0

My Web API acts as a proxy for users to connect to another server: User ➡️ My Server ➡️ Any Internet Server. They do that by specify a hostname ftp.example.com or 111.111.111.111. I do not want them to mess with my own server by entering localhost or 192.168.1.1 so I think I will blacklist them. Added info: It is safe to assume the server is the only one in the network and by "private network" I meant that server resources (i.e. user should not be able to access the server itself through private addresses).

What is a good list I need to disable? My current list from Private Network on Wikipedia:

// This is the only host name I am aware of
   localhost

// IPv4:
   10.0.0.0     -   10.255.255.255  (10/8 prefix)
   127.0.0.0    -   127.255.255.255  (127/8 prefix)
   172.16.0.0   -   172.31.255.255  (172.16/12 prefix)
   192.168.0.0  -   192.168.255.255 (192.168/16 prefix)

// IPv6:
   ::1

C# implementation thanks to this answer

    public bool IsInternal(string testIp)
    {
        if(testIp == "::1") return true;
        if(testIp.Equals("localhost", StringComparison.OrdinalIgnoreCase)) return true;

        var ip = IPAddress.Parse(testIp).GetAddressBytes();
        switch (ip[0])
        {
            case 10:
            case 127:
                return true;
            case 172:
                return ip[1] >= 16 && ip[1] < 32;
            case 192:
                return ip[1] == 168;
            default:
                return false;
        }
    }

Is there any hole I am not aware of?

5
  • 1
    You should know the addresses of the network interfaces of your server and of your internal network, we do not. Jan 5 at 15:51
  • @SergeBallesta Thanks for pointing it out. It's safe to assume it's the only server in the network. By "private network" I meant the server itself.
    – Luke Vo
    Jan 5 at 15:52
  • 1
    For security reasons, an outbound proxy should not allow connection to any machine on the internal network, whether a server is expected to be active or not. For example Python can be installed on a machine without admin rights, and building a minimal HTTP server in Python is trivial. So IMHO is is not safe to assume that it is the only server in the network. Of course internal clients can already connect there, but if your proxy was to be partially compromised, the harder it will be to reach the internal network, the more time you would have to fix the attack. Jan 5 at 16:02
  • That makes sense. Yes I will add the server local address into the list as well.
    – Luke Vo
    Jan 5 at 16:07
  • 1
    123.456.789.123 is not an IP address, please do not obfuscate badly. You can use the reserved block of 192.0.2.0/24 if really needed. Jan 5 at 17:55

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.