Asking ISP for external IP range

Ranjo

I have a customer with a database I need to connect to which is firewalled. I need my external IP address range added to their firewall whitelist.

I contacted my ISP to ask what the range is but they didn't get my question, they only advised about the internal IP assigned by the router, i.e. 192.168.1.1-254

Should my ISP be able to tell me the possible range of my external IP address? It's something like 37.228.249.1 at the moment.

Johnboy1951

This would appear to be what you want

inetnum: 37.228.224.0 - 37.228.255.255
netname: INFRASTRUCTURE-VM-IE
descr: Infrastructure
descr: Virgin Media Ireland
country: IE
admin-c: DH2529-RIPE
tech-c: DH2529-RIPE
status: ASSIGNED PA
mnt-by: VM-IE-MNT
created: 2017-10-27T09:19:18Z
last-modified: 2017-10-27T09:19:18Z
source: RIPE

% Information related to '37.228.224.0/19AS6830'

route:          37.228.224.0/19
descr:          NTL Ireland
origin:         AS6830
mnt-by:         AS6830-MNT
created:        2012-06-20T08:53:51Z
last-modified:  2012-06-20T08:53:51Z

seamus

A lot of ISPs will have chunks of ranges here, there and everywhere, so won't really be able to give you a single range. They might be able to narrow it down to a smaller range based on your location, but that info probably won't be available to CS, they'd have to escalate it to network ops. And there's nothing to stop them changing it in future, and no obligation to tell you.

JohnBoy gives one possible range above. This could change next week.

Chances are they'll just tell you to pay for static IP for yourself.

Safer for yourself and the customer is to connect via VPN when you need to talk to their database. Leaving their firewall permanently OP to an IP range is asking for trouble. Adding the above IP range, for example leaves the firewall exposed to 8190 Virgin Media customers (which could be tens of thousands of individuals).

If this is a permanent connection, then buy a static IP address from your ISP, or set up a server yourself with a static IP in AWS or similar and use that for connections to your customer.

Ranjo

Great thanks. I have actually set up a VM with a fixed IP. It's just a little bit easier from my home PC (mainly in regards to a lot of other project files/etc that are easier to access from home), so was aiming to solve that.

Cuddlesworth

Ranjo wrote: »

Great thanks. I have actually set up a VM with a fixed IP. It's just a little bit easier from my home PC (mainly in regards to a lot of other project files/etc that are easier to access from home), so was aiming to solve that.

To use a analogy.

Your external IP is the same as a address, unique to your house.
Your internal IP on your VM, is like a room within. Unique to your house but doesn't mean anything outside of the house.

If you want a fixed external IP from VM(virgin Media), you need a business line I think.

Ranjo

Thanks Cuddlesworth. The VM I set up is in Microsoft Azure and they offer a fixed IP so that one is all fine, no business line needed or anything, all cloud services.

Based on Seamus' message I'm not going to pursue looking for my ISPs external IP range as it's not fixed and I would also be asking a customer to expose too many IPs which could ultimately change again anyway.

Thanks all.

Johnboy1951

For those who know about this stuff, would the following work? (yes it is a bit much maybe to ask of a customer, but wondering if it would work.)

####

If it were possible to adjust the firewall dynamically it could probably be done using DDNS on your end to make the IP available?

If you set up a DDNS for your connection, and the server end was to ping that DDNS it would return the current IP of your connection which could be applied to the firewall whitelist in place of any previous IP you had.

It would involve running a command at each end timed to suit.

It would require a deal of cooperation as well as the ability to apply it.

It might be worth considering ...... ?

niallb

I think cuddlesworth meant Virgin Media by VM, not Virtual Machine.
If you ask Virgin for a static IP they will tell you what hoops you need to jump through.
I have one for exactly the same reason from Eir - one off setup charge and no ongoing cost as far as I can see.

What kind of VM have you set up in Azure? Are you running your database tools there or from home?
Even a very basic VM could run a VPN server to get you through to the client's network from home.
Creating an IPsec tunnel back to the client's site only requires one IP to be added to their firewall
and allowing you to connect via ipsec or openvpn to your VPS gives a strongly authenticated access point for your PC.

I have a €5 a month 256MB RAM VPS doing something similar. In my case the client's connection is over satellite,
so the costs of providing a visible IP address would have been several hundred extra a month otherwise.
Their router can reach out to my VPS and I can connect to it also. I use OpenVPN rather than IPsec because the router supported it and it's easy to manage, but there are several ways of approaching it.

Do you know what router they are using at their end?

seamus

Johnboy1951 wrote: »

For those who know about this stuff, would the following work?

Yeah, it's a possibility.

At the customer end it's a bit messy though because if the firewall rules are IP-based then the script has to remove the old entry and add the new one. And there may be a refractory period where you have to wait for the firewall to reapply its own rules.

