Subject: A Splendid Example Of A Renumbering Disaster

From: Sabahattin Gucukoglu <[email-masked]>
Date: Sat, 24 Nov 2012 01:46:32 +0000

It's Friday.  Time to plug IPv6 some more. :-)

http://b.logme.in/2012/11/07/changes-to-hamachi-on-november-19th/

LogMeIn Hamachi is basically a NAT-traversing layer 2 VPN solution.  They avoided conflicts with RFC 1918 space by hijacking IPv4 space in 5/8, now actively being allocated by LIRs in Europe.  When that didn't work (see link above), they moved to 25/8, allocated to the UK MoD.  While I'm almost sure that they haven't got it quite so wrong this time, following the comments says that the idea was not only a very bad one to start with, it's cost a lot of people a lot of grief that IPv6 was clearly going to mitigate in renumbering.  Perhaps it is why they recommend it per default, if not for the number of applications that would be broken by it.

By the way, is this an application that the new shared transition space might benefit?

Cheers,
Sabahattin

---

From: David Conrad <[email-masked]>
Date: Fri, 23 Nov 2012 18:54:34 -0800

On Nov 23, 2012, at 5:46 PM, Sabahattin Gucukoglu <[email-masked]> wrote:
> LogMeIn Hamachi is basically a NAT-traversing layer 2 VPN solution.  They avoided conflicts with RFC 1918 space by hijacking IPv4 space in 5/8,

Back when I was running IANA and we noticed this (back in 2006 or so -- don't remember the exact dates), we suggested to the folks at Hamachi that using squat space was perhaps not the best idea.  They floated the idea of a /8 dedicated to VPNs, but it didn't go anywhere (we at IANA told them to bring it up with the IETF -- not sure if they ever did).  

> now actively being allocated by LIRs in Europe.  When that didn't work (see link above), they moved to 25/8, allocated to the UK MoD.  

Sigh.  You would think that after a number of years they could've come up with a better solution than to use different squat space. Given 25/8 is 'legacy' space, unencumbered by registration service agreements, I suspect folks using Hamachi for v4 VPNs will get another unpleasant surprise in the future.

Regards,
-drc

---

From: Christopher Morrow <[email-masked]>
Date: Fri, 23 Nov 2012 23:24:46 -0500

> Sigh.  You would think that after a number of years they could've come up with a better solution than to use different squat space. Given 25/8 is 'legacy' space, unencumbered by registration servic…

'doctor! doctor! it hurts when I do this!' - 'Then STOP DOING IT YOU
IDIOT!!' - 'No, it's fun to  hurt!'

you can't help people who don't want help... :(

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 24 Nov 2012 08:08:55 +0000

> Sigh.  You would think that after a number of years they could've come up with a better solution than to use different squat space. Given 25/8 is 'legacy' space, unencumbered by registration servic…

In all fairness, they do say (at the above URL):

"However, our general recommendation is that if you can, please turn off
IPv4 support in your Hamachi clients. The IPv6 space we’re using has been
registered to LogMeIn, and most modern software should function perfectly
without needing an IPv4 address."

so let's give them some credit. (For extra credit, they could make
IPv6 the default in their client software.)

   Brian

---

From: Paul Wouters <[email-masked]>
Date: Sat, 24 Nov 2012 11:36:07 -0500 (EST)

> LogMeIn Hamachi is basically a NAT-traversing layer 2 VPN solution.  They avoided conflicts with RFC 1918 space by hijacking IPv4 space in 5/8, now actively being allocated by LIRs in Europe.  When…

Both TMobile in the US, and Rogers/Fido in Canada use 25/8. Our IPsec
client per default only allows incoming NAT-T for ranges in RFC1918, due
to security reasons (you don't want them hijacking google's ip range). So
we actually had to add 25/8 to the white list a few years ago.

But, it would be nice to have an IPv4 range dedicated to VPN ranges, so
you can setup things like L2TP tunnels without fear of collision in the
RFC1918 space, although I guess technology has advanced enough to
implement proper segmentation and workarounds for this these days.

Paul

---

From: "Andrew G. Malis" <[email-masked]>
Date: Mon, 26 Nov 2012 11:52:06 -0500

As LogMein says, even with the TMobile and Rogers use, it's extremely
unlikely that their customers will need to communicate with any hosts in
25/8. That said, I absolutely agree that an IPv4 range devoted to VPNs
would be great. I run a personal VPN to my home LAN, and I specifically use
different ranges of RFC 1918 space for the addresses in my home and my VPN.

