Should I be seeing other servers on the same "LAN" as my VPS?

voltagex · October 22

voltagex@frankfurt:~$ avahi-browse -a
+   eth0 IPv4 TorrServer                                    Web Site             local
+   eth0 IPv4 TorrServer                                    _torrserver._tcp     local
+   eth0 IPv6 TorrServer                                    _torrserver._tcp     local
+   eth0 IPv6 TorrServer                                    Web Site             local
+   eth0 IPv6 Home Assistant                                _home-assistant._tcp local
+   eth0 IPv4 Bubby (OpenClaw) (2)                          _openclaw-gw._tcp    local
+   eth0 IPv4 openclaw-dr                                   _openclaw-gw._tcp    local
+   eth0 IPv4 DE20USD                                       Microsoft Windows Network local
+   eth0 IPv4 DE20USD                                       Device Info          local

Frameworks · October 22

Did you create them yourself?

voltagex · October 22

No, these aren't mine.

Frameworks · October 22

@voltagex said:
No, these aren't mine.

Srsly? OMG. Who's the provider?

gbzret4d · October 22

@Frameworks said:

@voltagex said:
No, these aren't mine.

Srsly? OMG. Who's the provider?

Yeah who's the provider? Name and shame

voltagex · October 22

I'm not putting them on blast as I'm waiting for tickets to be resolved and working on locking down my server.

Initial response is good-ish.

voltagex · October 22

@gbzret4d said:

@Frameworks said:

@voltagex said:
No, these aren't mine.

Srsly? OMG. Who's the provider?

Yeah who's the provider? Name and shame

Dunno what the rules are about that here.

itzsenu · October 22

@voltagex said: I'm not putting them on blast as I'm waiting for tickets to be resolved and working on locking down my server.

just wanna know the provider so we can avoid any issues with our own VPSes. especially with some of the things we run on our VPSes.

voltagex · October 22

Will give them a chance to change settings on their end first.
They have suggested turning on ufw.

RAVNIX · October 22

@voltagex said:
Will give them a chance to change settings on their end first.
They have suggested turning on ufw.

The issue is far greater than a single guest enabling a firewall...

gbzret4d · October 22

@voltagex said:

@gbzret4d said:

@Frameworks said:

@voltagex said:
No, these aren't mine.

Srsly? OMG. Who's the provider?

Yeah who's the provider? Name and shame

Dunno what the rules are about that here.

Then don't open a thread if you don't want to name the provider. Rules here allows this

kenjing789 · October 22

I guess it MassiveGrid

SodaWithoutSparkles · October 22

OP's only comment that involves some form of hosting provider was with MassiveGrid (Nov 2024)

@voltagex said:
[at]MassiveGRID - invoice 1968270

rpqu · October 22

LOL LMAO

Void · October 22

I don’t think it’s just one provider. Tested the below and all of them have entries like this.
DartNode, Hostsailor, Hostdzire, VPSLayer, AspireHost

JasonM · October 22

@kenjing789 said: I guess it MassiveGrid

LowEndDetectives

emiraykoz · October 22

LMAO WTF

neighhouse · October 22

oh wow... gotta check this on mine now

deafcon · October 22

@Void said:
I don’t think it’s just one provider. Tested the below and all of them have entries like this.
DartNode, Hostsailor, Hostdzire, VPSLayer, AspireHost

God damnit. Add SolidVPS to the list. My guess is that we should be looking for VPS that have this configured correctly because the default is going to be shared layered 2 broadcast.

Void · October 22

@yoursunny time for another list

deafcon · October 22

Every provider I've tried is showing at least one other host. It seems wrong, but I'll leave it to other more knowledgeable people to say whether this is just something that is industry standard or not. It seems you can mitigate by shutting down the avahi daemon (and ostensibly anything else that broadcasts mDNS) and enabling a firewall rule that blocks inbound 5353. So if you're running the default ufw block pretty much everything, I think you're fine.

slowservers · October 22

Many providers will have this. They generally put you in the same /24 and (hopefully) filter from there. It shouldn't be a big deal if they have ARP spoofing protections and such in place.

I found it was easiest/safest to have a fully routed infrastructure.

fredo1664 · October 22

Wonder what happens if you define all the ipv4 of the subnet on your VM.

AspireHosting · October 22

@fredo1664 said:
Wonder what happens if you define all the ipv4 of the subnet on your VM.

It won't work obviously, everyone has anti spoofing setup(Unless some provider doesn't).

LEBUserJoe · October 22

but they are on localhost, screw spoofing lot of basic vps users will lock external access to local only.

This could be used to bypass limits, and abuse exploits.

fredo1664 · October 22

@AspireHosting said:

@fredo1664 said:
Wonder what happens if you define all the ipv4 of the subnet on your VM.

