Why is RFC1918 space in public DNS evil?
Fred Baker
fred at cisco.com
Mon Sep 18 13:04:55 UTC 2006
> I know the common wisdom is that putting 192.168 addresses in a
> public zonefile is right up there with kicking babies who have just
> had their candy stolen, but I'm really struggling to come up with
> anything more authoritative than "just because, now eat your
> brussel sprouts".
I think the best answer to that is to turn it on its head.
As Joe points out, exposing interior information unnecessarily is a
security risk - leaving a treasure map with "X marks the spot"
invites pirates of all sorts. In this case, it is not only exposing
interior information (the.host.you.want.to.attack.example.com)
unnecessarily, but also in a way that doesn't actually help anyone
else. The address of my telephone is 10.32.244.220. But do a
traceroute to that address (ar the address of my family computer,
which is 192.168.1.20), and I about guarantee that you will come to a
different computer, for the simple reason that you aren't in any of
my private domains.
So putting those addresses in the public DNS actually *only* helps me
if I am someone who is bombarding your prophylactic defenses with
messages intended to reach your chewy innards. Anyone else has no
actual use for the internal addresses.
I think the right question for your client is: "why exactly did you
want to do that?"
More information about the NANOG
mailing list