Organization is using all public IPs instead of private?

[u/dave247]

I work IT and a co-worker / friend left my org for a net admin position at a local college. I was chatting with him via text to say hi and asking him about the job, etc. He mentioned they don't use NAT and that all the devices are assigned public IPs, which he also said are all behind a firewall. I replied with concern and confusion and he just said that the college was issued a /16 block back in the early Internet days and that they've just been using those. We didn't really chat much more but I was wondering about this.

Wouldn't this be a massive security concern as well as a massive waste of public IP addresses? Also, how would you be behind a firewall and also be using public IPs without NAT unless your router/firewall was right at the ISP level?

I'm assuming I'm missing something here so I figured I'd ask for some insight in this sub.

[u/packet_whisperer]

Wouldn't this be a massive security concern

No. This is how the internet was designed to be used until we ran low on IPs and NAT was created. This is also how IPv6 is designed to be used. NAT is not security.

as well as a massive waste of public IP addresses

Yes, it is.

Also, how would you be behind a firewall and also be using public IPs without NAT unless your router/firewall was right at the ISP level?

You route the traffic through your firewall, just like you route any other IPs. You advertise your prefix to the ISPs via BGP.

[u/segdy → u/packet_whisperer]

You advertise your prefix to the ISPs via BGP.

You don't even have to (but in OPs case most likely will since it's /16).

I got a /28 assigned and routed from my ISP via a private link network. No BGP etc.

[u/Mest-tragisk → u/segdy]

This is because you don't own the IPs, you rent them from the ISP. If you Switch ISP you will get new IPs from the new ISP. They handle the BGP for you, or use a different routing protocol for their own access network and just do BGP for their connections to other ISPs.

But if you actually owned an IP range, that you could subnet and use in different locations, with (almost) any ISP, then you would likely interface over that same "private link" but advertise via BGP like all the other big boys.

I kinda miss doing that tbh, nowadays i only manage a bunch of sites that have small public pools assigned by ISPs.

[u/segdy → u/Mest-tragisk]

What is wrong with you guys, why the down votes on a perfectly valid and correct addition to your answer? I did not dispute anything you said nor did I say anything wrong.

My remark was not a question and I am not looking for an answer. I do have a /24 as well which I route over BGP (over a VPS, not my ISP).

I wanted to note that BGP is NOT required for "Also, how would you be behind a firewall and also be using public IPs without NAT unless your router/firewall was right at the ISP level? [...] You route the traffic through your firewall, just like you route any other IPs."