Some firewalls will allow DNS-based rules so the need to update the IP is negated from the customer's side. However, DNS-based rules are slightly less secure than IP-based ones, so the company's own policy might not permit it to be used.

For a scenario where a contractor or other 3rd party does ad-hoc work not requiring a permanently open connection, then a remote access VPN solution is the best.

Johnboy1951

seamus wrote: »

Yeah, it's a possibility.

At the customer end it's a bit messy though because if the firewall rules are IP-based then the script has to remove the old entry and add the new one. And there may be a refractory period where you have to wait for the firewall to reapply its own rules.

Some firewalls will allow DNS-based rules so the need to update the IP is negated from the customer's side. However, DNS-based rules are slightly less secure than IP-based ones, so the company's own policy might not permit it to be used.

For a scenario where a contractor or other 3rd party does ad-hoc work not requiring a permanently open connection, then a remote access VPN solution is the best.

Thanks for the explanation.
I had wondered when writing the question (but did not include it) whether such firewalls could use the content of a variable for an IP address.
I expect not .....

(I might need something temporary like this myself at some stage so just gathering info now )

seamus

A DNS record is a variable

Cloudflare offer free DNS hosting for a single domain. I use this and the Cloudflare API to periodically update a specific DNS record in my domain, to point to my home IP address. It's a python script running on a home server that gets the current public IP for the connection and then updates that in Cloudflare if it has changed.

I did this because I'm too cheap to pay for DDNS when I can just write it myself

Whether a firewall can use this depends on the firewall and the person administering it. DNS-based rules open a risk of cache poisoning or compromised DNS servers allowing an attacker to spoof a DNS record and get access through their firewall.

It can be mitigated against, but some companies will see it as an unnecessary risk to add.

Johnboy1951

seamus wrote: »

A DNS record is a variable

Cloudflare offer free DNS hosting for a single domain. I use this and the Cloudflare API to periodically update a specific DNS record in my domain, to point to my home IP address. It's a python script running on a home server that gets the current public IP for the connection and then updates that in Cloudflare if it has changed.

I did this because I'm too cheap to pay for DDNS when I can just write it myself

Whether a firewall can use this depends on the firewall and the person administering it. DNS-based rules open a risk of cache poisoning or compromised DNS servers allowing an attacker to spoof a DNS record and get access through their firewall.

It can be mitigated against, but some companies will see it as an unnecessary risk to add.

Thanks, so it can work if both ends are amenable.

Ranjo

niallb wrote: »

What kind of VM have you set up in Azure? Are you running your database tools there or from home?

I've set up a Standard_DS12_v2, 4 vcpu/28 GB RAM. I'll be doing some fairly heavy, but not massive, number crunching which is both CPU & RAM intensive. It costs 230 odd a month but will actually spend about 80-90% of the time shut down.

niallb wrote: »

Even a very basic VM could run a VPN server to get you through to the client's network from home.
Creating an IPsec tunnel back to the client's site only requires one IP to be added to their firewall
and allowing you to connect via ipsec or openvpn to your VPS gives a strongly authenticated access point for your PC.

I would love to set this up, but it's beyond my comfort zone. I know some bits & pieces, but not enough ot pick up & set this up without guidance. I'll see if I can google/RTFM, but if you have pointers then I'll try & attack it myself.

niallb wrote: »

Do you know what router they are using at their end?

No I don't, if I do try & progress I'll contact them & get their router details.

niallb

Ranjo wrote: »

I've set up a Standard_DS12_v2, 4 vcpu/28 GB RAM. I'll be doing some fairly heavy, but not massive, number crunching which is both CPU & RAM intensive. It costs 230 odd a month but will actually spend about 80-90% of the time shut down.

It's just the law of the lever. You need to apply a lot more force if you can't control where you put the fulcrum. Getting you connected through to do the work on the machine on their premises should only need 1/2 cores and 256M/512M RAM.

If it's saving your client €200 a month I'd expect they'd be eager for you to put some time into it!

Ranjo wrote: »

... I would love to set this up, but it's beyond my comfort zone. I know some bits & pieces, but not enough ot pick up & set this up without guidance. I'll see if I can google/RTFM, but if you have pointers then I'll try & attack it myself...

If you decide to give it a go, post a thread with a name like "Configuring VPS as VPN server" and I'll chip in. I suggest that putting it on the Unix forum will get much more relevant feedback, but link it from this thread if you do.

It might stretch the RAM requirements out to 1GB, but installing pfsense on the VPS (or even an old physical machine just to get comfortable with it) will give you a really good GUI as well as a choice of VPN platforms.

heffsarmy

Thread is a few months old, but a handy way to expose services running on localhost is a tool ngrok. No need to play around with firewalls, ddns etc. Read the documentation, https://ngrok.com/product