Hacker News Reader

Comment by cesarb | Hacker News Reader

> The "magic", as I understand it, of the 192.x.x.x network is that the Internet "knows" to not route it. Networking isn't my strength, so I don't know where, or what part of the my local network decides that 192.x.x.x can't be routed, and so doesn't.

First of all, it's 192.168.x.x, there are other networks which begin with 192 and are not treated as internal networks.

The trick is simple: it's not "the Internet knows to not route it", it's "the Internet doesn't know how to route it". These ranges (there are others, like 10.x.x.x) are reserved for private use, and will never be allocated for an Internet network. Since there's no network announcing it (and if some network mistakenly tries to announce a route to these addresses, they will be filtered since everyone knows there shouldn't be routes for it), any attempt to send a packet to it will go nowhere.

View on HN

> they will be filtered since everyone knows there shouldn't be routes for it

That is why they know they can filter it. However the reason they bother is they often are using those addresses internally in their data center and so if someone else announces it their local network would break.

This is not a correct assumption.

1. RFC1918 space is not "filtered". It is unroutable, because no route exists on the internet.

1a. Effectively, this is the same result, however it is still an important distinction to note: telecom networks rarely ACL or "filter" transit traffic without a) an associated service offering (like DDoS Mitigation) b) a customer request or c) RPF.

1b. Telecom networks do however filter transit routes. RFC1918 routes would be filtered on internet BGP sessions.

2. It is infrequent that RFC1918 space is used internally in telecom networks. It does happen, but it is rare.

> 2. It is infrequent that RFC1918 space is used internally in telecom networks. It does happen, but it is rare.

I have worked at 2 different ISPs... RFC1918 is used EVERYWHERE, including on networks that customers can reach by sending packets through their modems/CPE. I am also familiar with the internal network of 3 others because we closely worked together during a bunch of merger/acquisitions/divestments/territory split-ups.

This caused a lot of fun when one customer ran nmap across all of RFC1918 space and hit internal security systems that were advertised across the ISPs backbone but were not properly filtered for traffic coming from customers because of a bug in a CMTS that failed to properly apply ACL's.

A lot of telecoms avoid it like the plague because: 1. it destroys network observability 2. they have so much IP space they don't even know what to do with it. /30 everything!

Management networks are a different story, but hey, some Tier 1's think they're so large they don't even need OOB anymore! (haha...)

RFC1918 space is perfectly routable, and it is routed all the time.

The fact that is is not routed throughout Internet is another thing.

It's implied in my message that I'm referring to the internet: "It is unroutable, because no route exists on the internet."

Reply on news.ycombinator.com