Rfc 1918
RFC 1918, which can be downloaded from http://www.ietf.org/rfc/rfc1918.txt, states that a block of addresses has been permanently set aside for use in private intranets. Many organizations today use RF 1918 addressing inside their organizations and then use NAT to reach the public Internet. The addresse: RFC 1918 sets aside are these:
172.16.0.0172.31.255.255 (172.16/12 prefix)
192.168.0.0192.168.255.255 (192.168/16 prefix)
The basic idea of RFC 1918 filtering is that there is no reason you should see RFC 1918 addressing from outside your network coming in. So, in a basic Internet design, you should block RFC 1918 addressing before it crosses your firewall or WAN router. An ACL on a Cisco router to block this traffic looks like this
IOS(config)#access-list IOS(config)#access-list IOS(config)#access-list IOS(config)#access-list IOS(config-if)#ip acces
101 deny ip 10.0.0.0 0. 101 deny ip 172.16.0.0 101 deny ip 192.168.0.0 101 permit ip any any -group 101 in
255.255.255 any log 0.15.255.255 any log 0.0.255.255 any log
This ACL stops any traffic with a source IP address in the RFC 1918 range from entering your site. Also, your Internet service provider (ISP) should be blocking RFC 1918 addressing as well; check to make sui it is.
I had a conversation once with the administrator of a popular website who was the victim of a distributed denial of service (DDoS) attack that was launched entirely from RFC 1918 address space. If only his ISP had blocked this space, his website would have been unaffected. You can bet he had some choice words for the ISP after this attack!
One consideration with RFC 1918 addressing is the headaches it can cause when you need to connect to another organization that uses the same range of RFC 1918 addresses. This can happen through a merger or in an extranet arrangement. To at least slightly reduce the chances of this, pick addresses th aren't at the beginning of each major net range. For example, use 10.96.0.0/16, not 10.1.0.0/16.
Continue reading here: Figure 613 RFC 2827 Filtering
Was this article helpful?