Slashdot Mirror
Using RFC 1918 IP Addresses on Internal Routers?
braek asks: "Our network has expanded to the point that I have about 6 separate
network links to remote networks. I would like to avoid using public IP addresses for the routers to conserve my limited global IP addresses, and I don't expect any additional IP's for a while. :(
What do you guys think about assigning internal routers a private, RFC 1918 IP address, like 10.0.0.1 or something? (For security, RFC 1918 addressess would be filtered at the border routers.)"
"I am testing this right now, and routing seems to work fine, the only problem I can think of, is when someone does a traceroute, it will show up like:
10 120 ms 131 ms 120 ms 152.63.67.97 11 130 ms 130 ms 131 ms 66.141.21.1 12 * * * Request timed out. 13 130 ms 130 ms 140 ms 66.141.21.185Hop 12 is the router with the private RFC 1918 address, and I am assuming it is not responding to a traceroute because the IP is not globally routable. However, all the clients behind the router have complete, unabashed network access. What problems may one encounter if implementing this kind of addressing scheme?"
/. is a commercial entity. goto slashdot.com
When I traceroute from my Road Runner Pro connection (which uses statically-assigned routable IP addresses), I see at least one 10/8 network:
Technically, this is the Wrong Thing. Likewise, your routers should never respond to or generate traffic using RFC 1918 addresses.
I'm proud of my Northern Tibetian Heritage
That should work fine. the drops in the traceroutes are due to the fact that the 10.*/internal network addresses can't reply to the trace through the internet. It makes life easier to troubleshoot if you have real ips however. You may want to consider asking for some more IP addresses if you really, really care.
You'll just need to use the 'shared network' statement (or equivalent if you are not using ISC's dhcpd) to take care of this.
Shut up, be happy. The conveniences you demanded are now mandatory. -- Jello Biafra
Caused no problems for me, other than the traceroute issue you mention (since 10.0.0.0/8 is dropped by most internet routers as it's not supposed to ever be there) and windows doesn't like using a router in the subnet other than it's primary IP as a default route. For example, I give my windows box a public IP, but the router is 10.0.0.1 (to conserve an address), I have to go to the command line and add a static route every time I boot up. Note there might be an easier way to do this in NT, but in 9x this seems to be the only way around that problem. Of course in most unices we have startup scripts to do this for us (networking isn't up when autoexec.bat is run under 9x). I guess you might be able to script soemthign to do this under 9x too though (at least I should hope you can).
--MonMotha
All of our corporate offices use 1918 IP's for every single machine in every office, except for mail servers, remote access servers, and the firewall that we all go through to get out to the Internet.
It is possible, and it is a very good idea. If you have a web presence, this can also allow you to easily add a security layer from your datacenter (least trusted) to your office space with internal file servers (most trusted).
It's a mystery to me why this isn't considered mandatory. People sweat blood building firewalls and packet filters and block off port numbers that people need -- and the kiddies still find a way through. Using a private network space is the ultimate access control -- for anyone outside your network, internal machines simply don't exist.
Since most routers (should!) drop packets from or to non-routable address-space, you might run into problems with MTU-discovery and the like, which are a real bitch to debug. Also things like ECN may break. Somebody's public transfernets in private ip-space gave me headaches more often than not, which is already too much.
I'd advise to choose clever subnetting and NATing of your available space, it will save you and the rest of the net lots of pain, although private space might seem to work smoothly at first. The problems will show up when you least need them, but they will.
I thought that was what the 1918 addresses are for? We use a whole crapload of them (10.*s, 172.16.*, 192.168.*) for both internal/external segregation, as well as additional 'real VLANs'...for example, seperating our storage networks (192.168.10.0) from our 'normal PC net' (10.48.0.0). It works wonderfully!
See http://www.cisco.com/warp/public/701/20.html for some more information.
But I was comparing the private network approach with the firewall approach. Neither would hold up with an internal system comprimised. Indeed, it's hard imagine a security that would.
There isn't really a problem with what you are doing, the only thing I don't really like about doing this is the management aspects when the implimentation gets a little large. More on that in a bit but first, technically, the golden rule here is as long as these addresses are of course unique and stay in your own AS you'd be fine, I'd personally go one further and would keep them only in your IGP just to be safe in case someone screws your bgp filters etc.
/31 subnets are available in newer IOS revisions. At the end of the day I don't know how large you're network and it's exact design, its your choice at the end of the day, just make sure it won't bite you in the ass in the future.
