Member Avatar for ingrammusic

I noticed one of our clients was using an IP scheme for their internal network that wasn't one of the 3 groups of private IP addresses. They were using

They haven't had any problems so far, but will this cause any problems in the future?

  • 3 Contributors
  • 2 Replies
  • 274 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by CimmerianX

Dani AI

Generated

As noted, putting a publicly routable block onto an internal network can seem harmless at first. As and pointed out, immediate breakage isn’t guaranteed, but there are several realistic failure modes that make this a bad long‑term choice: route overlap with the real public owner, ISP egress filtering/anti‑spoofing, site‑to‑site VPN and cloud‑connectivity conflicts, unexpected NAT/hairpin problems, and split‑DNS surprises when internal names resolve differently than the public internet.

Recommended practical approach:

  1. Inventory: map every host, server, DHCP lease, ACL, NAT and VPN route that uses the public block.
  2. Pick private space (RFC1918) and plan a phased renumber: DHCP clients first, then servers during scheduled windows.
  3. Update DNS before changing addresses (use short TTLs and split‑horizon where needed), then change IPs and firewall/NAT rules.
  4. Test connectivity (internal and external), flush ARP/DNS caches, verify VPN routes.
  5. Keep backups and a rollback path for each step; document all mappings.

Mitigations when renumbering cannot happen immediately: employ 1:1 NAT or outbound NAT on the gateway, use split‑horizon DNS so internal names point to internal addresses, and isolate the space behind a NAT/VLAN to limit exposure. Monitor the gateway (tcpdump/traceroute) for unexpected egress drops (ISP filtering) and for route overlaps during any peering/VPN events.

Short version: it may “work” now, but renumber to RFC1918 when feasible. If immediate change is impossible, contain the block with NAT/DNS controls and plan a migration as soon as practical.

Recommended Answers

All 2 Replies

Member Avatar for wldake

It would only cause issues if they need to get to and IP address within that range (i.e. thru ).

This IP address range is under LACNIC responsibility for further allocations to users in LACNIC region.  Please see http://www.lacnic.net/ for further details, or check the WHOIS server located at
Member Avatar for CimmerianX

I'm just going to ditto wldake's reply. Using a random public IP as an internal network doesn't cause any issues internally.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.