Security risk with using internal IP on public DNS

Question

A web server inside the office network which is accessed by staff internally and the internal DNS resolves web.company.com to the server's LAN IP.

Publicly, company.com nameservers belong to their party hosting company where the main company website is hosted and it does not have web.company.com record.

Now if the web.company.com should also be accessible from outside, it is okay to expose our LAN IP in the A record so that only staff with VPN can access; or should web.company.com resolve to the office network external address and use firewall to route to the LAN IP?

Answer 1

Including private IPs in public DNS entries is not ideal because it provides a would be attacker with:

• An indication of what your internal subnets are;
• Actual IP addresses for specific internal resource(s).

Neither are likely to result in a direct compromise, but can assist with an attack or can facilitate onward compromise.

Generally speaking leaking information about your internal network and resources hosted on it should be avoided.

From your question it seems the internal resources are only intended for VPN users so it might be more appropriate to have an internal DNS which VPN users can access this avoids any issues with including 'sensitive' information in public DNS records.

Answer 2

There is another risk using private / LAN IP addresses for public DNS records.

Suppose you have a laptop user in your LAN, who uses web.company.com (which resolves for example to 192.168.178.10).

If this user connects his laptop to another network (wifi!), and tries to use web.company.com, it will resolve to 192.168.178.1 using the public DNS entry. It may be possible that the IP address 192.168.178.10 corresponds to a machine on this foreign network. The laptop will then send information to this machine, which may even include plain text credentials, cookies or other data.

It may even be possible to setup a sort of honeypot using some detailed knowledge of the LAN.

Answer 3

Your description of the architecture and the proposed architecture is a little confusing. If you publish the DNS of an internal IP address on your public-facing DNS then only people on your network or on your VPN are going to be able to reach it. An external party will be able to look up web.company.com and get back 172.168.1.10 but the network they are on won't be able to route traffic to that server. The traffic might go to a 172.168.1.10 but it won't be the right server. The network they're on might have a server using that same IP address.

You might be better off using a real IP for the internal server and having your router direct the traffic back to the internal server (with the appropriate access restrictions). Talk to your network team.

In terms of security it's not great to expose internal IPs externally but it's not horrible. It might assist someone who's trying to attack internal resources from outside by exploiting a vulnerable border service. Okay for a regular commercial network, not okay for protecting my pacemaker or launch codes.