Should I be afraid of extraneous ip-addresses on the local network?

Question

Computer networks

There is a local area network of the organization on 120 computers. The network uses addressing 10.0.0.0/20. Once it was discovered that there was a node on the network with the address 192.168.0.169. ping of the device is stable, but not typical for the local network, more than 30 ms. arp did not give the MAC address of this device. trace showed that the device is outside our network, it is behind the IP address of someone else's provider. A pfSense gateway with LANs and bogons blocked on its external interface. I am lost in conjecture, what kind of device is this and how is it present in our local network?
Is it possible to determine how this device gained access to our local network?
Is it possible to somehow avoid the appearance of such nodes in the local network in the future?

Answer 1

Should I be afraid of extraneous ip-addresses on the local network?

if there are secrets / values ​​​​in the network - definitely YES, you should be wary
of all the more intranet addresses, the trace to which goes beyond the limits of the LAN
what to do:
- try to investigate (maybe one of the employees raises a VPN home?)
- try to block the address / routing ( but you have to be prepared for the fact that something necessary will fall off, such as an external security webcam?))).. but [maybe] you will know exactly what it is ;))

Answer 2

There was a topic recently: Block addresses on the network . Maybe you can try to implement something similar.

Answer 3

clarify please
How was it discovered?
Was the trace going through your router?
What does this mean? Blocked how? Access to you blocked or from you?
I don’t really understand what the problem is if this address is outside your network.
If it's inside, what does it indicate?
If you do not use Vlans, then the poppy does not see that this node is behind your router.
You never know what the provider has there and how it works.