Penetrating Private RFC1918 Networks Without Firewall Holes: Lory Mesh

One of the greatest logistical headaches in penetration testing is assessing private corporate infrastructure. When a compliance standard (like SOC 2 CC7.1 or PCI DSS Requirement 11.4) mandates an internal network assessment, organizations are traditionally forced to:

• Ship physical hardware appliances (such as pre-configured NUCs or laptops) to remote offices.
• Configure cumbersome site-to-site IPsec VPN tunnels that require security team approvals and complex BGP routing.
• Open dangerous inbound firewall holes that expose private subnets directly to the public internet.

Lorikeet Security eliminated this friction with Lory Mesh (mesh/README.md), an asynchronous Layer-3 overlay network that connects cloud-based autonomous testing engines to private RFC1918 subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) using outbound-only mutual TLS.

How Lory Mesh Works Under the Hood

Setting up an internal assessment takes less than 60 seconds. A network engineer runs a single enrollment command on any machine inside the target network:

Behind the scenes, the connector daemon (lory-meshd.py):

1. Auto-Detects Local Subnets: Scans local network interfaces to identify active RFC1918 CIDR blocks.
2. Configures a Virtual TUN Adapter: Creates a virtual network interface (lory0 on Linux, Wintun on Windows) in the 100.100.0.0/16 overlay range.
3. Establishes Outbound mTLS: Connects to mesh.lorikeetsecurity.com:51820 using unique client certificates minted by the Lorikeet Mesh Certificate Authority.
4. Enables Stateful SNAT: Applies local kernel packet masquerading so packets routed from Lory's cloud scanner pod reach internal hosts and return seamlessly.

Strict Multi-Tenant Isolation (CompanyResolver)

When testing internal networks in a multi-tenant cloud environment, security isolation is paramount. The Lory Mesh Gateway pod features a dedicated CompanyResolver engine that validates every packet against active engagement scopes stored in the database.

Traffic originating from an engagement can only reach the specific connector and approved CIDRs registered to that organization, completely preventing cross-tenant packet leakage.

Lorikeet Security Team

Penetration Testing & Cybersecurity Consulting

Lorikeet Security helps modern engineering teams ship safer software. Our work spans web applications, APIs, cloud infrastructure, and AI-generated codebases — and everything we publish here comes from patterns we see in real client engagements.

Practical security, written by practitioners.