I'm a CCIE and been networking 11 years now, 6 with Cisco and I'd only do this is if I really had too and here's why: management of address space. I'm sure (hope) your management of all your public address space is organised and clear. Furthermore nobody would dream of adding a box to the network with a public address without asking you or another admin who would assign one, which case you would go to your speadsheet (or QIP / another tool), allocate one and record the details. With private address space people tend to just add boxes and subnets and pick an address from random out of the air. This is where time consuming issues come about with overlapping address space. If your network is going to stay small and you have full control over all the addresses then you shouldn't have much of a problem but if the network is going to grow a larger, think about the extra admin you might have to do and also if you were to be hit by a bus would the next guy understand it.
You have some cisco semi-hacks to help you out also such as unnumbered links and also note
A journey of a thousand miles starts with a brutal anal raping at airport security
The whole purpose of the RFC 1918 "private networks" was to allow companies to connect to the internet without having to have a "registered" ip address for every machine on there network. It was also implemented to help prevent people from grabbing random addresses like 3.0.0.0 and using them for there internal addresses.
Companies will then use the private addresses on there internal networks. This concerves the public addresses for the direct addressing on the internet.
Routers will route anything that they are not speciffically told not to. The general consensis is that you should not route private addresses past your border routers (ie to the outside world). Likewise you can't expect that anyone will be able to get to your machine if it have a private address. ie. 10.1.1.1.
The only people that expressly don't route private addressing are the core internet people. This is done usually done by filtering out these addresses at the edge of each of the large internet providers. Typical firewalls will filter out private addressing as well.
Don't assume just because you are using the private addressing on your network that you are safe. This is simply not true. Generally if you are using private addressing on your internal network there is a router or firewall between you that converts your private address into a registered one(NAT). Someone that is paying attention at this point will figure out that if the core providers filter out the private addresses and if I am on a machine with a private address that I won't be able to go very far on the net(unless there is a address translation inbetween).
There are several ways that NAT's can be assigned one is dynamic (more secure) and one is static. I assure you that if your machine has a statically assigned NAT address and there is no firewall between you and the net that your machine might as well be on the net directly.
Subject: Should isp's use private addressing? Well this is a hard question to answer. If they have a office lan that is behind a firewall that very well could be privatly addressed...
Should they use private addresses on interlink segments. Personally I say no because I really hate it when traceroutes don't return addresses. Although if you want to hide a couple of routers or firewalls in your path it's not a horrible way to do it.
Private networks and security: The only security that private networks provide you is this. If the people that are trying to hack into you are beyond a firewall or provider that filters private networks your are safe until they break into a machine on your network that has registered addresses. Then they have as much access as you network will allow. (note that alot of times this machine may be on your network beyond your defences.
Finally: before you decide to inplement large networks that use private addressing you need to think about who you may be connecting to yourself. On a network each machine must have a unique address for life to be happy. If you have a several thousand host network addressed in the 10.0.0.0 range and your company buys another company that alsi uses the 10.0.0.0 range of addressing life can get very very complicated. I know this from experience.
my two cents... I hope this makes sence.
-Geoff Kuchera
I've been doing this WAN/LAN thing since 1982. Ever IP shop save one that I have worked in has used RFP1918 addresses.
I cannot think of a situation, even a single end-point PC, that would not benefit from intellegent and thoughtful use of RFC1918, and even that single PC, if it offers no externally accesses services, has no need for a globally routed IP address of its own.
For all its faults, AOLs use of externally invisible addresses has meant 33 million surfing consumers without wasting routable IP addresses. The masses are (comparitively) secure from DOS and crack attacks, and the technically astute ones can still get little patches that let IP native software on their AOL attached machine work fine.
Even the Mom&Pop dial-up ISP customer, or DSL or Cable subscribers can benefit by only paying for globally routable addresses if/when they want to offer services, or the service provider can simply not offer such routable addresses. The vast majority of home users won't notice the difference.
And anyone with an internal point to point circuit can use RFC1918, anyone who uses a "real" router to link to their ISP (that includes *nix running IPMasquerade) benefits by putting their internal office on RFC1918 address except those few machines that are offering services to the outside world. And if their business depends on it, why are they putting the server in their office anyway? That's what professional datacenters are for.
Of course it can cause problems if done randomly or without consideration that yes indeed this same "10.0.0.1" is used by thousands if not hundreds of thousands of other 'Nets around the world.
