Address types

Address types

Part of the issue is that the very concept of "public" and "private" addresses isn't really something the network knows about, and we have no protocol to tell applications where the network boundaries actually are.

On the other hand, humans have no problem knowing where the boundaries are, and expect (sometimes unreasonably) that the computer will know which addresses go to their current ISP, and which ones stay within the site.

This is an unresolvable tension in general (and can happen even with IPv4 - for example, in places that are moving towards a "BeyondCorp" setup, but where you still have privileged access to hosts if you're on the VPN or the corporate network, which results in the host having a globally routable address that should be treated as "local", not "public"), and thus the "local network access" restrictions are inevitably an approximation, not perfection.

Now, maybe there should be a mechanism that lets the network stacks tell the client "all of 2001:db8:104::/48 is local" (from a DHCP option, or a router advertisment, perhaps), and lets the VPN client add "and 192.0.2.0/24 is also local", but today that mechanism doesn't exist.

Note: you can avoid this step in the future by logging into your LWN account.