Private IP is accessing my website

Question

I got some IPs like 192.168.0.* or 192.168.7.* accessing my website.

I host it in Rackspace.

How is that possible? IP spoofing? any clue?

Thanks!

Answer 1

Not sure about Rackspace but some hosting providers provide servers with 2 network cards, one public facing but also an internal one that is on their own internal network that they use for administering the system.

Would seem odd to see web traffic from that IP though if it were an internal network - unless they are monitoring for vulnerabilities or something similar?

If you run ipconfig (windows) or ifconfig (Linux) you will be able to see the list of network cards and their IP addresses and subnets which might give a clue

Answer 2

Yes, it's either spoofed IPs or internal machines talking to you most likely.

Can you firewall them ?

Answer 3

Why you think this is unusual?

Lets ignore packets poofing for a moment - this wuold be a reson for me to change the hoster (the hoster is supposed to block internal IP addresses on it's external gateways). And also ignore internal packet spoofing - too unlikely.

Why you assume Rackspace does NOT use internal IP addresses for systems that are not supposed to be public? Like admin systems. For example one monitoring every web server responds properly ;)

This is most likely what happens here. You get a request either from within Rackspace (i.e. they also have people therek, and I guess those people also surf sometimes, could be totally valid) or within the rackspace infrastructure (automated system testing the server works and returns a valid return value according to TCP - top notch service if you ask me).

I would try getting the host name for that IP address within their network. Could be a clue what happens. Otherise a suppor ticket will help you find out what is hitting you there. It is their system, they will know.