Hacker News Reader

Comment by kevincox | Hacker News Reader

One minor philosophical question. If you are using AWS PrivateLink because your VPC is not connected to the internet are you really squatting anything? You are just aren't using the public internet. This means that you own the entire address space and can decide what you want to do with it.

Of course it still may make sense to stick to ranges you own in case you need to peer your VPC with someone else, but I don't see much difference between using some random batch of IPs that you don't "own" on the public internet vs any block reserved for internal use. Either can conflict with someone that you want to merge with.

View on HN

That's not really what the author was getting at. The VPC endpoints just provide a way (via TLS certificate authority logs) for the author to discover DNS addresses that they can then use to check for queries and determine what IP addresses are being used in private networks.

They found a number of AWS users that are treating publicly routable IP space as their own private IP space. If someone were to ever offer a public service in that IP space, the company/network using it as private IPs would not be able to access the public service.

The author is trying to understand how prevalent this is, and to what extent of trouble an owner of these IP spaces would have if they decided to host a public service.

I agree with you in general. If you do expect to be able to connect to the public internet and map an endpoint over a public address you are aiming a gun at your foot. However the point I was trying to make was about this quote:

> This is useful since it can remove the need for some servers to have any outbound internet access at all.

My point is that if you are not connected to the public internet at all I don't see why you should be expected to follow the rules of the public internet (who owns what). You can use whatever rules you want for your own private network.

For what it's worth, I've these endpoints in use for VPCs that still had internet access. Meaning that if you attempted to read the "real" internet address you put your VPC subnet on, they would be unreachable.

It's hard/impossible to figure out if the VPC in question has been setup this way. But I agree that it would be likely that most of these VPC with the endpoints on don't have internet access.

However if we assume (dangerously I suppose) that the VPC subnet distribution is similar to other VPCs without private link, we can imagine how many other VPCs are squatting on space that do have internet access!

(Assuming any of this makes sense)

For sure, I'd bet that most of the examples you found were still connected to the internet. I don't think the findings are any less valid I just thought it was an interesting observation that if you are in fact disconnected from the internet there isn't really any reason you should follow the public internet's rules.

>My point is that if you are not connected to the public internet at all I don't see why you should be expected to follow the rules of the public internet (who owns what). You can use whatever rules you want for your own private network.

Hypothetically if you were dealing with a network that had zero access to the outside world then you are right, it doesn't matter. You can use whatever IPs you want and it wouldn't make a difference.

Its a bit of a moot point though since outside of niche situations like high security air gapped networks you don't really see that scenario anymore. Yes, the network at a nuclear missile silo could do that but everyone else is connected to the internet.

This particular survey finds things that are connected to the public internet. For example, the WD NASes used are specifically those NASes whose owners have chosen to connect them to the public internet.

The squatters probably don't intend anything at all evil, but their address use conflicts with access to the general net. If you addresses that aren't yours and you expect to be able to connect to web sites in general, you might by chance use an address that is later allocated to a web site you'll want to use. If you squat on 193.168/16, that's 2¹⁶ addresses and you might block your own access to a few thousand web sites.

I understand you now.

I suppose the argument is you're building a house without a door. While you may believe you have everything you will ever need in that house, there's a likelyhood you will eventually need to leave (or something needs to arrive). Now you're stuck. Of course, it's not all or nothihng when it comes to IP space.

If you were going to use 11.x for an air gapped secure enclave, I would have a very difficult time presenting a scenario where that may bite you later. However, I'd vote to use CGNAT reserved space before any 'unused' public IP space.

This is useful threat intel as well b/c many firms employ source ip address in policy constraints and log monitoring. However it's trivial to masquerade as a target IP address range in a private vpc, and overlap could indicate that someone is up to some tomfoolery.

(FWIW cloudtrail will include source vpc and/or vpc endpoint information when the request is coming through an endpoint. This will help detect those requests)

And you can use IAM policies with VPC endpoints!

I wish AWS would offer an all-in-one VPC endpoint that covered all their services. Of course they're not financially incentivized to do that.

I believe the networking term is "bogon". Basically you're using space in a way that isn't intended. Mostly I've seen it as people trying to use RFC1918 space on public networks probably because of misconfigurations and most routers/FWs will ignore these. This is sort of the inverse.

Not really, bogon is generally used for either unallocated space or "Martian" packets (packets with a source in private space). This space is unannounced, but not unallocated, therefore it doesn't show up on the bogon list.

Here's the team cymru bogon list, for instance: https://team-cymru.com/community-services/bogon-reference/bo...

Yes I didn’t understand this as squatting and made me question if I understood the post. As it is a topic I admit to not being too deeply knowledgeable about.

I think in general the author's definition of squatting is reasonable. I see it to mean "living on land you don't own" or more directly "using IP addresses that you don't own".

My point is about fully private networks that aren't connected to the internet. I would argue that in this case you do own all of the addresses, even if someone else owns them on the public internet.

Thanks. I have a question then.

If you squat as per this definition, can you divert internet traffic designated foe the real IP address to your server?

Or does it only divert it for computers on your network?

The author is only talking about private networks. This does however occasionally happen on the public internet (or when a government turns their country into a private network and does this maliciously). The most common source is "BGP Leaks" which is a fun search.

My favorite example is when a Turkish ISP accidentally declared themselves to be the best route to anywhere, and the whole Internet simply took their word for it.

https://web.archive.org/web/20080228131639/http://www.renesy...

That's like saying if I create a 3D model of my neighbour's car and drive it around the streets of a videogame I am "squatting my neighbour's car" or "using a car I don't own".

Reply on news.ycombinator.com