Cheers,
Andy

On Sat, Nov 24, 2012 at 11:36 AM, Paul Wouters <[email-masked]> wrote:

>  http://b.logme.in/2012/11/07/**changes-to-hamachi-on-**november-19th/<http://b.logme.in/2012/11/07/changes-to-hamachi-on-november-19th/>
>>
>> LogMeIn Hamachi is basically a NAT-traversing layer 2 VPN solution.  They
>> avoided conflicts with RFC 1918 space by hijacking IPv4 space in 5/8, now
>> actively being allocated by LIRs in Europe.  When that didn't work (see
>> link above), they moved to 25/8, allocated to the UK MoD.  While I'm almost
>> sure that they haven't got it quite so wrong this time, following the
>> comments says that the idea was not only a very bad one to start with, it's
>> cost a lot of people a lot of grief that IPv6 was clearly going to mitigate
>> in renumbering.  Perhaps it is why they recommend it per default, if not
>> for the number of applications that would be broken by it.
>>
>

---

From: Benson Schliesser <[email-masked]>
Date: Mon, 26 Nov 2012 12:12:42 -0500

I expect to be flamed for suggesting it, but why not use the Shared 
Address Space for this purpose? (http://tools.ietf.org/html/rfc6598)

Cheers,
-Benson

On 11/26/12 11:52 AM, Andrew G. Malis wrote:
> unlikely that their customers will need to communicate with any hosts 
> in 25/8. That said, I absolutely agree that an IPv4 range devoted to 
> VPNs would be great. I run a personal VPN to my home LAN, and I 
> specifically use different ranges of RFC 1918 space for the addresses 
> in my home and my VPN.
>
> Cheers,
> Andy
>
>
>
> On Sat, Nov 24, 2012 at 11:36 AM, Paul Wouters <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>         LogMeIn Hamachi is basically a NAT-traversing layer 2 VPN
>         solution.  They avoided conflicts with RFC 1918 space by
>         hijacking IPv4 space in 5/8, now actively being allocated by
>         LIRs in Europe.  When that didn't work (see link above), they
>         moved to 25/8, allocated to the UK MoD.  While I'm almost sure
>         that they haven't got it quite so wrong this time, following
>         the comments says that the idea was not only a very bad one to
>         start with, it's cost a lot of people a lot of grief that IPv6
>         was clearly going to mitigate in renumbering.  Perhaps it is
>         why they recommend it per default, if not for the number of
>         applications that would be broken by it.
>
>

---

From: Pete Resnick <[email-masked]>
Date: Mon, 26 Nov 2012 14:41:38 -0600

> By the way, is this an application that the new shared transition space might benefit?

Yes, like Benson, I am at a loss for why they do not use RFC 6598 
addresses. That's what someone should tell these goofballs to do.

pr

-- 
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Technologies, Inc. - +1 (858)651-4478

---

From: Cameron Byrne <[email-masked]>
Date: Mon, 26 Nov 2012 12:56:44 -0800

On Mon, Nov 26, 2012 at 12:41 PM, Pete Resnick
<[email-masked]> wrote:
>> actively being allocated by LIRs in Europe.  When that didn't work (see link
>> above), they moved to 25/8, allocated to the UK MoD.  While I'm almost sure
>> that they haven't got it quite so wrong this time, following the comments
>> says that the idea was not only a very bad one to start with, it's cost a
>> lot of people a lot of grief that IPv6 was clearly going to mitigate in
>> renumbering.  Perhaps it is why they recommend it per default, if not for
>> the number of applications that would be broken by it.
>>
> Yes, like Benson, I am at a loss for why they do not use RFC 6598 addresses.
> That's what someone should tell these goofballs to do.
>

Unfortunately, RFC1918 and RFC 6598 are not enough to number all that
needs numbers.

Lots of love,

Goofball

---

From: Pete Resnick <[email-masked]>
Date: Mon, 26 Nov 2012 15:27:02 -0600

On 11/26/12 2:56 PM, Cameron Byrne wrote:
>>> above), they moved to 25/8, allocated to the UK MoD. [...]
>>>

I'm sorry, I don't understand. Are you saying that Hamachi needs more 
than a /10? Or are you saying that other people need more than a /10 and 
the 1918 /8, /12, and /16? If so, please explain.

pr

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Mon, 26 Nov 2012 23:02:20 +0000

> Yes, like Benson, I am at a loss for why they do not use RFC 6598 addresses. That's what someone should tell these goofballs to do.

OK, I'm getting the idea.  I've left a comment there.  Hopefully somebody will find it.

Cheers,
Sabahattin

---

From: Paul Wouters <[email-masked]>
Date: Mon, 26 Nov 2012 12:33:51 -0500 (EST)

On Mon, 26 Nov 2012, Benson Schliesser wrote:

> I expect to be flamed for suggesting it, but why not use the Shared Address Space for this purpose?
> (http://tools.ietf.org/html/rfc6598)

You can't, if carriers are assigning you that IP range. You'd still get
a conflict if you use it for your own VPN range, as the inner address
cannot be in the same subnet as the outer address (whether in tunnel
mode, or when using transport mode with L2TP)

Paul