Question

Difficulty: MediumPrivate IPv4 Addressing and RFC 1918

An edge security gateway is configured to drop any outgoing packet to the public Internet if its source IP address belongs to an RFC 1918 private address space. During a security audit of un-translated egress traffic logs, four source IPv4 addresses were recorded. Which source IPv4 address is globally routable on the public Internet and will be permitted through the firewall filter?

  1. 172.32.10.55Answer
  2. B
    172.30.100.1
  3. C
    192.168.100.255
  4. D
    10.255.254.1

Answer

172.32.10.55 is a public IPv4 address because it falls outside the RFC 1918 Class B private address allocation (172.16.0.0/12).
RFC 1918 allocates three specific ranges for private networks: 10.0.0.0/8 (10.0.0.0 - 10.255.255.255), 172.16.0.0/12 (172.16.0.0 - 172.31.255.255), and 192.168.0.0/16 (192.168.0.0 - 192.168.255.255). The address 172.32.10.55 begins with 172.32, which is higher than the upper boundary of 172.31.255.255, making it a globally routable public address that passes the RFC 1918 egress filter.

Step-by-Step Solution

1
Recall the RFC 1918 private IPv4 address allocations.
Class A: 10.0.0.0 to 10.255.255.255 (10.0.0.0/8), Class B: 172.16.0.0 to 172.31.255.255 (172.16.0.0/12), Class C: 192.168.0.0 to 192.168.255.255 (192.168.0.0/16).
Establishing accurate range boundaries is necessary to differentiate private non-routable addresses from public addresses.
2
Compare each given address against the RFC 1918 boundaries.
10.255.254.1 is inside 10.0.0.0/8; 192.168.100.255 is inside 192.168.0.0/16; 172.30.100.1 is inside 172.16.0.0/12. However, 172.32.10.55 exceeds 172.31.255.255.
Any IP starting with 172.32.x.x is part of public IP address space, not RFC 1918.
3
Determine which address is permitted through the egress filter.
172.32.10.55 is a public IP address and will pass through the RFC 1918 filter.
The filter only drops packets originating from RFC 1918 private ranges.

Key Concept

RFC 1918 Private IPv4 Address Space Boundaries
Estimated Time:1m 0s
Rate this question