Network Addresses, Segmentation and NAT

What it is

Network addresses identify devices, and how you organise them decides what an attacker can reach.

An address tells you where a device sits and who it can talk to. Good address planning lets you separate systems into groups, which limits the damage when one group is attacked.

This page covers the address types, how CIDR describes a network, NAT, and why segmentation is a core security control.

How it works

Addresses work at different layers, and each can be abused or used for protection.

IPv4, IPv6 and MAC addresses

An IP address is logical and can change, and it is used to route traffic between networks. A MAC address is tied to the network interface and is used only on the local network. A MAC address can be changed in software, which is called MAC spoofing, so it is not a reliable proof of identity.

IPv6 has its own security needs. Devices often have IPv6 switched on without anyone planning for it, so firewall rules and monitoring must cover both IPv4 and IPv6.

CIDR notation

CIDR (Classless Inter-Domain Routing) writes an address followed by a slash and the number of bits that belong to the network part.

So 192.168.1.0/24 means the first 24 bits identify the network, and the last 8 bits identify hosts. A longer prefix means a smaller network. Small networks are easier to protect and monitor, which is one reason CIDR matters for security.

Public and private networks

Private addresses are for use inside organisations and are not routed on the internet. The private IPv4 ranges are:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

Public addresses are unique on the internet and can be reached from outside. Systems on public addresses are exposed to scanning and attack all day, so they need careful hardening. Private systems are not directly reachable from the internet, but they are not automatically safe, because an infected device inside can still attack others.

NAT

Network Address Translation (NAT) changes the addresses in packets as they cross a boundary. The usual form lets many private hosts share one public address. When many hosts share one address by using different port numbers, this is often called PAT or NAT overload.

NAT has a useful side effect. Outside hosts cannot start a connection to a private host unless a rule allows it, and internal addresses are hidden from the outside. However, NAT was built to save public addresses, not to be a security tool, so it does not replace a firewall.

Network segmentation

Network segmentation divides a network into smaller zones, with controls between them. The zones can be made with separate subnets, VLANs or physical networks.

Benefits of segmentation:

• an infection or intruder in one segment cannot freely reach the others
• sensitive systems, such as payment or HR servers, get stronger rules
• guest and IoT devices can be kept away from business systems
• monitoring is simpler, because traffic between segments can be inspected

Segmentation supports defence in depth and the principle of least privilege. Traffic between segments is normally controlled by a firewall or access control list.