Re:Ask HN: What is China doing with 1.1.1.1?
by jason_slack on Thursday July 27, 2017 @01:01PM
(#14867196)
I worked for a company once where each department had a public IP space, like 97.0.0.x or 98.0.0.x. When I told the network guy this wasn't proper and we should be using 192.168.x.x or 10.x.x.x he laughed and said "it really doesn't matter, nobody cares". To make all of these networks talk, share, etc they had to use a punch of equipment to tie each one in and then out via a Time Warner Road Runner circuit. This was about 1999 :-)
Re:Ask HN: What is China doing with 1.1.1.1?
by Spivak on Thursday July 27, 2017 @10:25PM
(#14871445)
It seems as though the conventional wisdom has changed, because in my large org every device is assigned a public IP and access is controlled by our border firewall.
It's weird how much NAT has changed the thinking about network organization -- if you have the addresses you should get into the IPv6 state of mind -- publicly address all the things!
Now if your org picked 97/98 arbitrarily without actually owning the addresses relying on the fact that you wouldn't actually get routed any public traffic then that's a different story.
Re:Ask HN: What is China doing with 1.1.1.1?
by corymacd on Friday July 28, 2017 @02:02PM
(#14876203)
I too have worked at organizations that have been configured like this. I speculate that pressure on the limited IPv4 allocations has caused many places that had previously been configured with large public IP blocks, to sell sub-allocations, for profit. NAT certainly does enable this practice but isn't the root cause. Sell those IPv4 blocks for $$$ -- who needs their laptop getting a public IPv4 address anyway?
While that's probably never getting allocated at this point, that's also what everyone thought 10-20+ years ago about 1.0.0.0/8 and yet here we are.
When my organisation was allocated from 110.0.0.0/8 a few years back we were constantly seeking out others to remove us from their "bogon" filters blocking unallocated ranges that were static and not being maintained. Including big organisations like Commonwealth Bank of Australia. It was a real pain. Meanwhile the security advantage of this behaviour is highly dubious in my view - just as easy to steal an otherwise valid but un-used (or even used) prefix.
Thanks for reading my rant this far if you did, I'll return you to your regularly scheduled more insightful comments....... now.