Hacker News Reader

Comment by ordersofmag | Hacker News Reader

I'm no network guy so someone please explain why using 10.x.x.x. on a plane might "potentially cause routing issues"? It doesn't jive with what I understand about unrouteable address spaces. Is the 10.x.x.x space somehow different than the 192.168.x.x space that millions of people use VPN's out of every day (basically every WFH person on their cheap NAT'd home Wifi)?

View on HN

Because IPv4 sucks! If you don't have enough publicly routable addresses then you are forced to use reserved ranges like 10/8. That means you'll get collisions, ie. multiple networks using the same addresses. With IPv6 you'd just get a real public IP address and all would be fine.

Edit: I feel bad for saying IPv4 sucks. It's one of my favourite pieces of tech and an astonishingly good one at that. It just doesn't have a big enough address space.

Because many of the VPNs have _their_ internal routing using 10.0.0.0/8.

If the plane network uses 10.0.0.0/8; and then the VPN you're trying to connect to uses 10.0.0.0/8, stuff breaks.

Hopefully I'm not too late to the party. When you setup a VPN, you are telling your network stack that all connections for a set of IP addresses will be handled by it, in this example case, all 10.x.x.x requests will be routed through the VPN's application. The VPN will then wrap up all requests through that connection and send them out to the Internet towards the public IP address on the other end of the VPN. To send things out to the Internet, you use your default gateway, basically an IP address everything is sent to when it doesn't match any other configured route `ip route`. If your local network is using the 10.x.x.x subnet for local connections, it will likely be 10.0.0.1 or something. But who handles that route? Your VPN which would then just recursively keep handling its own request.

Now, I think VPN applications are smarter than that and will still get the outgoing packet to the default gateway (citation and research needed), but what happens when it doesn't know to handle a route automagically. For instance, with DHCP, a router can tell your computer what DNS server to reach out to. If that's on the local network, now you see all DNS requests actually routing into the network on the other side where you almost certainly aren't going to be talking to a DNS server. And now, you can't go to any websites.

Hopefully this helps. I'm not the most knowledgeable about VPNs and routing, but I'm pretty sure this is all fairly accurate.

Reply on news.ycombinator.com