Comment by 0x0

It's still possible to trick the browser of a user on the inside to HTTP POST a form invisibly to 192.168.1.1, by javascript hosted on an external web page.