Why to use public IP addresses within private networks?

Question

I have started to work in a multinational company which has a global network spanning across 4 continents (20 0000+ network devices). I noticed that a lot of end user devices (PCs, laptops) have IP addresses like 22.17.218.151, 124.0.42.16, 35.16.42.11, etc., i.e. public IP addresses. And absolute majority of those devices have the connection to the Internet. I suppose network designers consciously chose to use public IPs inside private networks? But there must be some justification in doing so? In which cases is it beneficial to have public IP addresses within private networks? And what are the downsides/pitfalls of this scheme? What if a company's PC with "local" IP 22.17.218.151 tries to access some 3rd party resource on external network which public IP is incidentally 22.17.218.151 ?

Answer 1

The first thing you need to figure out is whether the public addresses in your network are in fact assigned to your company.

If the answer is Yes, it's likely because those addresses were available to use and address space wasn't an issue at the time. There is no problem in using public addresses, and it has one advantage of making troubleshooting easier.

If the answer is No, then you have a problem. As you point out, if you use someone else's addresses inside your network, you will not be able to reach those addresses on the Internet.

Answer 2

Originally there was no need to conserve IPv4 addresses and NAT did not exist, so it was normal for organisations to number their entire internal networks with public addresses. Some larger organisations were assigned entire Class A addresses. A lot of these have now been reclaimed and the organisations have renumbered with private addresses.

I have seen examples recently were companies need to provide services to other companies and use public addressing even though those services will never see the Internet. These public addresses are used to guarantee uniqueness between the companies so that services that do not respond well to NAT can be shared. This would be on a much smaller scale though, with only key services receiving public addresses and I suspect RIRs would ask for the addresses back if they knew it was used for this purpose.

I have also seen companies use public addressing internally just because they didn’t know what they were doing and didn’t know about private addressing when their networks were first created.

If a company uses addresses that don't belong to the organisation there can be issues when routing to companies that actually own those addresses.

Your addresses are currently assigned to:

22.0.0.0/8 – Defence Information Systems Agency
124.0.0.0/15 – SK Telecom
35.16.0.0/16 – Wayne State University

Does your company have associations to these organisations? One is registered through ARIN, one through APNIC and another looks like defence.

Answer 3

Using "unallocated" IP addresses internally will prevent anyone on your network from reaching the real destinations on the internet that use those addresses, but it's not a vulnerability per se; it's just ignorant behavior.

Using "allocated" Public IP addresses internally is a significant cyber vulnerability.

Simply put, using ICANN public IP internally means that if any point in your network was inadvertently, maliciously, etc. directly connected to the internet, then your subnet or potentially your whole network would immediately become a visible extension of the internet. Everyone on the internet could ping any of your printers, PCs, servers, etc. Traffic from China would route just fine to your printers, PCs, servers, etc.

How would this happen? Well an insider could easily do it in 5 minutes with a MiFi unit. An external firewall could be mis-configured. Phishing could also pull in some interesting code to create an embedded network channel. In short, lots of ways.

If you have this setup, change it asap as you may already have been hacked and just don't know it. How? Your main internet connected firewall(s) need to use NAT and DHCP to hand out private IP addresses in the range 10.X.X.X or 172.20.X.X or 192.168.X.X.

Easy to do, no excuse not to.