13

Does it make any difference from a security perspective to use any other IP address ranges than RFC1918 addresses within LAN segments?

48

No, and it will give you nothing but headaches.

What happens when your email server has to email an MTA that just so happens to have the same IP address as a machine in your subnet? Or when that website your user needs to go to has the same IP address as a machine in your network? Default routes are created saying "If this machine doesn't exist in this network, send it to through the gateway to find said machine", but if that machine is found on your network it will never reach the gateway.

I assume one might think that there is a security benefit by using unconventional IP addressing might deter an attacker footprinting your network, when in actuality if he pops a box he's going to look at the IP address scheme and just scan that network. It won't matter if the network is 10.10.0.0/16 or 123.123.123.0/24.

Private address ranges were invented for a reason and not using them provides no additional security benefits. There is a litany of reasons why "Security through Obscurity" is not a sound security concept, so please save yourself the hassle and just use those in the RFC.

  • 7
    Yeah, do not under any circumstances do this. One benefit of RFC1918 is that is isn't (or should not be) publicly routable (avoiding some random stranger getting sent something important). BCP-38 compliant ISPs should also be dropping RFC1918, again, avoiding a number of data leakage issues. – iwaseatenbyagrue Mar 1 '17 at 15:29
  • 11
    I was contracted to setup a network, and halfway through, the customer asked why I'm using the standard 192.168.0.0/24 block internally. He claimed that hackers would know that, and he wanted to throw them off. After a few minutes of arguing, and me assuring him it is not any more secure, he let me set up my way, then changed it as I was leaving. Just shook my head and left... Got called back in a few days later to get the Internet working again. – Canadian Luke REINSTATE MONICA Mar 1 '17 at 19:37
  • 3
    @CanadianLuke I hope you changed it to 192.168.255.0/24. – a CVn Mar 1 '17 at 19:57
  • 4
    @CanadianLuke I think there would be less chance of them noticing if you used something like: 172.29.86.0/24. In all seriousness though, using something other than 192.168.0.0/24 is a good practice because it reduces the probability of collisions if you ever need to merge two LANs in the future. That concern is actually significant enough that in the case of IPv6 it was even made mandatory to randomize 40 bits of the address when using local addresses. – kasperd Mar 1 '17 at 22:49
  • 2
    Just one point: it doesn't matter if the IP is actually used by any computer on the local network — as soon as the IP is part of the local network range, whether it is actually used or not, traffic for that IP won't get out. – jcaron Mar 1 '17 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.