0

The two datacenters 'A' and 'B' that has site-to-site VPN set up, has internal subnets that are colliding. To work-around that I saw that the network team has NATed the IP addresses at 'B' to public IP addresses. Everything works. So, instead of using private IP addresses, clients from 'A' connects to a public IP address in 'B', which in turns gets de-NATed to the original private IP at 'B'. So, when a user at 'A' wants to SSH to a server in 'B', that user SSHs to a public IP address. Network team justifies it by saying it is completely secure since the traffic flies over VPN even though the destination address is a public IP. Is it something widely done across the industry to work around colliding subnets? How good is that from security point-of-view.

1

Yes, it's done quite often. Using public addresses eliminates a lot of problems when connecting multiple networks which use the same addresses in their local networks. If you're connecting multiple networks with the same IP ranges on the inside, things can get very, very ugly with very complicated NAT setups.

Of course, only public IP addresses actually assigned to the networks should be used or you'll probably be blocking some part of the public internet.

  • Wouldn't double-NATing help here to avoid using public IP addresses? Can ISP listen to the traffic if a non-secure protocol is used over this public IP address even though it is over VPN? – Sree Aug 21 '18 at 11:21
  • Double natting only makes things more complex when analysing traffic flows and running services on all ends of the VPN. What do you mean by 'non-secure' in your last question? Using public or private addresses doesn't change a thing with regard to what an ISP can or cannot see. – Teun Vink Aug 21 '18 at 11:36
  • By non-secure, I meant http communication. If I am right, ISP cannot see what passes inside an https connection. – Sree Aug 21 '18 at 12:05
  • You're mostly correct (the ISP should not be able to decrypt the HTTPS traffic), but that has nothing to do with your original question. – Teun Vink Aug 21 '18 at 12:06
  • @haxxor ISP cannot read anything inside the VPN. FTP, HTTP, Telnet, whatever. The tunnel encrypts everything and all data ISP can read is the packet size, destination, and an opaque binary blob. – ThoriumBR Aug 21 '18 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.