It won't work obviously, everyone has anti spoofing setup(Unless some provider doesn't).

In the age of the vibe coded panel, hosting company, support and potentially owner, I don't know if we can be sure of anything ;-)

layer7 · October 22

Hi,

i just had today a ticket like this. This was my answer:

Hi $customer_prename,

i do not really understand what you want to tell me.

If you scan the internet you will receive the same information.

So of course since all our customers are part of the internet, what ever is available via the internet is also available through the internet, within the same provider.

The only difference is that since you are in the same broadcast domain like other customers, you can go over the broadcast to get to know what other things are available and up.

This is what usually bot networks are doing to discover things.

The information is either way reachable.

If customer do not want this services to answer on public request, they should not publish it to the public.

This is not a security issue but normal internet.

But thank you for your hint! Thats very mindful of you.

And that still stands, and i am wondering a bit about this shocking moment of some people here.

I do not see much difference if you are using a software to tell you what is available in your broadcast domain or if you are using a port scanner.

For one of the monitoring nodes at hetzner i just did that:

nmap -sS $hetzner_/26_network
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-10-22 20:14 CEST
Stats: 0:00:01 elapsed; 0 hosts completed (0 up), 64 undergoing Ping Scan
[....]
SYN Stealth Scan Timing: About 97.31% done; ETC: 20:14 (0:00:01 remaining)
Host is up (0.00063s latency).
Not shown: 1000 filtered tcp ports (no-response)

With here some selected examples:

Host is up (0.00033s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT     STATE SERVICE
1723/tcp open  pptp


Host is up (0.00052s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https
587/tcp open  submission


Host is up (0.00022s latency).
Not shown: 990 closed tcp ports (reset)
PORT     STATE    SERVICE
25/tcp   filtered smtp
26/tcp   filtered rsftp
110/tcp  filtered pop3
111/tcp  filtered rpcbind
143/tcp  filtered imap
465/tcp  filtered smtps
587/tcp  filtered submission
993/tcp  filtered imaps
995/tcp  filtered pop3s
3128/tcp open     squid-http

Host is up (0.00040s latency).
Not shown: 986 closed tcp ports (reset)
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   filtered smtp
53/tcp   open     domain
80/tcp   open     http
110/tcp  open     pop3
111/tcp  open     rpcbind
143/tcp  open     imap
443/tcp  open     https
465/tcp  filtered smtps
587/tcp  open     submission
993/tcp  open     imaps
995/tcp  open     pop3s
3306/tcp open     mysql


Host is up (0.00028s latency).
Not shown: 995 closed tcp ports (reset)
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
465/tcp  filtered smtps
3389/tcp open     ms-wbt-server
9100/tcp open     jetdirect


Host is up (0.00024s latency).
Not shown: 993 closed tcp ports (reset)
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   filtered smtp
80/tcp   open     http
443/tcp  open     https
465/tcp  filtered smtps
3306/tcp open     mysql



Host is up (0.00054s latency).
Not shown: 974 closed tcp ports (reset)
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
80/tcp   open     http
443/tcp  open     https
465/tcp  filtered smtps
5001/tcp open     commplex-link
5002/tcp open     rfe
5003/tcp open     filemaker
5004/tcp open     avt-profile-1
5009/tcp open     airport-admin
5030/tcp open     surfpass
5033/tcp open     jtnetd-server
5050/tcp open     mmcc
5051/tcp open     ida-agent
5054/tcp open     rlm-admin
5060/tcp open     sip
5061/tcp open     sip-tls
5080/tcp open     onscreen
5087/tcp open     biotic
5100/tcp open     admd
5101/tcp open     admdog
5102/tcp open     admeng
5120/tcp open     barracuda-bbs
6001/tcp open     X11:1
6002/tcp open     X11:2
8000/tcp open     http-alt


Host is up (0.00064s latency).
Not shown: 990 closed tcp ports (reset)
PORT     STATE    SERVICE
25/tcp   filtered smtp
135/tcp  open     msrpc
139/tcp  open     netbios-ssn
445/tcp  open     microsoft-ds
465/tcp  filtered smtps
3260/tcp open     iscsi
3261/tcp open     winshadow
3389/tcp open     ms-wbt-server
5988/tcp open     wbem-http
9000/tcp open     cslistener


Host is up (0.00036s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT     STATE SERVICE
7777/tcp open  cbt



Host is up (0.00055s latency).
Not shown: 986 filtered tcp ports (no-response)
PORT     STATE SERVICE
53/tcp   open  domain
80/tcp   open  http
110/tcp  open  pop3
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
143/tcp  open  imap
443/tcp  open  https
587/tcp  open  submission
993/tcp  open  imaps
995/tcp  open  pop3s
3389/tcp open  ms-wbt-server
5000/tcp open  upnp
5222/tcp open  xmpp-client
8080/tcp open  http-proxy


