3 ms·
We run all of our traffic over ipsec to our VPS. It's https anyway, but I don't really care for Google to know how many clients I have behind my network. Everyt
by exabrial 5y ago
We run all of our traffic over ipsec to our VPS. It's https anyway, but I don't really care for Google to know how many clients I have behind my network. Everything is in 10.x.x.x space.
No, we're not going to do let-everyone-access-everything. We believe in layered security. Locks on the front door, locks to get around the house.
- notatoad 5y agoSeems like as long as everything is in the 10.x.x.x/8 range and a user gets there by typing the IP into their address bar, nothing is going to change for you. This is only about mixing public and private contexts. If you have a link to private IP space on a public website, then you're going to get warnings.
- deleted 5y ago[deleted]
- rocqua 5y agoI presume DNS names that resolve to 10.x.x.x are also fine to write into your address bar directly? It seems to me the issue with a DNS split-horizon is that google results return DNS names that are in your local intranet, and thus resolve to a local IP, but you clicked on that link from the outside world, and hence chrome would block that.
- southerntofu 5y agoYes it would be fine. The issue would arise if you connect to a remote service which then instructs your browser to run local queries.
- notatoad 5y agoI think any sort of split-horizon on devices you don't fully control is going to start giving you a lot of problems going forward. For example, any sort of DNS-over-https is going to make split-horizon non existent unless you control the client device. And presumably if you control the client to change the DNS behaviour, you could turn off this new behaviour too. Fwiw, I think this is generally good. Network operators shouldn't be able to arbitrarily intercept traffic on their networks.