However, the benefits of implementing RFC1918 far outweigh the potential problems. At the absolute worst, two sites might have to use masquerade between them to hide the fact that years before they knew they would be working together, they both used 10.0.0.1. That's it, that is the one "danger", and it's little more than another option on the (hopefully used, like a condom) firewall that is also installed between the two offices.
Re-reading, this is in fact a "big picture" spewing on my part. I really wish the "doom and gloom" nay-sayers on both sides, the "We're Running Out Of Addresses" and "RFC1918 Use Is Dangerous" would take cold showers and relax.
Extensive use of RFC1918 is saving lots of money in those places like Asia where routable addresses cost a bundle, and putting off IPv6. Renumbering at some point is the greatest "danger" that any use of RFC1918 can cause, and not using it will require renumbering any time someone changes ISP's anyway. Such is not the case if you're already using unrouted addresses. Something to think about, with the merger/failure cycle in ISP's, ne?
So my advice, do RFC1918 where ever you can!
And for the "I'm Sid, so there" urge, the CCIE "certification" didn't exist yet at the time when I took all the Cisco classes. So There!
Bob-
The Ludwig von Mises Institute. The reasoning individuals economics
RFC1918 addresses will show up any time your ISP uses it.
RFC1918 source/destination packets are dropped at the *edge* routers, not "every" router. By edge I mean AS-Number borders, my experience is that anyone with the technical know-how and need for their own AS-number also usually knows to filter those packets to and from their BGP peers and default providers.
Yes, to and from. For laughs I used to put logging on the border routers, to catch packets to/from RFC1918 addresses, as well as BGP advertizements of RFC1918 address blocks. It was amazing the otherwise reputable ISP's and major companies who forgot to filter those things out! Lets just say that it was one reason for my buying my first AMD chip!
Bob-
The Ludwig von Mises Institute. The reasoning individuals economics
http://www.google.com/search?q=rfc1918+pmtud
This is a topic that has been flamed^H^H^H^H^H debated to death on the North American Network Operators Group(NANOG) Mailing List
Its a great list, and has a lot of very knowledgable people on it.
*Not a Sermon, Just a Thought
*/
...can be broken sometimes if you are using RFC1918 addresses on globally-connected networks. But a lot of people think it's pretty much broken anyway!
My cable modem uses this technique because I was able to ping one of their internal hosts (I'm not 100% sure why) before. Trace route shows the same as step 12
This comes up on NANOG's mailing list about once a week. Search the archives.
The most important thing it breaks is PMTU discovery, which may cause stalls in your IP transmissions through that router.
"I figure you're here 'cause you need some whacko who's willing to stick his finger in the fan. So who are we helping?
I keep getting flammed for saying that private networks are the solution to all your security woes. Which sort of bothers me, because I never said it. All I am saying is that private networks are more effective than firewalls, and less of a pain for your users.
I once worked at a company with a really extreme security policy. It was against the rules to leave your desk without logging out! (Widely ignored of course.) The company firewall was as restrictive as they get. You could use ports 80 and 23 and that was it. No secure sockets (so no ecommerce or banking from work), no Realaudio, nada.
And of course there was a shortage of IP numbers!
Now I work at a place where everybody's on a private net. No fireway to get in my way, no proxy to configure, and no shortage of IP numbers.
this is how you do it on a cisco on your WAN router. (assuming that you know to configure it):
ip nat inside source static 10.x.x.x 12.34.56.78
now you have a static where internally 10.x.x.x is the ip of the router, but the outside world can see it as 12.34.56.78
a quick google search brought up this -- http://www.cisco.com/warp/public/556/9.html
Dont forget about ICMP messages (net unreach, etc...) from other routers you will no longer get. sometimes these are a good thing(tm)
When you use a random 10/8 subnet for some of your internal hosts, then your company buys/merges with/is acquired by another company that is using their own overlapping segment of RFC1918, somebody is going to be stuck with a major renumbering project or a really ugly NAT table.
I just got hit by this last fall. We bought a small company (500 employee), and needed to integrate them into the corporate WAN, but their production LAN with hardcoded IPs scattered all over 172.16.X.X, with everything on a flat /16 netmask (single broadcast domain).
Not fun. Ended up with a huge static NAT table condensing their hosts into a single Class-C of real routable space. Ugly and a pain to maintain.
I do not deploy Linux. Ever.