North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: RFC1918 addresses to permit in for VPN?

  • From: Richard A. Steenbergen
  • Date: Sun Dec 31 18:07:14 2000 
On Sun, Dec 31, 2000 at 02:14:54PM -0800, Bill Woodcock wrote:
>
>     > Don't use RFC1918 addresses on as a security measure.
>
> That's the clue people are trying to convey here, yes.  RFC1918 just
> names a block of IP addresses.  IP addresses are just integers.  No
> magic differentiates one from the next.  i.e. there's no inherent
> difference, security or otherwise, between 9.255.255.255 and 10.0.0.0.  
> They're just adjacent integers in a continuous range.

Lets not get carried away. The difference we care about is, one address is
announced and routed from the global internet, and one address is only
used locally. This could just as easily be your real IP space which you're
not announcing (note: this may actually be more useful then rfc1918 space
for some things, like numbering your router interconnects out of such a
block to prevent DoS without breaking icmp messages generated from them).

Using unrouted IPs can be a very key part of a security policy, and if you
want those IPs can be 1918 space. HOWEVER, it must be noted with lots of
red flags and buzzers that this is NOT a complete security policy. For
example if there is any way for an attacker to get on your local network,
globally unrouted IPs won't help you. Also, if you're using NAT hosts can
still be subverted in their external connections (perhaps something on
your network is using MS Outlook for example).

The key thing about this discussion is that it should be common sense.
There is nothing "evil" with using globally unrouted IPs as part of your
security, just as there is nothing "smart" about relying on it and
thinking you're secure. Lets not make the same grossly oversimplified and
underclued statements against 1918 addresses as some people would use in
favor of them.

-- 
Richard A Steenbergen <[email protected]>   http://www.e-gerbil.net/humble
PGP Key ID: 0x138EA177  (67 29 D7 BC E8 18 3E DA  B2 46 B3 D8 14 36 FE B6