2

I’m seeing many logins to my Stack Exchange OpenID account from the private IP addresses 10.7.2.16 and 10.8.2.15. Another of my accounts says that it was logged in from 10.80.0.144. I was under the impression that accessing webpages via the Internet requires a public IP address.

So, can Internet logins occur from the private IPv4 address range (10.x.x.x)? More specifically, I’m curious if this suggests unauthorized login attempts via the Internet or something else, such as internal logins from the relevant servers.

Improve this question

1 Answer 1

Reset to default
1

Well, it can be a misconfiguration of a webserver if the client uses proxy to reach the outer world and proxy adds a header 'Forwarded' - see the wikipedia example here - it can look like 'Forwarded: for=192.0.2.43, for=198.51.100.17' - and it's totally OK for private network addresses to appear in for-part of the header. If the webserver tries to separate users originating from the same IP but having different LAN ip's in an old way - it can result in such a metrics. However, to be fully correct, an external IP address should be shown as well.

Improve this answer
2
  • So, basically, the logs are useless since they allow effective IP spoofing by not recording the (public) IP address that made the request. :/
    – Patrick Dark
    Sep 24, 2017 at 15:29
  • Any misconfiguration is the true reason of fail, and - if misconfigured - not just logs are useless. In logs, if they are left by default config, the IP address is real, so you can read the global, not just public, address
    – Alexey Vesnin
    Sep 24, 2017 at 15:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .