2

I have started to work in a multinational company which has a global network spanning across 4 continents (20 0000+ network devices). I noticed that a lot of end user devices (PCs, laptops) have IP addresses like 22.17.218.151, 124.0.42.16, 35.16.42.11, etc., i.e. public IP addresses. And absolute majority of those devices have the connection to the Internet. I suppose network designers consciously chose to use public IPs inside private networks? But there must be some justification in doing so? In which cases is it beneficial to have public IP addresses within private networks? And what are the downsides/pitfalls of this scheme? What if a company's PC with "local" IP 22.17.218.151 tries to access some 3rd party resource on external network which public IP is incidentally 22.17.218.151 ?

  • Are you in control of the network? Can't you tell if your company owns the addresses? As part of your job, you should understand why this was done. – Ron Maupin Jul 20 '18 at 17:24
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:07
2

The first thing you need to figure out is whether the public addresses in your network are in fact assigned to your company.

If the answer is Yes, it's likely because those addresses were available to use and address space wasn't an issue at the time. There is no problem in using public addresses, and it has one advantage of making troubleshooting easier.

If the answer is No, then you have a problem. As you point out, if you use someone else's addresses inside your network, you will not be able to reach those addresses on the Internet.

| improve this answer | |
  • In case my company owns those public IPs, I should see my company's name listed if I searched for 22.x.x.x in google? If so, then no, the company does not own any of those IP address ranges. The IPs I provided in my question are made up (except the first octets of each example). But earlier today at work I tried to search for the actual 22.x.x.x and 124.x.x.x IPs which were assigned to laptops and found out that 22.x.x.x belongs to DoD Network Information Center, and 124.x.x.x belongs to some South Korean ISP. And none of these are the ISPs of our company – kamokoba Jul 20 '18 at 17:48
  • 3
    Wow. If that's true, then that's very poor practice. There will be cases where you make parts of the Internet unreachable. Obviously, it hasn't caused a problem in the past (or maybe it has?). As organizations renumber, this could cause new problems. But as a new engineer, you need to weigh this issue against all the others your organization might have. you may have more important things to worry about. – Ron Trunk Jul 20 '18 at 17:58
2

Originally there was no need to conserve IPv4 addresses and NAT did not exist, so it was normal for organisations to number their entire internal networks with public addresses. Some larger organisations were assigned entire Class A addresses. A lot of these have now been reclaimed and the organisations have renumbered with private addresses.

I have seen examples recently were companies need to provide services to other companies and use public addressing even though those services will never see the Internet. These public addresses are used to guarantee uniqueness between the companies so that services that do not respond well to NAT can be shared. This would be on a much smaller scale though, with only key services receiving public addresses and I suspect RIRs would ask for the addresses back if they knew it was used for this purpose.

I have also seen companies use public addressing internally just because they didn’t know what they were doing and didn’t know about private addressing when their networks were first created.

If a company uses addresses that don't belong to the organisation there can be issues when routing to companies that actually own those addresses.

Your addresses are currently assigned to:

22.0.0.0/8 – Defence Information Systems Agency
124.0.0.0/15 – SK Telecom
35.16.0.0/16 – Wayne State University

Does your company have associations to these organisations? One is registered through ARIN, one through APNIC and another looks like defence.

| improve this answer | |
  • Thank you, Karl, your answer clarifies a lot of things for me. Indeed, my company does provide services to other companies and vice versa (i believe this setup is called Extranet). But no, the company i work in does not have any associations with those organisations that you listed, so that bit remains a bit of a mistery - the IPs belong to the organizations we have nothing to do with yet we use their IPs in our internal network lol – kamokoba Jul 20 '18 at 18:02
  • 1
    Not so much public addresses, but unallocated addresses that later became public. It was a (bad but) common practice in the long-long-ago to use unallocated addresses -- 1/8 being a now infamous case. It was somewhat less common to see companies numbered with their ISP's addresses that simply never renumbered. (eg. I still haven't bothered renumbering my former /28 -- I'll never need to reach the real nodes at those addresses, and it's just me, so meh.) – Ricky Beam Jul 20 '18 at 21:44
-2

Using "unallocated" IP addresses internally will prevent anyone on your network from reaching the real destinations on the internet that use those addresses, but it's not a vulnerability per se; it's just ignorant behavior.

Using "allocated" Public IP addresses internally is a significant cyber vulnerability.

Simply put, using ICANN public IP internally means that if any point in your network was inadvertently, maliciously, etc. directly connected to the internet, then your subnet or potentially your whole network would immediately become a visible extension of the internet. Everyone on the internet could ping any of your printers, PCs, servers, etc. Traffic from China would route just fine to your printers, PCs, servers, etc.

How would this happen? Well an insider could easily do it in 5 minutes with a MiFi unit. An external firewall could be mis-configured. Phishing could also pull in some interesting code to create an embedded network channel. In short, lots of ways.

If you have this setup, change it asap as you may already have been hacked and just don't know it. How? Your main internet connected firewall(s) need to use NAT and DHCP to hand out private IP addresses in the range 10.X.X.X or 172.20.X.X or 192.168.X.X.

Easy to do, no excuse not to.

| improve this answer | |
  • 1
    No, traffic will be not be routed to the network unless announced in BGP. If the company does use BGP to advertise some prefixes to the Internet, yes then a misconfiguration could cause the misused address space to be announced (altough it should be filtered by the upstream) but this cannot happen wit a mobile wifi hotspot. Also "Easy to do, no excuse not to." , not so for a multinational company which has a global network spanning across 4 continents (20 0000+ network devices). – JFL May 18 at 14:38
  • NAT and private addressing has nothing to do with security. Security comes from firewalls, not NAT. The NAT device has full access to the internal network, and compromising the NAT device gives you full access to the internal network, private addressing or not. – Ron Maupin May 18 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.