Access to a PAT-ed network questions.

rossonieri#1

does PAT-ed network can be accessed by a static route?
for example :
ip route 192.168.0.0/24 172.16.0.2. -> can it be done?
just wondering
because afaik, it uses ports to differentiate the connection right? well if it can be accessed by a static route - then the concept of PAT/ICS will fall down.

Drakonblayde

well, you can certainly define that all traffic being sent to a certain address will go follow a certain route, but there's no guarentee you're going to get a response. Most routers will drop packets that have addresses that fall in the RFC1918 address spaces.

PAT uses ports to differentiate the connections, yeah, but the ip address itself is being translated as well. The outside world will never see a packet coming from the private space behind the network, all they'll see is the ip address of the interface that's sending the packet outside of the internal network.

I suppose you could try source routing a packet to an ip behind the firewall, but any network administrator who allows that kind of traffic through his network needs to be shot and admitted to hell as it's chief damned soul for such a cardinal sin.