Does it make any difference from a security perspective to use any other IP address ranges than RFC1918 addresses within LAN segments?


1 Answer 1


No, and it will give you nothing but headaches.

What happens when your email server has to email an MTA that just so happens to have the same IP address as a machine in your subnet? Or when that website your user needs to go to has the same IP address as a machine in your network? Default routes are created saying "If this machine doesn't exist in this network, send it to through the gateway to find said machine", but if that machine is found on your network it will never reach the gateway.

I assume one might think that there is a security benefit by using unconventional IP addressing might deter an attacker footprinting your network, when in actuality if he pops a box he's going to look at the IP address scheme and just scan that network. It won't matter if the network is or

Private address ranges were invented for a reason and not using them provides no additional security benefits. There is a litany of reasons why "Security through Obscurity" is not a sound security concept, so please save yourself the hassle and just use those in the RFC.

  • 7
    Yeah, do not under any circumstances do this. One benefit of RFC1918 is that is isn't (or should not be) publicly routable (avoiding some random stranger getting sent something important). BCP-38 compliant ISPs should also be dropping RFC1918, again, avoiding a number of data leakage issues. Commented Mar 1, 2017 at 15:29
  • 11
    I was contracted to setup a network, and halfway through, the customer asked why I'm using the standard block internally. He claimed that hackers would know that, and he wanted to throw them off. After a few minutes of arguing, and me assuring him it is not any more secure, he let me set up my way, then changed it as I was leaving. Just shook my head and left... Got called back in a few days later to get the Internet working again. Commented Mar 1, 2017 at 19:37
  • 3
    @CanadianLuke I hope you changed it to
    – user
    Commented Mar 1, 2017 at 19:57
  • 4
    @CanadianLuke I think there would be less chance of them noticing if you used something like: In all seriousness though, using something other than is a good practice because it reduces the probability of collisions if you ever need to merge two LANs in the future. That concern is actually significant enough that in the case of IPv6 it was even made mandatory to randomize 40 bits of the address when using local addresses.
    – kasperd
    Commented Mar 1, 2017 at 22:49
  • 2
    Just one point: it doesn't matter if the IP is actually used by any computer on the local network — as soon as the IP is part of the local network range, whether it is actually used or not, traffic for that IP won't get out.
    – jcaron
    Commented Mar 1, 2017 at 23:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .