Two networks with two different subnetmasks

Question

This may be a dumb question but I really don't get it.

Let's assume we have two networks. Network A and B. They have the following devices:

• Network A
  • Device X (IP: 192.168.0.10; subnet mask: 255.255.255.0)
• Network B
  • Device Y (IP: 192.168.1.11; subnet mask: 255.255.0.0)
  • Device Z (IP: 192.168.0.10; subnet mask: 255.255.0.0)
• Router that connects A and B

This works out when Device X would send something to Device Y because X would notice that Y is not in his network and would send his message to the gateway. But when Y wants to answer X's message, Y will think that X is in his network because of his subnet mask (255.255.0.0). That would not only be an error but also a security problem because now Z would receive the answer that was intended for X.

Edit: Is this correct? Is this a serious security flaw?

Answer 1

The only flaw here is in configuration.

192.168.0.0/24 is a subnet of 192.168.0.0/16, creating a network address collision. This in turn creates the routing error you're describing, in combination with an additional end-address collision (duplicate 192.168.0.10).

IP addresses need to be unique for routing to work. If you connect two networks with overlapping addressing, that overlap needs to be removed by renumbering one of them. If you can't renumber by any means, you could choose to use NAT with different addressing domains (opening a can of worms).

Of course, if you let an unauthorized party reconfigure your network like that'd be an obvious security issue (letting the attacker in). There are countless ways to attack hosts in a network once you're "in" - what you're describing is just one of them. The point of network security is to not let anyone in that you don't want.