Accidental open route to private network on Afrihost ?

[dnetdesign]

I was sitting working on a few of our servers on the 10.0.0.0/24 private network range when my VPN dropped without me noticing.

A few minutes later the web page I was working on turns to an ESXi login page and I am completely stumped, I was thinking something along the lines of one of our ESXi servers getting assigned the incorrect IP address but after a few incorrect logins I started investigating further.

A couple traceroutes and IP scans later and I realize that this is not my network....

Some more investigating further and it seems that Afrihost has a route to the 10.0.0.0/24 network that gets handed off to what appears to be Echo Service Provider ?

I dont know if this is some bizzare routing only affecting me or if others have seen the same ? Perhaps something along the lines of the accidental route that Rain opened a while ago ?

Some further info:

Traceroute which lead to a public IP which lead to a phone number which lead to Echo Service Provider.


5 74 ms 75 ms 76 ms cpt-net1.ip.adsl.co.za [169.1.5.128]
6 43 ms 42 ms 42 ms vlan1221.terjhb-igw2.net.echosp.link [102.67.176.8]
7 41 ms 69 ms 71 ms 154.73.189.6
8 125 ms 119 ms 119 ms 10.0.0.13

 

[access]

oh dear

 

[RonSwanson]

So Afrihost does not do BCP 58? You should also be be filtering these RFC1918 destined packets on your perimeter firewall.

 

[dnetdesign]

It looks like a bunch of cloud hosting servers that there is access to.

 

[AfriFella]

I was sitting working on a few of our servers on the 10.0.0.0/24 private network range when my VPN dropped without me noticing.

A few minutes later the web page I was working on turns to an ESXi login page and I am completely stumped, I was thinking something along the lines of one of our ESXi servers getting assigned the incorrect IP address but after a few incorrect logins I started investigating further.

A couple traceroutes and IP scans later and I realize that this is not my network....

Some more investigating further and it seems that Afrihost has a route to the 10.0.0.0/24 network that gets handed off to what appears to be Echo Service Provider ?

I dont know if this is some bizzare routing only affecting me or if others have seen the same ? Perhaps something along the lines of the accidental route that Rain opened a while ago ?

Some further info:

Traceroute which lead to a public IP which lead to a phone number which lead to Echo Service Provider.


5 74 ms 75 ms 76 ms cpt-net1.ip.adsl.co.za [169.1.5.128]
6 43 ms 42 ms 42 ms vlan1221.terjhb-igw2.net.echosp.link [102.67.176.8]
7 41 ms 69 ms 71 ms 154.73.189.6
8 125 ms 119 ms 119 ms 10.0.0.13

Hey dnetdesign

The routing issue is more of a design that an error because we do work with Echo SP, which is an independent integrator of advanced network. They also work with multiple ISP's

Are you still experiencing VPN issues?

 

[dnetdesign]

Thanks for the feedback. My VPN is fine again but was super confused as to what had happened thinking I was still on my VPN network

 

[AfriFella]

Thanks for the feedback. My VPN is fine again but was super confused as to what had happened thinking I was still on my VPN network

I totally understand. Please shout if you need anything.