CIDR: A Prescription for Shortness of Address Space
Another way many companies can expand their pool of usable IP addresses is to take advantage of the private IP addresses set aside for companies and individuals not requiring direct Internet access on all their machines. These numbers can be used as seen fit.
By using a firewall or proxy server that performs network address translation (NAT), called “masquerading” in the Linux community, these machines can still connect to the Internet. The bright side is you won't be routing internal company addresses to the Internet, since most routers are set up to not route these private addresses. Conversely, no one can directly access your systems, so rogue web sites springing up in your company will not come back to haunt you. In order for anyone to access an internal computer, they would have to either log in to the proxy server first, then continue in, or be redirected by the proxy through the server to the designated machine.
The reference for those addresses we can make use of with no prior coordination is RFC 1918, “Address Allocation for Private Internets”, February 1996. These private addresses are as follows (excerpt from RFC):
10.0.0.0 - 10.255.255.255 (10/8 prefix) 172.16.0.0 - 172.31.255.255 (172.16/12 prefix) 192.168.0.0 - 192.168.255.255 (192.168/16 prefix)
Note that under the old classful addressing, while the first address segment is one Class A network, the second would actually be 16 Class B networks, and the final segment 256 Class C networks. By implementing a Linux gateway box and setting up some simple rules in ipfwadm (generally available with all Linux distributions), we can perform masquerading or Network Address Translation, giving all computers on the private network full Internet access. However, those on the Internet cannot get to any of the computers with private addresses unless one of two things happens. One, the administrator sets up the gateway to act as a proxy server; proxying requests on a particular port to a particular computer, or two, by the Internet user using TELNET to access the gateway box first, then on to the internal computers. Thus, private addresses stay private.
These address groups can also be put to use in private networks that piggy back on the Internet. By using two “live” (non-private) IP addresses, one on each network's “gateway” machine, we can tie two private networks together using Linux's IPIP, IP tunneled inside IP. While this won't provide privacy unless the two gateways are running an encryption program such as ssh (secure shell), it can provide a virtual network.
While live Internet addresses are becoming scarce, companies and individuals can maximize use of their current address space and even expand their address space through the use of private addresses. CIDR can also be used to improve security and increase network response time through subnetting.
By staying current with trends in such things as CIDR and Linux's networking software, most obstacles to Internet and Intranet connectivity can be easily circumvented. As CIDR provides everyone with a way to maximize the little we have, private addresses afford us the flexibility to expand beyond those addresses provided by our Internet Service Provider.
Getting Started with DevOps - Including New Data on IT Performance from Puppet Labs 2015 State of DevOps Report
August 27, 2015
12:00 PM CDT
DevOps represents a profound change from the way most IT departments have traditionally worked: from siloed teams and high-anxiety releases to everyone collaborating on uneventful and more frequent releases of higher-quality code. It doesn't matter how large or small an organization is, or even whether it's historically slow moving or risk averse — there are ways to adopt DevOps sanely, and get measurable results in just weeks.
Free to Linux Journal readers.Register Now!
- Hacking a Safe with Bash
- Django Models and Migrations
- Secure Server Deployments in Hostile Territory, Part II
- The Controversy Behind Canonical's Intellectual Property Policy
- Huge Package Overhaul for Debian and Ubuntu
- Home Automation with Raspberry Pi
- Shashlik - a Tasty New Android Simulator
- Embed Linux in Monitoring and Control Systems
- KDE Reveals Plasma Mobile
- diff -u: What's New in Kernel Development