Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serveo: Expose Local Servers to the Internet

serveo.net

Post reply on HN
Print view View original

41–50 of 122 posts

Re: Serveo: Expose Local Servers to the Internet

#41

Post by zAy0LfpBZLC8mAC »

jfries wrote: post #26
TrueDuality wrote: post #24

Earlier quoted context omitted.

NAT is definitively not a security layer and was never intended as such. You can get better security with a simple stateful ingress firewall (block packets not associated with an established/related connection) which is what most people think of for security with NAT. The only slight benefit it has imparted is the privacy benefit of hiding multiple devices behind a single address, but they can usually be individually…

I've heard before that "NAT is not intended as security", but isn't the effect still the same, that an external device can't connect to a device behind NAT without explicit configuration allowing it?

No, NAT does not prevent connections, it only rewrites addresses. If your NAT router also has a stateful firewall, that is what prevents inbound connections, and removing the NAT from that equation does not change that.

Re: Serveo: Expose Local Servers to the Internet

#43

Post by zAy0LfpBZLC8mAC »

AmericanChopper wrote: post #35
jfries wrote: post #26

Earlier quoted context omitted.

I've heard before that "NAT is not intended as security", but isn't the effect still the same, that an external device can't connect to a device behind NAT without explicit configuration allowing it?

I find this argument to be completely ridiculous, and it’s become remarkably common among those who wish to justify some of IPv6s shortcomings. Whether it was designed to be a security control or not, it is one, and it’s an incredibly important one. Anything that controls how hosts are allowed to communicate with each other is a security control. The argument is so absurd that I literally can’t believe people go arou…

Please explain how NAT without a stateful firewall provides security against what.

Re: Serveo: Expose Local Servers to the Internet

#44

Post by jakoblorz »

zx2c4 wrote: post #36
TrueDuality wrote: post #27

Earlier quoted context omitted.

That is generally true, but has weird edge cases. For example using not so specially crafted ICMP packets[1] two hosts each behind independent NATs can communicate with each other without any change to a firewall configuration. Also honorable mentions: The UPnP protocol & STUN servers [1]: https://samy.pl/chownat/

For an even cooler trick, check out pwnat, also from Samy: https://samy.pl/pwnat/ Server sends constant icmp pings with fixed payload to unreachable dead Internet IP. Client sends icmp time exceeded message to server containing original fixed ping subpayload, which the server NAT lets through because the payloads match as related traffic. Server then learns client IP and usual chownat udp hole punching tricks apply.

Wow that's insane!

Re: Serveo: Expose Local Servers to the Internet

#45

Post by AmericanChopper »

zAy0LfpBZLC8mAC wrote: post #43
AmericanChopper wrote: post #35

Earlier quoted context omitted.

I find this argument to be completely ridiculous, and it’s become remarkably common among those who wish to justify some of IPv6s shortcomings. Whether it was designed to be a security control or not, it is one, and it’s an incredibly important one. Anything that controls how hosts are allowed to communicate with each other is a security control. The argument is so absurd that I literally can’t believe people go arou…

Please explain how NAT without a stateful firewall provides security against what.

It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network. It’s a form of access control. What is your justification for saying that access control measures are not security controls? That is so incredibly contrived.

Re: Serveo: Expose Local Servers to the Internet

#47

Post by zAy0LfpBZLC8mAC »

AmericanChopper wrote: post #45
zAy0LfpBZLC8mAC wrote: post #43

Earlier quoted context omitted.

Please explain how NAT without a stateful firewall provides security against what.

It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network. It’s a form of access control. What is your justification for saying that access control measures are not security controls? That is so incredibly contrived.

> It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network.

So, how does it do that?

> What is your justification for saying that access control measures are not security controls?

I am not saying that. It simply isn't an access control measure.

Re: Serveo: Expose Local Servers to the Internet

#48

Post by ComodoHacker »

zAy0LfpBZLC8mAC wrote: post #41
jfries wrote: post #26

Earlier quoted context omitted.

I've heard before that "NAT is not intended as security", but isn't the effect still the same, that an external device can't connect to a device behind NAT without explicit configuration allowing it?

No, NAT does not prevent connections, it only rewrites addresses. If your NAT router also has a stateful firewall, that is what prevents inbound connections, and removing the NAT from that equation does not change that.

The point is NAT is actually a couple of rules in router's stateful firewall, it is done by firewall, and firewall can't do it without explicit configuration. There can't be 'default allow NAT' config.

Re: Serveo: Expose Local Servers to the Internet

#49

Post by Proven »

dboreham wrote: post #38

Note: you can do this yourself with a basic Linux VM, config to permit reverse ssh tunnel, and run some SSL proxy like Apache. And a DNS record.

Sure I can set up a "basic" VM with several services that have to be configured and maintained just to have this one feature, but why bother when this service and several hosted alternatives provide it for free?

One basic VM for mail, another for DNS, another for something else and soon you have a shitload of VMs, some of which are likely misconfigured and security risks.

It's not like no one has heard of hypervisor.

Re: Serveo: Expose Local Servers to the Internet

#50

Post by AmericanChopper »

zAy0LfpBZLC8mAC wrote: post #47
AmericanChopper wrote: post #45

Earlier quoted context omitted.

It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network. It’s a form of access control. What is your justification for saying that access control measures are not security controls? That is so incredibly contrived.

> It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network. So, how does it do that? > What is your justification for saying that access control measures are not security controls? I am not saying that. It simply isn't an access control measure.

> So, how does it do that?

By rewriting the IP headers of packets as they traverse routing devices. If you’re trying to say that all NAT devices are stateless firewalls, then your point is even more contrived than I first thought.

> It simply isn't an access control measure.

Then why can’t other internet connected devices connect to my internet connected laptop? If I’d connected my laptop directly to my ISP then they would be able to. But I didn’t do that, I connected my home router to my ISP, and I connected my laptop to my home router, which is providing access control for me.

Post reply on HN