5

Using a bridged router so that I can set the IP settings directly on the gateway server. We have two such routers for two different IPs (we needed a secondary IP but the ISP only provided it through a new subscription.. I know, right?).

These are internet lines that we're not using anymore after two 20-24 hours downtime periods (ISP's fault) and waiting for the ISP to disable them (it's been two months already).

Last week I checked if the internet was disabled on one router (cable into the laptop and manual settings) and it had lost the bridge setting - happened before, works only on auto-settings. Then I tried the manual settings on the 2nd router and it worked as expected - bridge working.

Then I had the idea to try the public IP of the first router into the second. And it worked without issues. After I checked again to make sure I saw it right, I tried 3 more IPs from the same range (not ours this time, but for as little time as needed to test it worked) and it worked the same way. I could assign almost any public IP to my laptop through the bridged modem.

Isn't this a security issue? Probably a weak configuration issue resulting into a security one.

I thought the public IPs should be tied to the MAC address of the modem or something like that.

Should I report this? This is a major ISP in my country but previous experience showed their high level of incompetence so that I think it's useless telling them.

Improve this question
6
  • I can't figure out what your question is. It sounds like you have an ISP you aren't using and you're wondering whether you should report ... something. But you haven't explained enough about your configuration for anyone to guess what problem might exist, or what resolution you might want.
    – Jeff K
    Dec 21, 2017 at 19:28
  • 1
    I think the issue is being able to set the public IP of one router on the other one and the system not detecting and stopping this.
    – jrtapsell
    Dec 28, 2017 at 20:14
  • @jrtapsell exactly
    – Denis.C
    Dec 29, 2017 at 22:28
  • I would think that the main issue would be if you can take over a 'live' IP, while either another user was using it, or straight after they stopped using it
    – jrtapsell
    Dec 29, 2017 at 22:47
  • I could do both with the two routers I had then. As they were different internet lines I was able to test both scenarios.
    – Denis.C
    Jan 2, 2018 at 15:22

2 Answers 2

Reset to default
1

I assume this is a DOCSIS cable ISP. It can be a bit of a security issue. It's just like having an IP address conflict on a LAN. DOCSIS cable can use ARP just like a LAN. If that IP address that you assigned is also being used by another host on the network, then that other host will loose connectivity while your host is working. You could host services that trick users in to connecting to you instead of the other host, or you could obtain some incoming packets that are intended for the other host.

A bigger concern is if baseline privacy (encryption) is enabled on the cable network. If it isn't, then this issue probably not important compared to that.

Improve this answer
0

What's going on technically is simple ARP announcement. The overall purpose of the Address Resolution Protocol is to allow users to announce what L2 (MAC) address corresponds now to their L3 (IP) address.

From the network engineering point of view, it's rather convenient, because you might want to change your router at some point, and this way you won't need to bother your ISP's tech support to update a MAC address in their policies.

Next, you're on a L2 network with your provider, connected via cable, ARP events are probably being logged, and in case you'll cause a downtime for another customer they'll track you down easily. Most ISPs out there don't consider this threat seriously.

Of course, there's always a possibility of a human error, and setting up a dedicated VLAN for each customer and enforcing a set of addresses that could be present in each VLAN is better and prevents possible connectivity issues for all customers in case one of them is mistaken, but it also means more work for the ISP's NOC. So it generally depends on how much of an uninterruptible connectivity your ISP guarantees in its Service Level Agreement.

As your former ISP allows themselves for a 24 hour downtime, I can figure out that their SLA is rather weak. Hopefully your new ISP promises better delivery (yet probably costs you more).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .