Why use private network addresses?

APLawrence.com - Resources for Unix and Linux Systems, Bloggers and the self-employed

Why use private network addresses?

I've removed advertising from most of this site and will eventually clean up the few pages where it remains.

While not terribly expensive to maintain, this does cost me something. If I don't get enough donations to cover that expense, I will be shutting the site down in early 2020.

If you found something useful today, please consider a small donation.

Some material is very old and may be incorrect today

© August 2013 Tony Lawrence

It happens less and less, but I still see systems where people have used public ip addresses for private networks. These systems sometimes even end up behind a NAT firewall and while they "work", problems are out there.

There are several ranges of IP addresses that you SHOULD use for internal, private networks:

10.0.0.1 through 10.254.254.254
172.16.0.1 through 172.31.254.254
192.168.0.1 through 192.168.254.254

This is the subject of RFC-1918, Address Allocation for Private Internets

Let's say you ignore this and just arbitrarily pick some other scheme for your internal network. You have a firewall that happily maps your internal addresses to a real public address, so things do work - until you need to access a site that actually has the address range you incorrectly used for your network. Your packets won't be routed to that site at all, because they are seen by your router as being local.

The opposite side of this is that if you do use the reserved private IP addresses, you can't look them up on the internet to resolve host names. You need to resolve those locally, not look to your ISP's DNS server.

Why is THAT important? Well, programs like telnetd will try to do a reverse DNS lookup when your local machines try to connect. This is often a cause for slow telnets on the local network.

From Telnet/FTP is very slow to connect: Slow telnet or ftp connections are often caused by the server wanting to do a reverse DNS lookup to find out who is connecting. If you aren't running DNS, you can fix this just by listing all the machines in /etc/hosts. Note that you don't have to be accurate about the names: I often use the ip adress with "_" substituted for the "."'s, like "host_192_168_2_3" and so on. A simple script:

#!/bin/ksh
x=1
while [ $x -lt 255 ]
do
echo "192.168.2.$x   host_$x"
x=$((x + 1 ))
done >> /etc/hosts

Understand that being slow to give up on name resolution is an annoyance on small networks and a Good Thing on large networks. Systems that give up quickly work well on small networks, but don't get the information they should have on larger nets.

See Networking 101.

Do you need to renumber?

Are you facing a renumbering problem? Are you looking at renumbering and envisioning horrible pain and massive downtime?

I have a customer using a 210. scheme, so I've been a-googling. - I'm looking for a way this customer doesn't have to pay the piper in full just yet. I haven't found much. I found Issues with Private IP Addressing in the Internet which might offer some illumination or motivation, but no help to make it easier..

It's a nasty problem..

If you found something useful today, please consider a small donation.