1

Generally, despite running hardware+software firewall combos and keeping every layer 7 aspect of the box secure, I don't like to disclose the direct IP addresses of our servers to the public as a further layer. That being said in order for mail to be sent most ISPs are requiring that the PTR record for our server match up with an A-name (forward resolving) record. If we do this that would expose our servers IPs because anyone could simply resolve workerx.cluster.x.com to the IP address of our server which isn't very difficult to guess. Is this a serious concern, or is this a fine thing to do?

2

You shouldn't be exposing your server's IP, but your firewall's IP through DNS ...

1

Static translation of IP addresses has some small value in that it makes it more difficult for an attacker to determine the subnet that a host may be on, however that's not much advantage as that information isn't much advantage to the attacker. The security that the obscurity buys is limited. An attacker can still attack the IP as it is visible, and there's only one machine behind it.

Where address transformation does add some security benefit is many to one translations, frequently used in outgoing internet access from home broadband connections to the world's largest companies. In larger setups there may be thousands of hosts behind a single IP address (The firewall or proxy replaces the source IP of all connections to be one single IP and keeps track of which connection is which using session tables), so even if an attacker knows the IP they go out on the real source is obfuscated. An attacker trying to connect to that IP is prevented from getting anywhere by virtue that there's multiple destinations.

  • And see we are using a "one-to-many" system by using anycasting as well as a virtual IP and keepalived all managed and load balanced by HAProxy. So it is a concern for us. – Matthew Salsamendi Oct 1 '13 at 1:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.