TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Strange public IPv4 address assigned behind NAT (2019)

85 点作者 rohan1024将近 5 年前

15 条评论

fanf2将近 5 年前
Microsoft use 25.0.0.0/8 for some of their cloud services: you can see it in mail headers from Hotmail and Exchange Online. (Or could - I have not looked recently to see if this is still the case.) Microsoft stated on the mailop list on 16 July 2016 that they have an agreement with the MOD that it is OK to use these addresses like this. I don’t know if other organisations squatting on this address range have similar agreements...
psim1将近 5 年前
NAT breaks certain things, and broken NAT breaks them further. The specific thing I can speak of is VoIP or more accurately SIP. SIP was designed for the public internet and so there are NAT workarounds, such as: if my interface has an RFC 1918 IP, I’ll use STUN along with certain SIP headers and tags to indicate I’m behind a NAT and need special treatment by the remote SIP agent. Using public IP space as NAT foils this logic entirely.
gruez将近 5 年前
Apparently hamachi also uses the 25.x.x.x ip range for their vpn interfaces[1]. Not sure why anyone would use a random delegated range when there are plenty available, especially the 100.64.0.0&#x2F;10 range.<p>[1] <a href="https:&#x2F;&#x2F;support.logmeininc.com&#x2F;central&#x2F;help&#x2F;about-the-hamachi-virtual-ip-address-central-c-hamachi-virtual-ip" rel="nofollow">https:&#x2F;&#x2F;support.logmeininc.com&#x2F;central&#x2F;help&#x2F;about-the-hamach...</a>
评论 #23827944 未加载
评论 #23827762 未加载
评论 #23829321 未加载
评论 #23827788 未加载
Canada将近 5 年前
I saw this years ago on Rogers mobile devices in Canada. Freaked me out when I noticed it. But then it&#x27;s behind NAT, so whatever. Always wondered why they chose that address space though. Like there aren&#x27;t enough addresses to use in 10&#x2F;8 or 172.16&#x2F;12
评论 #23827994 未加载
评论 #23828606 未加载
评论 #23828469 未加载
mrkstu将近 5 年前
I used to work for a service provider, that solved the MPLS administration problem by hijacking 7.0.0.0 DoD space that wasn&#x27;t publicly routed.<p>By using 7.x IP assigned loopback interfaces in customer MPLS space, we could export just the loopback interfaces into our managment vrfs (without burning our supply of public IPs.) Of course the one problem is that we&#x27;d never have been able to take a Federal contract...
评论 #23830119 未加载
评论 #23831443 未加载
评论 #23828479 未加载
godzillabrennus将近 5 年前
I rebuilt a corporate network for a relatively well known CGI company around a decade ago. They had chosen to use a subnet owned by a big tech company as their internal network. Took me months to convince the CEO that a change was necessary. Ultimately they were unable to download something important that caused them to suddenly care.
评论 #23831608 未加载
nvahalik将近 5 年前
Back when I worked in IT (15+ years ago), I went onsite to a bank that used some seemingly-random &#x2F;20 subnet for their internal network.<p>Turns out that they had some piece of hardware that came with a &quot;hard-coded&quot; IP address (from Japan) and instead of figuring out how to change it, they just used that entire subnet as their internal range.<p>It took me several hours to figure this out as I was working on their Cisco equipment and trying to add sane firewall rules...
评论 #23833844 未加载
评论 #23832704 未加载
lathiat将近 5 年前
This kind of thing seems innocent, but it really isn&#x27;t.<p>Another comment put it as &quot;25.x.x.x is not advertised globally, not announced with BGP, so they&#x27;re using it as private IP space. This works because you will never connect to a 25.x.x.x IP. It&#x27;s just NAT.&quot;<p>That sounds fine but you run into trouble when the owner suddenly starts using the space or it’s reallocated. This has happened quite a lot in the last decade as IP space was ever more in demand and thus ever more scarce. An example is the use of 1.0.0.0&#x2F;8 - allocated to APNIC in 2010 - there is a detailed analysis of the &quot;unintentional&quot; traffic this network was receiving when first used <a href="https:&#x2F;&#x2F;www.potaroo.net&#x2F;studies&#x2F;1slash8&#x2F;1slash8.html" rel="nofollow">https:&#x2F;&#x2F;www.potaroo.net&#x2F;studies&#x2F;1slash8&#x2F;1slash8.html</a> - over 165 megabits in 2010.<p>Among various lazy configs and people using the range as it was convenient I recall there was some default popular Cisco recommended config that used it. Though I can’t find a link right now.<p>Similar problems also happened in the 2007-2010 timeframe as a lot of people used to have static “Bogon filter” firewalls that dropped traffic from unallocated IP ranges (not those marked as &#x27;never to be used&#x27;, just those not allocated yet). As more and more ranges were allocated the people receiving them had all sorts of connectivity problems to random networks because of these old out of date static filters - in my experience as a hosting provider the most common offender was banks hilariously. In practice these filters provided relatively little security and just broke things instead some years after they were put in place. If you had a dedicated team managing your network and constantly watching these kinds of things - hyper-aware the filter was in place and vigilant to update them then maybe it’s a tactic you could use but as static network config that is left and forgotten about it was a terrible idea and I spent a lot of time chasing down working contacts for various networks to get them to fix their firewalls. Meanwhile as far as our customers (trying to use the IP space) are concerned it was our problem since it worked fine should they use another provider. And this was just a network in the 110.0.0.0&#x2F;8 range - no fancy 1.0.0.0.<p>Back to this specific case. If for example we wanted to extend IPv4 a little more and the UK DOD decided to sell or allow this range to be reallocated (since as rightfully pointed out, it&#x27;s not really being used right now) there would be a lot of problems using it because of configurations like this. And you have a bit of a chicken and egg problem in that you can’t really use it until it mostly works but people won’t fix their networks unless people are using it.<p>Hence why sounds kind of innocent but in practice these are terrible ideas and using IP ranges for purposes they are not intended for shouldn&#x27;t be done.<p>This is partly why for CGNAT applications like this a new range was reserved in 2012 - 100.64.0.0&#x2F;10 which is what should be used here. The reason to have a dedicated range for the “ISP side” rather than just using RFC1918 space is so it doesn&#x27;t clash with whatever RFC1918 space the end user wants on the LAN side of their network. If both sides used RFC1918 and accidentally chose an overlapping range then the connection would not work.
api将近 5 年前
The internal use of global but not actually BGP advertised ranges is very common for many reasons.
Sebb767将近 5 年前
This needs a (2019) added, or maybe a link directly to the newer posts.
评论 #23827589 未加载
评论 #23829558 未加载
stillbourne将近 5 年前
Apparently this is a common practice at IBM, I had a friend tell me even the printers are assigned a public IPv4 addr even behind the NAT
blendergeek将近 5 年前
I use Mint Mobile (a T-Mobile MVNO) and I also get an IP Address that officially belongs to the UK Ministry of Defense. I have always found it weird.
exikyut将近 5 年前
Question (if it&#x27;s seen): How can I see The List of all non-BGP-announced address ranges?
mitchs将近 5 年前
C&#x27;mon. Everyone knows that Class E space is the new 8&#x2F;8.
m3kw9将近 5 年前
If it’s behind NAT, anything can be used but best practice is to just the 10s
评论 #23827921 未加载
评论 #23834401 未加载
评论 #23831057 未加载