4 ms·

> Firstly, WebSockets seem to be prohibited from accessing 192.168.0.0/16 and 10.0.0.0/8. In Firefox, it raises SecurityError. And 172.16.0.0/12 I hope. I did

> Firstly, WebSockets seem to be prohibited from accessing 192.168.0.0/16 and 10.0.0.0/8. In Firefox, it raises SecurityError. And 172.16.0.0/12 I hope. I did a little Googling and didn't quickly find a list of sources they are blocking in Firefox (or is it part of the standard?), but I hope that one is included. It's not as common, but it's still a private network and used sometimes.

pdonis 6y ago
> And 172.16.0.0/12 I hope Yes, at least on my Firefox (76.0.1 on Ubuntu). However, Chrome will happily open a websocket to addresses in the 192.168., 10., and 172.16. ranges. It fails for 127.0.0.1, but only because it says there's nobody listening (not, as Firefox does, because of a security error accessing that IP in the first place); for localhost it can actually verify that no service is running on that port, whereas for remote hosts in the private ranges it can't.
- tzs 6y ago
  I don't understand the point of blocking all of 192.168/16, 172.16/12, and 10/8. If the point is to block access to other hosts on your LAN shouldn't it just block the one your LAN actually uses?
  - pferde 6y ago
    What if the my network uses several different local subnets? How would the browser figure that out? No, blocking all these IP ranges is a good idea. After all, these ranges are supposed to not be directly routeable to from the Internet.
    - tzs 6y ago
      > What if the my network uses several different local subnets? How would the browser figure that out? It would look at your computer's routing table. If it is an IP address your computer talks to directly, it is on a LAN your computer is on and would be blocked. If it is an IP address that your computer talks to through a gateway, it is on the internet and would not be blocked. > After all, these ranges are supposed to not be directly routeable to from the Internet. They are supposed to not be directly routeable to/from the public internet. They can be directly routable between non-public parts of the internet. A not uncommon example, especially now, is having a VPN connection between a home network and the internal network of a business, both of which are using addresses in the private ranges.
      - pdonis 6y ago
        > If it is an IP address that your computer talks to through a gateway, it is on the internet and would not be blocked. No, this would just make the security problem worse, because now any website could use websockets to scan, not just your personal LAN, but any network you are connected to through a VPN or any other gateway.
      - pferde 6y ago
        > They are supposed to not be directly routeable to/from the public internet. They can be directly routable between non-public parts of the internet. Sure, but this is different from a VPN. This would be untrusted code downloaded from a remote website talking to unrelated devices on my local network. Effectively, it would be the remote website having free reign inside my local network, with my web browser acting as a proxy (or as a trojan horse, with a bit of exaggeration).
  - magicalhippo 6y ago
    I use both 192.168/16 and 10/8 on my computer. One is for my regular LAN and the other is for my 10G link to my NAS.
  - pdonis 6y ago
    I don't understand the point of not blocking all of those ranges. Why should the browser bother trying to figure out which ones are actually used on a particular LAN? All of those IP ranges are designated as private, and that in itself should be reason enough for browsers to block websocket connections to them.
moonbug 6y ago
Gee, good job no one uses IPv6.
- gerdesj 6y ago
  Shhh the kids are thinking. They'll work it out eventually. My IPX/SPX and pigeon borne packet transfers are all good. I'm using a dual IPv4/6 stack laptop at home with a dual stack IPv4/6 OpenVPN to the office at the moment, with my default gateways forced down the VPN. Silly me, click (disconnect) Oh, no real change in experience.
- icedchai 6y ago
  Consider a /64 subnet will take a while, if not forever, to scan.
  - Dylan16807 6y ago
    Unless you know part of the mac address. Or it's bound to :0:0:0:1. And maybe you already know the IP and the firewall is blocking connections from outside the building.

pdonis 6y ago

> And 172.16.0.0/12 I hope Yes, at least on my Firefox (76.0.1 on Ubuntu). However, Chrome will happily open a websocket to addresses in the 192.168., 10., and 172.16. ranges. It fails for 127.0.0.1, but only because it says there's nobody listening (not, as Firefox does, because of a security error accessing that IP in the first place); for localhost it can actually verify that no service is running on that port, whereas for remote hosts in the private ranges it can't.

tzs 6y ago
I don't understand the point of blocking all of 192.168/16, 172.16/12, and 10/8. If the point is to block access to other hosts on your LAN shouldn't it just block the one your LAN actually uses?
- pferde 6y ago
  What if the my network uses several different local subnets? How would the browser figure that out? No, blocking all these IP ranges is a good idea. After all, these ranges are supposed to not be directly routeable to from the Internet.
  - tzs 6y ago
    > What if the my network uses several different local subnets? How would the browser figure that out? It would look at your computer's routing table. If it is an IP address your computer talks to directly, it is on a LAN your computer is on and would be blocked. If it is an IP address that your computer talks to through a gateway, it is on the internet and would not be blocked. > After all, these ranges are supposed to not be directly routeable to from the Internet. They are supposed to not be directly routeable to/from the public internet. They can be directly routable between non-public parts of the internet. A not uncommon example, especially now, is having a VPN connection between a home network and the internal network of a business, both of which are using addresses in the private ranges.
    - pdonis 6y ago
      > If it is an IP address that your computer talks to through a gateway, it is on the internet and would not be blocked. No, this would just make the security problem worse, because now any website could use websockets to scan, not just your personal LAN, but any network you are connected to through a VPN or any other gateway.
    - pferde 6y ago
      > They are supposed to not be directly routeable to/from the public internet. They can be directly routable between non-public parts of the internet. Sure, but this is different from a VPN. This would be untrusted code downloaded from a remote website talking to unrelated devices on my local network. Effectively, it would be the remote website having free reign inside my local network, with my web browser acting as a proxy (or as a trojan horse, with a bit of exaggeration).
- magicalhippo 6y ago
  I use both 192.168/16 and 10/8 on my computer. One is for my regular LAN and the other is for my 10G link to my NAS.
- pdonis 6y ago
  I don't understand the point of not blocking all of those ranges. Why should the browser bother trying to figure out which ones are actually used on a particular LAN? All of those IP ranges are designated as private, and that in itself should be reason enough for browsers to block websocket connections to them.

moonbug 6y ago

Gee, good job no one uses IPv6.

gerdesj 6y ago
Shhh the kids are thinking. They'll work it out eventually. My IPX/SPX and pigeon borne packet transfers are all good. I'm using a dual IPv4/6 stack laptop at home with a dual stack IPv4/6 OpenVPN to the office at the moment, with my default gateways forced down the VPN. Silly me, click (disconnect) Oh, no real change in experience.
icedchai 6y ago
Consider a /64 subnet will take a while, if not forever, to scan.
- Dylan16807 6y ago
  Unless you know part of the mac address. Or it's bound to :0:0:0:1. And maybe you already know the IP and the firewall is blocking connections from outside the building.