[Godel_unicode]

Wait till he finds out that people frequently use multiple VMs with their own MAC addresses on a given physical box. Especially in the kind of lab where people are working on security projects.

Edit: or that security includes availability in addition to confidentiality and integrity

[milankragujevic]

Eh, at work I either have to assign them pre-approved MAC addresses or get approval for VM MACs, or just use pretend my PC is a router and all VMs get a 100...* IP (10...* is used for the network already).

[Godel_unicode]

Why rfc6598 space instead of one of the other 1918 ranges? I would expect pretending to be a cgn on an internal network to blow up in spectacular fashion.

[walrus01]

I think he means doing NAT on his PC itself (such as is the default network configuration on virtualbox), where it doesn't ordinarily matter what private IP range the VMs are located in. VMs get DHCP leases and a default gateway from the host. The host presents only one IP address and MAC to what it's physically plugged into.

[Godel_unicode]

I know what NAT is, and even if I didn't it was obvious from the post, my question was about the range chosen for the clients. Given that the RFC covering 100.64../10 is specifically for carrier-grade NAT (that's what cgn in my post refers to) I was surprised at the choice to use it instead of one of the other private IP ranges specified in rfc1918, such as 192.168../16.

One place where cgn addressing can trip people up is with DNS; lots of DNS servers (especially the flimsy ones used in lab-in-a-box setups) end up filtering host records for those ranges which can screw up SSH by making the reverse lookup fail, for instance.

Edit: from the text of the RFC -

"""Because CGN service requires non-overlapping address space on each side of the home NAT and CGN, entities using Shared Address Space for purposes other than for CGN service, as described in this document, are likely to experience problems implementing or connecting to CGN service at such time as they exhaust their supply of public IPv4 addresses."""

[walrus01]

I agree that it would be rather unusual to intentionally choose the 100.64 cgnat ranges for guest VMs running on a workstation.

[milankragujevic]

Erm, the VMs see CGNAT, but it doesn't mean anything in my case, but still let's me access other PCs on the company Intranet on 10.x.x.x

[rovr138]

You can usually do NAT and Bridged.

NAT won’t have issues. Bridged will.

Regarding the IP range, on most most hypervisors that’s configurable.