How can I determine that user IP address is in accessible range or not?

Question

Guys,

I am grabbing user IP address, and then I want to determine whether that IP address is in accessible range or not.

What I am doing is, in my PHP script i am using 'ip2long' function and compare it with allowed range of ip address.

I know this is not a clean way to do that...does anyone have better idea to do that?

Any help appreciated.

Thanks, Amit

Answer 1

At minimum, you need to be comparing the top N bits against known-private or known-unused network blocks. And the minimum of that is the RFC 1918 private networks:

10/8
172.16/12
192.168/16

(This notation means that if you mask off the top 8 bits and get "10", it's in the first private block. 12 bits == 172.16 is the second, etc.)

There are many more blocks you could detect.

The easiest example is 127/8, which are all loopback addresses. You probably know about 127.0.0.1, but in fact all 127.x.y.z addresses refer to the loopback interface on your machine.

A more obscure example is 5/8, which was assigned but never used on the wide Internet, so it's been appropriated by Hamachi. You would want to be careful about testing for this, though, if there's a chance that your program could be run on a machine with access to the Hamachi network.

Another set of addresses you'll probably want to ignore are the various multicast ranges. You should only ever be sending UDP packets to those, never TCP connections.

If you want to get really aggressive, you could keep up to date on the latest assignments published by IANA, ignoring IPs from blocks that haven't been assigned yet. You'd want to keep that list frequently updated, though.

Answer 2

PHP does almost everything for you:

filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4| FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);

This will return false if the IP is in a private or reserved range, if the range is accessible it'll return the IP. You can come up with something like this to always return a boolean:

function isAccessibleRangeIP($ip)
{
    return (bool) filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4| FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);
}