2

I’m seeing many logins to my Stack Exchange OpenID account from the private IP addresses 10.7.2.16 and 10.8.2.15. Another of my accounts says that it was logged in from 10.80.0.144. I was under the impression that accessing webpages via the Internet requires a public IP address.

So, can Internet logins occur from the private IPv4 address range (10.x.x.x)? More specifically, I’m curious if this suggests unauthorized login attempts via the Internet or something else, such as internal logins from the relevant servers.

1

Well, it can be a misconfiguration of a webserver if the client uses proxy to reach the outer world and proxy adds a header 'Forwarded' - see the wikipedia example here - it can look like 'Forwarded: for=192.0.2.43, for=198.51.100.17' - and it's totally OK for private network addresses to appear in for-part of the header. If the webserver tries to separate users originating from the same IP but having different LAN ip's in an old way - it can result in such a metrics. However, to be fully correct, an external IP address should be shown as well.

  • So, basically, the logs are useless since they allow effective IP spoofing by not recording the (public) IP address that made the request. :/ – Patrick Dark Sep 24 '17 at 15:29
  • Any misconfiguration is the true reason of fail, and - if misconfigured - not just logs are useless. In logs, if they are left by default config, the IP address is real, so you can read the global, not just public, address – Alexey Vesnin Sep 24 '17 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.