[walrus01]

NIPR and SIPR don't talk to the global routing tables for v4 and v6. Generally if a DOD person needs to access commercial internet resources for things, it'll be through a separate commercial network purpose LAN, or through something like an rdp session to a Citrix thin client to do that.

[chipsa]

I think you'd be surprised. Most NIPR computers just use a regular proxy server for internet access. But example: 214 /8 is a DoD owned block, and "weather.af.mil" is on that block, and both externally and internally reachable.

[walrus01]

Not that NIPR computers don't have access to the internet - but because this isn't 1987, those individual workstations would never have public facing DoD v4 IPs. They'll always be behind some combination of NAT and firewall or as you mentioned, proxy. Certainly there could be some DoD public IP on the external interfaces of said firewalls. If I had to guess very often the public facing side of those boxes might be a commercially acquired local ISP using that ISP's IP space, and not actual DoD IP space...

[chipsa]

I'm logged into my Google account, and it shows a certain IP address as where I'm logged in from. Checking ipconfig shows the same IP address as being the computer I'm on. The proxy will of course show it as being the actual source, but Google is smart enough to show the IP address that the proxy says it's proxying for. AFAICT, there's no NAT, but there is a firewall blocking traffic that doesn't run through the proxy.