 1.1.1.0/24 and 1.0.0.0/24 (obtained under a special arrangement with apnic), not the 1.0.0.0 prefix as a whole. Other parts of that prefix are assigned to regular ISPs. – plugwash Jul 3 '19 at 20:03
  • Thank you so much for your detailed explanation. I totally get what I want from your answer. Btw, how do I see that "if you look at the local table, you'll see all assigned IP addreses having /32 routes pointed at the 'lo' interface." you describe? I run sudo ip route (I am using Ubuntu), and I only get : – Rick Jul 4 '19 at 1:10
  • default via 192.168.0.1 dev enp3s0 proto dhcp metric 100 169.254.0.0/16 dev enp3s0 scope link metric 1000 192.168.0.0/24 dev enp3s0 proto kernel scope link src 192.168.0.107 metric 100 I don't see any ip with /32 prefix. – Rick Jul 4 '19 at 1:10
  • My question is based on my actual experience I encoutered.Why can my ISP use 172.39.x.x as local network IP?. Take a look if you're interested (opnions are appreciated of course :D). Without more information or confirmation from my ISP, I really can't tell whether I am truly connecting to that public IP or not. – Rick Jul 4 '19 at 1:17
  • @Rick: Do you mean the appearance that your ISP (China Mobile) uses 172.39.0.1 in what appears to be the ISP's internal network? That seems to be a completely different situation from what you've asked here. – user1686 Jul 4 '19 at 10:10
1

The DNS mechanisms set up by your network administrator are what your computer will use, as the routing will go through their infrastructure before it will hit any sort of external DNS. So, if your admin has for some reason assigned an internal IP address that they shouldn't have, and that IP address would normally go to an outside location - your computer is going to be routed to that internal system.

While there are a few different methods for ISPs to assign public IP addresses, the simple answer is that they are not going to give you an IP address used by another external place. Most of the time this is handled by DHCP, so once a public IP has become inactive or its lease has expired, that IP will likely be reassigned anyway (this is one good reason why DNS is important - especially if you're not some major corporation with a block of static IP addresses).

So to reiterate a little differently: if your router is telling your computer that 111.111.111.111 is outside your LAN, your computer will follow that route out until an external system sends it to 111.111.111.111 (if it exists), which should only be assigned publicly to one place.

There are standards governing IP address allocation, and plenty of other rules if you're interested in researching further.

| improve this answer | |
  • 1
    To add to this answer, you can create DNS entries on the host operating system, or on the router acting as a gateway to redirect requests locally. +1 – Tim_Stewart Jul 3 '19 at 17:57
  • 1
    and if you really want to dive in - manipulating/poisoning those entries on a host system is a type of attack called DNS spoofing when done maliciously! – mael' Jul 3 '19 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.