Risks of using non-private IP addresses internally?

Question

My company has received a large industrial machine with many networked devices on it. Unfortunately the engineer in charge has used a public IP address range on the machine. I'm in Europe. The chosen address range belongs to a USA company. Let's say it's 143.166.0.0 (which actually belongs to Dell).

Let's assume I don't connect the machine to our company LAN (for now) but I do connect my laptop to it to program a device - say 143.166.0.1. Let's also say that my laptop wireless network adaptor is connected to the company LAN and hence to the Internet. Now I have two possible routes to two devices that share an address. The local one I want and the Dell address.

My question is, "How worried should I be?" What should and would happen in this case? My guess is that the local machine would respond first and that I might get away with it but that eventually I will get bitten. Incidentally, I've seen public ip addresses on other machines too. It seems the engineers either don't understand private addressing or don't expect their machine to be connected to the wider world.

Any ideas / comments? (that don't involve violence to the machine engineer)?

Epilogue

We found an interesting problem that has forced us to change the IP addresses to private.

• One of the devices on the machine is programmed via Internet Explorer using an ActiveX component. This device will try to push data to the ActiveX 'listener' (rather than the usual browser mode of requesting data from a remote server).
• Our Active Directory configuration downloads security policies to our computers at login. Included in the policy is the list of trusted sites. These include:
  • Approved company addresses.
  • Various external addresses such as our bank.
  • Private addresses 192.168.0.0/16, 172.16.0.0/20 and 10.0.0.0/24.
  • Everything else is blocked.
• Due to the security policy, the ActiveX component never received any data as the incoming traffic is blocked by the security policy!

This has forced me to have the vendor change the addresses to 172.16.0.0. I'll sleep easier.

Thanks for all the interest.

Answer 1

Short answer: Duplicating allocated public addresses is a bad idea.

Slightly longer answer: Leaving aside the routing issues for the moment, it's not safe to assume that you will never need to reach this machine from some place other than a directly attached cable, or that public or private address allocations are static and will never change.

The remote-access issues are obvious: The global Internet thinks 143.166/16 is in one place, and you want it to be in another. Routers won't go to your machine.

And ownership could change. Even if this address weren't assigned to Dell, it could be allocated to them in the future. Dell does have this address today, but someone else might tomorrow, with a different route. Who knows? Your organization might even buy that address block, with even more routing adventures.

Bottom line: Don't assume duplicate IPs can safely be walled off forever.

As for the routing, your wired interface would prefer the local address over Dell's. Your wired interface would send an ARP request for that address and get it directly from the industrial machine, no gateway required. Thereafter, packets destined to that address would use the destination MAC address of the industrial machine.

That will work fine as you only use a cable for access, and as long as you never need to reach this machine from someplace else, and as long as the global routing table remains static.

That's a lot of ifs. You're better off avoiding the issue by using either a unique public address or something out of the private address pool.

Answer 2

The only issue will be an inability to talk to the real (internet) machines with those addresses. Of course, you can put a firewall ("nat box") between your network and this thing to make it look like private addresses to your network.

This sort of thing has popped up all over the place for many years due to people being lazy and using "unassigned" addresses for their own purposes; now that they're assigned, it presents a small problem.

[Edit: for the record, I never renumbered my home network. but I'm not likely to ever need to talk to the people who now have that address space. 15 years and counting...]

Answer 3

My question is, "How worried should I be?" What should and would happen in this case? My guess is that the local machine would respond first and that I might get away with it but that eventually I will get bitten.

As a side note, it is not about who answers first. If you give your computer an address in the same subnet, the traffic will go straight to the machine, no routers involved.

Even if you would use routing, entering a route to 143.166.0.0/16 on some internal router(s) in your network, they will prefer this route over their (default?) route to the internet. This happens because the "longest prefix match" is preferred, ie. the most specific route is chosen.

Your correct about the net result, the 143.166.0.0/16 part of the internet will be unreachable for you or your network should you install the route in your internal routers. /16 seems a bit large for this issue, the smaller the subnet you route to, the smaller the chance of getting bitten.

Answer 4

Below, is my edited answer - which originally didn't get that it wasn't "owned" IP space, but instead someone else's space.

As long as it's your space, it doesn't matter. An IP address is an ip address. Your applications don't know what's private, and what's public. If you have space, you might even have some subnets which are "internal" and some which are "externally" accessible - controllable with the usual routing controls, firewalls, etc.

All the public space on the inside means is that you don't have to worry about NAT to go in or out of your network.

If it's NOT your own IP space, but someone else's, it can technically work. However you won't ever be able to reach their space without a lot of extra effort and confiuration - such as tunneling, NAT or double NAT, or more specific routing. It would be best to suggest readdressing your network, in writing, and detail how to do it, how it can be managed, etc. Get it in writing, then if there's ever problems, you can pull out your "I told you so email".

The down votes below were from my original answer, in which I misread the question.

Thanks everyone.