Printable View
on my network we use all 172 (private) addresses. We have no webserver or public IPs whatsoever behind the firewall...
What does this mean for securing this network? isnt all the work then done on the firewall? is that the most important? i guess i am not sure of the implicatuions with this type of network?
No, you still have plenty to worry about.
Spyware, viruses, trojans, disgruntled employees, people walking in off the street, etc. people plugging in rogue wireless access points, misconfigured modems that people can wardial, etc. the list goes on.
The firewall is just a layer at the boarder. Many places have more than one layer at the boarder. The boarder firewall is just a start. (IDS/IPS/VPN/another firewall)....
Your network using private addressing does little to make you secure....what you need to check is the visibility of your firewall's external IP address (the one assigned by your ISP) from outside of the network.
What kinds of access to the net do your users require, does anybody require access to your network from the internet?
What firewall/server are you using?
I'm not sure if this is info you're looking for, but...
Every box in your LAN will have both a private (LAN IP) and public (WAN IP) address. LAN IPs are how other computers and machines within the LAN identifty your computer (in your case the 172.... adresses). Then, each of those computers also has a WAN IP for connecting to the Internet. If I were to successfully ping your computer from outside the LAN, I'd get the WAN IP for it. If I pinged from inside, then the LAN IP.
Obviously then, your firewall's job is to protect access to those WAN IPs, and in regard to IP addresses specifically, that's what you're worried about. Can someone successfully ping you from the outside, thus getting your WAN IP?
(Am I on the right track senior members?)
Nope, every box only needs an internal IP adresss, unless it is connected directly to the internet.
If a computer on a network is directly connecyed to the internet then that will require an external IP, unless it goes through a router/modem in which case the router/modem will have the external ip!
Ok, I was assuming all his are Internet connected. So then I can't ping a specific box within the LAN from the outside world then, right? Because the ping would bring back the WAN IP of the router? I'm still having trouble with that detail myself, I think that's why I can't get my dang VNC to work. :D
You wouldnt necessarily be able to ping a box on a lan unless it is directly connected to the internet.Quote:
If I were to successfully ping your computer from outside the LAN, I'd get the WAN IP for it. If I pinged from inside, then the LAN IP.
However you dont "get" ip's when you ping something, as you need the IP in the first place to ping it!
The ip that you would have would either be the router/modem or the box connected to the internet so you would just ping that, not any internal boxs.
i'm not a senior member, but you aren't entirely on track because if he is using a NAT scheme, the router/firewall knows where to forward the communication based on port... ex: 3 computers behind a firewall, NAT enabled w/ dhcp. computer 1 talking to google, computer 2 talking to yahoo, and computer 3 talking to AO ;) all using port 80, all appearing to be the same IP address, but behind the router the comuters have been moved to ephemeral ports (typically greater than 1024) and the router knows which computer is using which ephemeral port.
Um...right...I was just testing you. You caught that, good for you! ;) Ok, I was trying to get at the point that you'd ping a WAN IP from outside, LAN IP from inside, more or less. Unfortunately, stupid.exe kicked in!Quote:
If you did manage to ping it though you wouldnt get the IP for it, as you would need the IP in the first place to ping it!
Ok, so for example, the business network here is 20+ computers behind one router. So, all I'm going to get for any of those boxes from the outside world is the router IP address, which is one address for the router and all 20+ comptuers connecting behind it rather than 20+ WAN IPs, right?Quote:
The ip that you would have would either be the router/modem or the box connected to the internet so you would just ping that, not any internal boxs.
Most networks that enable all the computers on it to access the intenet will go through a router/modem they wont connect directly to the internet as this would mean they would all need accounts with the ISP that is being used, it would also mean a lot of work for the sys admin as he would have to secure all these computers from outside interfearence!Quote:
[i]I was assuming all his are Internet connected. So then I can't ping a specific box within the LAN from the outside world then, right? Because the ping would bring back the WAN IP of the router?
It just makes too many entry points to a network.
You seem to think that pinging something will get you the ip of it, youyneed the ip in the first place to ping something, otherwise how would you address your ping?
Yeah, and I knew that, but I've been hung in this thinking nonetheless that each computer should have an IP associated with it...So that makes sense, I follow ya.Quote:
Most networks that enable all the computers on it to access the intenet will go through a router/modem they wont connect directly to the internet as this would mean they would all need accounts with the ISP that is being used
Right, I actually do know that, I was just thinking backwards this morning. :D Sorry 'bout that, that's why I made the stupid.exe comment on my part last post.Quote:
You seem to think that pinging something will get you the ip of it, youyneed the ip in the first place to ping something, otherwise how would you address your ping?
Kinda right, you would get the ip for the router or the box that has a direct internet connection and that is all, forget about all the other boxs behind it for now, the ip you get is just for whatever own it, nothing else.Quote:
Ok, so for example, the business network here is 20+ computers behind one router. So, all I'm going to get for any of those boxes from the outside world is the router IP address, which is one address for the router and all 20+ comptuers connecting behind it rather than 20+ WAN IPs, right?
its possible can get the internal ips from/through the router with a SNMP walk type technique or with a bit of further scanning ;-) but i would try to get to grips with the ip addressing system first!
Gotcha, I think you have me all cleared up!
Yes, I am very familiar with the internal IP concept. I just wasnt sure if It "really" made me more secure or not...
I guess i wasnt sure what other implication being a private network would have.
See, and look at what all you started with that innocent little question! ;)
isn't it always the simple questions that get the most responses ;)
O yeah, back to the origional question!!
Does this network have internet access? if so, what way have you configured it to get access?Quote:
Originally posted here by Jason1977
on my network we use all 172 (private) addresses. We have no webserver or public IPs whatsoever behind the firewall...
What does this mean for securing this network? isnt all the work then done on the firewall? is that the most important? i guess i am not sure of the implicatuions with this type of network?
Yes we do have internet access.
we have a T1 with a Cisco 2600 i think...and NAT is running.
Hmm, i've finished all four cisco courses and i did fairly well, but never had to troubleshoot anything yet, as im still a student.
Anyways lemme know if im on the right track, if u have 172 private addresses, and one WAN address assigned by the ISP, You would obviously need a router or switch that all addresses connect too, going into the router from the LAN u would also need a LAN address and on the other side(internet) u'd have the WAN address that is assigned by the ISP. so from the net u'd be able to ping the router, and since the LAN address is prb something like 192. . . u wouldnt be able to actually ping those from the outside.
Thats just my opinion i could be wrong of course, and if i am could someone lemme know