Host is up (0.00039s latency).
Not shown: 984 filtered tcp ports (no-response)
PORT     STATE  SERVICE
21/tcp   open   ftp
22/tcp   open   ssh
80/tcp   open   http
110/tcp  open   pop3
143/tcp  open   imap
443/tcp  open   https
587/tcp  open   submission
993/tcp  open   imaps
995/tcp  open   pop3s
3306/tcp open   mysql
5222/tcp open   xmpp-client
5269/tcp closed xmpp-server
5280/tcp open   xmpp-bosh
5432/tcp open   postgresql
8082/tcp closed blackice-alerts
9090/tcp open   zeus-admin


Host is up (0.00028s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
465/tcp  filtered smtps
1500/tcp open     vlsi-lm


Host is up (0.00034s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT     STATE SERVICE
135/tcp  open  msrpc
7777/tcp open  cbt


Host is up (0.00038s latency).
Not shown: 990 closed tcp ports (reset)
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
80/tcp   open     http
443/tcp  open     https
465/tcp  filtered smtps
1000/tcp open     cadlock
3000/tcp open     ppp
7001/tcp open     afs3-callback
7002/tcp open     afs3-prserver
8000/tcp open     http-alt


Host is up (0.00025s latency).
Not shown: 981 closed tcp ports (reset)
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
179/tcp  open     bgp
465/tcp  filtered smtps
5900/tcp open     vnc
5901/tcp open     vnc-1
5902/tcp open     vnc-2
5903/tcp open     vnc-3
5904/tcp filtered ag-swim
5906/tcp open     rpas-c2
5907/tcp open     dsd
5910/tcp open     cm
5911/tcp open     cpdlc
5915/tcp open     unknown
5922/tcp open     unknown
5925/tcp open     unknown
5950/tcp open     unknown
5952/tcp open     unknown
9100/tcp open     jetdirect

Host is up (0.00040s latency).
Not shown: 991 closed tcp ports (reset)
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
80/tcp   open     http
111/tcp  filtered rpcbind
443/tcp  open     https
465/tcp  filtered smtps
2049/tcp open     nfs
3128/tcp open     squid-http
3389/tcp filtered ms-wbt-server


Host is up (0.00052s latency).
Not shown: 988 filtered tcp ports (no-response)
PORT      STATE  SERVICE
21/tcp    open   ftp
22/tcp    open   ssh
53/tcp    open   domain
80/tcp    open   http
110/tcp   open   pop3
143/tcp   open   imap
443/tcp   open   https
587/tcp   open   submission
993/tcp   open   imaps
995/tcp   open   pop3s
8083/tcp  open   us-srv
12000/tcp closed cce4x

So what exactly is the difference now?

Except the fact that because we configure vanilla IPs without the required on-link config directive and being this way also compatible to older OS's some customers might want/need.

yoursunny · October 22

@voltagex said:
Should I be seeing other servers on the same "LAN" as my VPS?

Yes, this is expected behavior.
When you share the same /24 subnet with another server, your ARP and other broadcasts must reach each other according to the Internet Protocol.
If the switch blocks such traffic, you’ll be unable to properly communicate with another server in the same subnet.
There are legitimate use cases for such communication, such as (1) you bought two servers, one as frontend, the other as database (2) you want to fetch from a website hosted by someone else who happened to have chosen the same provider and deployed in the same subnet.

EndlessGravity · October 23

@layer7 said:
Hi,

i just had today a ticket like this. This was my answer:

@yoursunny said:

@voltagex said:
Should I be seeing other servers on the same "LAN" as my VPS?

Yes, this is expected behavior.

Crazy amount of lack of competence on display here. avahi-browsegives you services discovered through mDNS, which is based on multicast. It has nothing to do with subnet adjacencies / neighbors. Reaching open services within the same subnet works regardless of whether the virtual machines share a broadcast domain or not - it's entirely irrelevant.

Allowing BUM traffic between virtual machines indicates that the provider doesn't have a production-ready guest filtering setup. At least they have uRPF and don't allow VMs to send traffic from random IPs - right..., right...?

To answer OP: on any serious provider's network the answer is nope.

fredo1664 · October 23

@EndlessGravity said:
any serious provider.

Should this be read as "not a vibe coded integration between a base proxmox installation and a dodgy panel hacked together by chatGPT free tier"?

SodaWithoutSparkles · October 23

The LAN should go through but the mDNS shouldnt.
You should "see" the other neighbors as in your ping can reach them (provided not blocked by firewall) or as in you can reach their website hosted on that IP.

...But you shouldn't be able to discover them via avahi-browse.

Howdy, Stranger!

Categories

In this Discussion

Should I be seeing other servers on the same "LAN" as my VPS?

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Should I be seeing other servers on the same "LAN" as my VPS?

Comments