21

Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet?

e.g. In a similar capacity, the domain name example.com is reserved and can be safely used without risk of this becoming someone's actual domain.

The context is that we have a custom Cloudflare firewall rule which allows access to a web-based system by matching a user's IP address. The user is able to remotely update the IP on the corresponding firewall rule to authorise themselves from another of our systems. We facilitate this update via Cloudflare's API.

Initially, the firewall rule requires a starting IP address which could potentially be in place forever, as we don't know if and when the user will use the system and update their IP. We also want to be able to revoke access after a certain time, by running a server task that resets all the firewall rules to the placeholder IP address again each night.

What should I do here? My first thought was to use a private IP address like 192.168.0.0 but this page made me question this.

Use caution when setting filters to exclude these private address ranges. In some cases, Regional Internet Registries (RIRs) have issued adjacent address space to their customers and that space is in use on the global Internet.

In August 2012, ARIN began allocating “172” address space to internet service, wireless, and content providers

Improve this question
3
  • 3
    what about 127.0.0.1?
    – schroeder ♦
    May 25 at 14:32
  • 7
    Note the "adjacent" in your quote – the entirety of 172 was never reserved for private use, only 172.16.0.0/12 was. What ARIN did is not really comparable to allocating out of 192.168.
    – user1686
    May 26 at 8:49
  • Some nitpicking about your reference to "example.com": This domain is actually intended only for documentation purposes (and for, well, examples). In your case, I suppose you'd rather want a domain name from the ".invalid" TLD - but of course you are looking for IPs and not domain names, so this distinction doesn't matter here
    – Hagen von Eitzen
    May 28 at 8:33

2 Answers 2

Reset to default
36

I recommend using an address in one of the TEST-NET networks (192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24) documented in RFC 5737 and RFC 5735 (link below). Pay attention to the Operation Implications section. These addresses should be non-routable and filtered. Using an address in the 127.0.0.0/8 range would also work if the address isn't assigned to the loopback. More info on Special Use IPv4 Addresses is in RFC 5735

Improve this answer
3
  • 3
    Why the restrictive subsentence about the 127.0.0.0/8 addresses? Even if they used 127.0.0.1 which is highly likely to be assigned to a loopback interface, no harm would ensue (no packet from the external interface of a public router should ever arrive with this address - and if it does, passing that final filter would be the least of their problems)? Or am I misjudging this?
    – AnoE
    May 26 at 13:52
  • @AnoE Plus you're going to trust that any reasonable system will drop any incoming traffic destined for 127.0.0.1 (if nobody dared setting net.ipv4.conf.*.route_localnet).
    – iBug
    May 27 at 16:38
  • 1
    @AnoE I won't use 127.0.0.0/8 for the same reason one does not use localhost instead of example.com
    – Hagen von Eitzen
    May 28 at 8:29
-3

There isn't a good option here. Realistically, if connections can come from anywhere on the internet, they will. I'm not saying IP based blocks are useless, but they're far less-useful than historically.

ANSWER 1 Consider not putting in a placeholder source IP address in. Instead rely on your authentication to control access.

Answer #2 If you absolutely must have something, use an IP address/range that you own, from a block allocated to you by your Regional Internet Registry, and that is actively advertised on the internet. That way you can always pass the firewall deny rules and get access.

Relying on IP blocks and firewalling websites/services based on IPs is old-fashioned now. It is not-yet obsolete, but with dynamic IPs, CGNAT, and cloud services that change IPs, all make IP-based firewalls less-useful.

Separately, the backend should only accept direct-connections from cloudflare (and perhaps your own test sources) and not the internet at large.

Cloudflare's config is where you add protection with categories. EG, if your product will never be used from China, then cloudflare will have regional protections based on BGP.
So explore what CF has to offer and make use of it as long as the additional restrictions don't impact legitimate usage.

Improve this answer
3
  • I know this doesn't specifically answer the question-as-asked but does address the "how do I do this?" implicit question.
    – Criggie
    May 27 at 22:43
  • 1
    Not only does this not answer the question, it's not clear that you understood the context. The IP blocking firewall is CF, not the web backend. People connecting are getting different IPs and using the CF API to update the rule to allow the connection. But they can't update a rule that doesn't exist, so there needs to be a placeholder. What IP should be in those placeholder rules?
    – schroeder ♦
    May 27 at 23:16
  • @schroeder Good point. To rephrase my point "IP based firewalling is an old solution heading towards obsolescence" and the underlying design is flawed, or at best limited. I've expanded the answer to show that better. This might be an XY type question with assumptions.
    – Criggie
    May 28 at 0:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .