2

What would be some of major use-cases in which you would want to assign multiple IP addresses to your NIC?

Knowing of any standard/well-known 'gotchas' associated with each use-case would also be helpful. For example, I heard someone saying that a user with access to such a machine will automatically get access to both networks, which could be a security issue.

You can assume a Linux-based environment.

2
  • I have no idea why anyone on earth would find this question as 'not constructive'. I asked this question to solicit specific, practical answers that no one book can teach you, only years of experience can.
    – Harry
    Sep 9, 2012 at 2:08
  • All posters, please help reopen this question if you have enough authority to do so. I believe the question is very much valid AND constructive. I've learned a lot from all of those who responded, when several hours of googling was proving useless. The kind of answers I have received, no book can ever teach you.
    – Harry
    Sep 9, 2012 at 2:19

4 Answers 4

4
  • Webservers: Websites that require SSL need to have one IP address per site, so this would require multiple IP addresses on a NIC.
  • Email servers: Multiple domains that want to use TLS with SMTP require separate IP addresses
  • DHCP servers: If you run out of IP addresses in your scope you may need to route a second network over and create a DHCP Superscope which would require that a second IP address in that additional network be bound to your NIC.
4
  • 1
    Regarding points #1 and #2: Most TLS clients now support "Server name indication". But this is not required for SMTP, since the SMTP server's certificate only needs to list the same name you have in MX records, but has no relation to the recipient addresses. Many people have configured <foo>.google.com to accept mail for their domains. Sep 8, 2012 at 16:15
  • 1
    I agree, those are good points. It should be clarified that "Required" depends on client functionality. Unfortunately, as you said, not everything supports SNI so in a hosted model it isn't always a good solution. To that point, if you are forklifting a new customer to a multi-tenant solution, they may not want to obtain a new SSL certificate if they already have one.
    – phiz
    Sep 8, 2012 at 16:28
  • Thanks, +1. Unfortunately, this question has been unfairly CLOSED by people who don't find it constructive. Please help reopen this question if you have enough authority to do so.
    – Harry
    Sep 9, 2012 at 2:17
  • The answers by phiz and grawity had the most information, and I feel like marking both of them final... but unfortunately I cannot do so. So, will at random select one of them as final. Thank, you both!
    – Harry
    Sep 9, 2012 at 2:24
3

There is a very easy reason why people use multiple IPs on a single NIC. You want to be part of multiple networks with a computer which only has one network card or at a place which only has one network outlet.

And yes, sometimes you can add a second NIC or a second outlet.


I heard someone saying that a user with access to such a machine will automatically get access to both networks

Well yes. That usually is the point.

1
  • 1
    Unfortunately, this question has been unfairly CLOSED by people who don't find it constructive. Please help reopen this question if you have enough authority to do so.
    – Harry
    Sep 9, 2012 at 2:17
3

One possible use case is providing an entire LAN access to a VPN without using NAT.

But don't assume that those two addresses would automatically belong to different networks. Even in IPv4, a computer may have one or more "external" IP addresses from the same network assigned directly to it. (This is the case with most servers, for example.) This can be used to implement IP-based "virtual hosts" (with one site per IP address – not only for old SSL versions, but also for various old protocols such as FTP).


In IPv6, multiple IP addresses are very common. For example, a single interface can have

  • a link-local address fe80::4a5d:ff60:e8fe:658f, which is based on the MAC address and always the same everywhere; it is used for IPv6 internal purposes (Neighbor Discovery).

  • a global address in your current network 2001:470:1f0b:614:4a5d:ff60:e8fe:658f, which has the same "host identifier" but might have different prefixes depending on the network; it can be used for incoming connections from other Internet hosts.

  • several global privacy address in the same network 2001:470:1f0b:614:a944:101:7c99:25ce (a "current" one and several "deprecated" (expired) ones), which have the same network prefix but randomly-generated host identifiers, which are changed every few hours to prevent tracking; these addresses are used for outgoing connections, such as browsing websites.


Note that it absolutely doesn't make sense to prevent the user from assigning multiple addresses. If I have sufficient privileges to add an address, I also have sufficient privileges to craft arbitrary IP packets (or even Ethernet frames) and have them sent over the wire, with any addresses I want.

In other words, if your issue is preventing users from accessing certain parts of a network, it cannot be solved on the users' machines – you should ensure that the network itself is secure (firewalls, 802.1x, port security on access-layer switches, or whatever else network guys use to achieve this).

2
  • Thanks, +1. Unfortunately, this question has been unfairly CLOSED by people who don't find it constructive. Please help reopen this question if you have enough authority to do so.
    – Harry
    Sep 9, 2012 at 2:16
  • The answers by phiz and grawity had the most information, and I feel like marking both of them final... but unfortunately I cannot do so. So, will at random select one of them as final. Thank, you both!
    – Harry
    Sep 9, 2012 at 2:23
2

High-availability software often uses shared IP addresses - say we have two servers with IP addresses 10.0.0.1 and 10.0.0.2. Additionally, we have (for example) mail server software that we need to be highly available - we assign it IP address 10.0.0.15, and all DNS records point to that IP address (mail.domain.com -> 10.0.0.15). Note that it's not the IP address of a real hardware server - it's an IP uniquely identifies that software package.

Initially, we may run that software on the server with 10.0.0.1, so that server can now be accessed with two different IPs. As soon as that server fails, or we need to perform some maintenance, we 'fail over' to the other server - we move the data to the second server, and then assign 10.0.0.15 to the second server, and our software is available again.

Many types of software operate this way: HP Serviceguard, OpenBSD's (and the Linux/FreeBSD ports) of CARP and Cisco's VRRP.

1
  • Thanks, +1. Unfortunately, this question has been unfairly CLOSED by people who don't find it constructive.
    – Harry
    Sep 9, 2012 at 2:15

Not the answer you're looking for? Browse other questions tagged .