Public IP Used Internally

[Dos_Box]

Wasn't there a bit of a 'to-do' a few years back when it was found the UK govt was using global IP's internally.

It turned out they owned a huge block of them so were utlising them, but it transpired many of the systems may have been insecure due to this.

The UK govt sold these surplus IP's recently.

[FN-GM]

Wasn't there a bit of a 'to-do' a few years back when it was found the UK govt was using global IP's internally.

It turned out they owned a huge block of them so were utlising them, but it transpired many of the systems may have been insecure due to this.

The UK govt sold these surplus IP's recently.

 

Thats down the the firewall settings rather than the IP range used. NAT is not for security purposes. In IPv6 most deployments will use public IP addresses internally.

[Opendium_Steve]

Wasn't there a bit of a 'to-do' a few years back when it was found the UK govt was using global IP's internally.

It turned out they owned a huge block of them so were utlising them, but it transpired many of the systems may have been insecure due to this.

The UK govt sold these surplus IP's recently.

 

It was a "to-do" caused by people who didn't understand things.

 

The government were using public IPs internally to connect disparate departments/external contractors/etc over VPNs. The "to-do" was people realising that the IPs weren't globally routable (i.e. although they are public IP addresses, their routes aren't actually announced publicly) and therefore claiming that the government should have been using RFC1918 (internal) addresses. The claim was that the government could then release their IP addresses to relieve the global IPv4 address shortage.

 

What the government was doing was pretty sensible: they needed to link up a number of independently administered networks. Using RFC1918 addresses for this task isn't sensible - with no central authority allocating them, you can guarantee that all those network will have overlapping address ranges, so now you're talking about re-IPing a load of networks. And as you hire new external companies you're going to have to instruct them to renumber their entire networks too. Far better to use public IP addresses that you own, which you can therefore guarantee aren't already in use.

 

The second misunderstanding was the naïve belief that releasing a few IP addresses would somehow "fix" (or even make much of a dent in) IPv4 address exhaustion - really it would have extended the exhaustion date by a few days or weeks, which really isn't worth the hassle (hell, given the amount of network renumbering that would have been involved to free up those addresses, they probably wouldn't have been able to release them before the exhaustion date anyway).

[Opendium_Steve]

Thats down the the firewall settings rather than the IP range used. NAT is not for security purposes. In IPv6 most deployments will use public IP addresses internally.

 

Yes and no

 

If some BGP peer announces a route to RFC1918 addresses to the internet, most ISPs will filter them out, so no harm done. On the other hand, if they are legitimate public IPs which you didn't want to be globally routable and some idiot accidentally announces the routes you'll suddenly find anyone on the internet can talk to them (assuming you didn't have sane firewall rules).

 

Of course I agree that you need proper firewalling no matter what IP range you use internally, and there are enough ways to subvert NAT that it offers no appreciable security in itself.

 

Anyway, my point really was that there are legitimate reasons for using public IPs in private settings if _you own_ them. But in the case Gibson335 described, someone obviously just didn't know what they were doing and picked a random bunch of IP addresses that they didn't own when RFC1918 addresses would have been fine.

 

As an aside, I seem to remember that the RiscOS IP stack expected people to use 1.1.x.y internally, which is equally nuts