<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Sep 7, 2021, at 4:51 AM, John Curran <<a href="mailto:jcurran@arin.net" class="">jcurran@arin.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
On 7 Sep 2021, at 4:39 AM, arin-ppml <<a href="mailto:arin-ppml@arin.net" class="">arin-ppml@arin.net</a>> wrote:<br class="">
<div class="">
<blockquote type="cite" class="">...<br class="">
<div class="">
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
It is perfectly within ANY RIR’s policy if I distribute addresses to customers that are connected to me only via a GRE tunnel or other VPN. The only infrastructure required to support this would be a cloud-based VM that wouldn’t even need to be on my hardware.
With that very thin fig leaf, I’ve met the test of connectivity that is required by some RIRs and I’m technically providing sufficient transit to meet the qualifications for address space.</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
Correct, but making the representation that you need to have number resources issued to provide VPN services when the actual intent is simply leasing would be a fraudulent representation. In the ARIN region, I can state that resources known to be issued fraudulently
are revoked. (If the resources were issued and used for providing network services, but then business factors change and they’re no longer used for network services and instead now transferred or leased then that is not fraud - such usage is either specified
allowed or not clearly prohibited [respectively] by the community-developed registry policy in this region.) </div></div></div></blockquote><div><br class=""></div>OK, but what if I made the application, ran a VPN service for several years and then discovered that due to shifting market realities, leasing was a way to keep the addresses in use while still creating a revenue stream whereas the VPN service in question was becoming less viable?</div><div><br class=""></div><div>Would pivoting my business be cause for ARIN to revoke my addresses or treat my application as fraudulent?</div><div><br class=""></div><div>How, exactly, does ARIN read my mind about intent in such a case?</div><div><br class=""><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class="">
<div class="">
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
<br class="">
</div>
</div>
<blockquote type="cite" class="">
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
Whether you want this to be normal or not, the simple reality is that it is. There is a market for IPv4 address leasing and people will do it one way or another. While it can’t be used as justification for acquiring additional addresses (unless you throw a
fig leaf on it as described above), that really doesn’t matter since 80% of RIRs are essentially out of IPv4 anyway.</div>
</blockquote>
<br class="">
</div>
<div class="">Throwing “a fig leaf” on it in order to obtain number resources may have other repercussions in the ARIN region, as we refer cases of criminal fraud to law enforcement authorities. </div></div></div></blockquote><div><br class=""></div>It’s only fraud if the “fig leaf” isn’t real. If I operate an actual VPN (even if that VPN doesn’t carry much traffic), then there’s no fraud.</div><div><br class=""></div><div>Owen</div><div><br class=""></div></body></html>