Does it make any difference from a security perspective to use any other IP address ranges than RFC1918 addresses within LAN segments?
-
4Are we to assume that this is for a network that has any reason whatsoever to communicate with any host on the Internet, either now or in the future? Remember, RFC 1918 (and some of its companions) is only relevant on an Internet-connected network; if you are building your all own IP network that does not need to communicate with the Internet, you can of course do what you want, at the risk of confusing whoever comes after you to manage it.– userMar 1, 2017 at 19:58
-
2See also Are there any advantages to using someone else's publicly-routable IPv4 addresses locally?– Michael HamptonMar 1, 2017 at 23:16
Add a comment
|
1 Answer
No, and it will give you nothing but headaches.
What happens when your email server has to email an MTA that just so happens to have the same IP address as a machine in your subnet? Or when that website your user needs to go to has the same IP address as a machine in your network? Default routes are created saying "If this machine doesn't exist in this network, send it to through the gateway to find said machine", but if that machine is found on your network it will never reach the gateway.
I assume one might think that there is a security benefit by using unconventional IP addressing might deter an attacker footprinting your network, when in actuality if he pops a box he's going to look at the IP address scheme and just scan that network. It won't matter if the network is 10.10.0.0/16 or 123.123.123.0/24.
Private address ranges were invented for a reason and not using them provides no additional security benefits. There is a litany of reasons why "Security through Obscurity" is not a sound security concept, so please save yourself the hassle and just use those in the RFC.
-
7Yeah, do not under any circumstances do this. One benefit of RFC1918 is that is isn't (or should not be) publicly routable (avoiding some random stranger getting sent something important). BCP-38 compliant ISPs should also be dropping RFC1918, again, avoiding a number of data leakage issues. Mar 1, 2017 at 15:29
-
11I was contracted to setup a network, and halfway through, the customer asked why I'm using the standard
192.168.0.0/24block internally. He claimed that hackers would know that, and he wanted to throw them off. After a few minutes of arguing, and me assuring him it is not any more secure, he let me set up my way, then changed it as I was leaving. Just shook my head and left... Got called back in a few days later to get the Internet working again. Mar 1, 2017 at 19:37 -
3
-
4@CanadianLuke I think there would be less chance of them noticing if you used something like:
172.29.86.0/24. In all seriousness though, using something other than192.168.0.0/24is a good practice because it reduces the probability of collisions if you ever need to merge two LANs in the future. That concern is actually significant enough that in the case of IPv6 it was even made mandatory to randomize 40 bits of the address when using local addresses.– kasperdMar 1, 2017 at 22:49 -
2Just one point: it doesn't matter if the IP is actually used by any computer on the local network — as soon as the IP is part of the local network range, whether it is actually used or not, traffic for that IP won't get out.– jcaronMar 1, 2017 at 23:34