Puzzle: PINGing private IP across internet [workaround found]

Question

I'm troubleshooting a client's issues with reaching her office servers. We're using a Meraki VPN and her client machine is Windows 10. Her home IP is 192.168.0.87/24. The server in the office happens to have IP 10.1.10.12. Her computer is getting PING replies from the server's IP but can't browse to it using File Explorer or map drives by IP \10.1.10.12[share] while on the VPN.

I found that when the computer is not connected to the VPN we're getting PING this IP address. We can tracert across this as well:

C:\>ping 10.1.10.12

Pinging 10.1.10.12 with 32 bytes of data:
Reply from 10.1.10.12: bytes=32 time=22ms TTL=60
Reply from 10.1.10.12: bytes=32 time=25ms TTL=60
Reply from 10.1.10.12: bytes=32 time=20ms TTL=60
Reply from 10.1.10.12: bytes=32 time=24ms TTL=60

Ping statistics for 10.1.10.12:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 20ms, Maximum = 25ms, Average = 22ms

C:\>tracert 10.1.10.12

Tracing route to 10.1.10.12 over a maximum of 30 hops

  1     4 ms     5 ms     3 ms  192.168.0.1
  2    19 ms    23 ms    28 ms  10.6.104.1
  3    14 ms    12 ms    12 ms  100.118.110.136
  4    16 ms    11 ms    19 ms  100.118.110.1
  5    23 ms    29 ms    22 ms  10.1.10.12

When connected to the VPN we're getting a slightly different PING response:

Pinging 10.1.10.12 with 32 bytes of data:
Reply from 10.1.10.12: bytes=32 time=10ms TTL=126
Reply from 10.1.10.12: bytes=32 time=11ms TTL=126
Reply from 10.1.10.12: bytes=32 time=11ms TTL=126
Reply from 10.1.10.12: bytes=32 time=11ms TTL=126

Ping statistics for 10.1.10.12:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 10ms, Maximum = 11ms, Average = 10ms

Tracing route to 10.1.10.12 over a maximum of 30 hops

  1     *        *        *     Request timed out.
  2     *        *        *     Request timed out.
  3    11 ms    11 ms    11 ms  10.1.10.12

We have "Use default gateway on remote network" enabled so everything should be going through the VPN when we're connected. I'm baffled about why she's reaching a public IP while not connected to our VPN. We reset Windows and everything worked fine for a day but it's gone back to this. I'm going to be looking into getting her a new laptop and asked her to try on another public network like a library, coffee shop, etc.

Question is why she's able to PING this private IP from her home internet service provider?!

Answer 1

Your traceroute doesn't show traffic actually reaches 'the public internet', all IP addresses in the traceroute output are private, so traffic is all within the client's ISP. And it seems that ISP has assigned these addresses to other devices. They should probably block this traffic, and as Zac67 suggested, it's a good thing to do so yourself.

Answer 2

That may be possible if the ISP ignores RFC 1918 which states that those private addresses must not be routed over inter-enterprise links, ie. over the Internet. Most likely, the ISP uses those addresses internally and doesn't filter them on their access ports as they should (somewhat supported by the tracert output).

In order to prevent sensitive information to leak out (e.g. login credentials), you should make sure that RFC 1918 addresses are always blackholed on the client router towards WAN.

Answer 3

I have a workaround. Weirdness. I found these routing tables before and during the VPN was connected:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1     192.168.0.87     35
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      192.168.0.0    255.255.255.0         On-link      192.168.0.87    291
     192.168.0.87  255.255.255.255         On-link      192.168.0.87    291
    192.168.0.255  255.255.255.255         On-link      192.168.0.87    291
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link      192.168.0.87    291
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link      192.168.0.87    291
===========================================================================
Persistent Routes:
  None

---------------------------------------------------------------

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1    192.168.0.207   4260
          0.0.0.0          0.0.0.0  192.168.205.146    192.168.0.207   4261  
          0.0.0.0          0.0.0.0         On-link   192.168.205.146     36
       10.1.10.12  255.255.255.255  192.168.205.146    192.168.0.207   4261
  [pub ip of VPN]  255.255.255.255      192.168.0.1    192.168.0.207   4261
        127.0.0.0        255.0.0.0         On-link         127.0.0.1   4556
        127.0.0.1  255.255.255.255         On-link         127.0.0.1   4556
  127.255.255.255  255.255.255.255         On-link         127.0.0.1   4556
      192.168.0.0    255.255.255.0         On-link     192.168.0.207   4516
    192.168.0.207  255.255.255.255         On-link     192.168.0.207   4516
    192.168.0.255  255.255.255.255         On-link     192.168.0.207   4516
  192.168.205.146  255.255.255.255         On-link   192.168.205.146    291
        224.0.0.0        240.0.0.0         On-link         127.0.0.1   4556
        224.0.0.0        240.0.0.0         On-link     192.168.0.207   4516
        224.0.0.0        240.0.0.0         On-link   192.168.205.146     36
  255.255.255.255  255.255.255.255         On-link         127.0.0.1   4556
  255.255.255.255  255.255.255.255         On-link     192.168.0.207   4516
  255.255.255.255  255.255.255.255         On-link   192.168.205.146    291
===========================================================================
Persistent Routes:
  None

Four entries were added. I've connected my computer to this same VPN and do not get four entries added to the Windows routing table. I'm not sure how that got added for her. When I manually removed the entry for 10.1.10.12 the mapped drives are working again.

We're going to monitor for a few days and make sure things are stable. I've given her the command for deleting the route just in case and I'll check with her by mid-week and she'll call me if she has anything to report.