Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One bad apple can spoil your IPv6 privacy (2022)

arxiv.org

Post reply on HN
Print view View original

21–30 of 64 posts

Re: One bad apple can spoil your IPv6 privacy (2022)

#21

Post by noinsight »

JohnFen wrote: post #19
adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

> I don't want any random machines behind my router to be able to open ports to the internet at large.

The solution to this is a firewall, not NAT. As has always been.

NAT is not a security feature and never has been. The fact that it blocks uninitiated inbound connectivity is an implementation detail, not its purpose.

Re: One bad apple can spoil your IPv6 privacy (2022)

#22

Post by Arnavion »

JohnFen wrote: post #19
adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

Since every IPv6 discussion on HN has to repeat this misunderstanding, I'll just link to what I posted last time: https://news.ycombinator.com/item?id=39997078

Re: One bad apple can spoil your IPv6 privacy (2022)

#23

Post by yjftsjthsd-h »

kstrauser wrote: post #11
paul_funyun wrote: post #6

Ipv6 is a lot like a bios update - best avoided unless absolutely necessary. Potential mess with no upsides for end users.

And by that analogy, the previous BIOS version was released in 1981, and modern networking is hamstrung by its design which assumed "4 billion addresses ought to be enough for anybody" and that it needed to be manageable by an 8-bit OS with 64KB of RAM. IPv4 is a brilliant protocol for having been published 43 years ago. There aren't a whole lot of technologies that old still widely used. I mean, I'm glad my NVMe dri…

> And by that analogy, the previous BIOS version was released in 1981, and modern networking is hamstrung by its design which assumed "4 billion addresses ought to be enough for anybody" and that it needed to be manageable by an 8-bit OS with 64KB of RAM.

I'm not sure if it makes the analogy better or worse, but this is what happened; BIOS was born in ~1981 (I think), had severe shortcomings that were partially mitigated over time but you can only mitigate so much, UEFI is a better replacement, BIOS->UEFI was a somewhat rocky migration, that migration was made worse by extra stuff getting bundled in (secure boot), and this led to a significant chunk of the population deliberately avoiding it at least for a while. The only real difference is that UEFI has long since become standard, while IPv6 is still fighting for adoption.

Re: One bad apple can spoil your IPv6 privacy (2022)

#24

Post by JohnFen »

noinsight wrote: post #21
JohnFen wrote: post #19

Earlier quoted context omitted.

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

> I don't want any random machines behind my router to be able to open ports to the internet at large. The solution to this is a firewall, not NAT. As has always been. NAT is not a security feature and never has been. The fact that it blocks uninitiated inbound connectivity is an implementation detail, not its purpose.

> NAT is not a security feature and never has been.

True, and I don't think of it as such -- after all, NAT or not, it's my firewall doing the protecting. What NAT would buy me here is convenience, not security.

I could have the same level of security without NAT, but managing it properly is easier and less error-prone with it.

Re: One bad apple can spoil your IPv6 privacy (2022)

#25

Post by kstrauser »

JohnFen wrote: post #19
adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

> I don't want any random machines behind my router to be able to open ports to the internet at large.

While it's hypothetically possible to have NAT without a firewall, I've never personally touched or seen such a thing. I can confidently state that if you have NAT, you also have a firewall. Use it.

Re: One bad apple can spoil your IPv6 privacy (2022)

#26

Post by JohnFen »

Arnavion wrote: post #22
JohnFen wrote: post #19

Earlier quoted context omitted.

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

Since every IPv6 discussion on HN has to repeat this misunderstanding, I'll just link to what I posted last time: https://news.ycombinator.com/item?id=39997078

What misunderstanding? I am familiar with what you wrote, and am not disagreeing. There is nuance here that seems to get lost whenever this topic comes up.

Re: One bad apple can spoil your IPv6 privacy (2022)

#27

Post by JohnFen »

kstrauser wrote: post #25
JohnFen wrote: post #19

Earlier quoted context omitted.

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

> I don't want any random machines behind my router to be able to open ports to the internet at large. While it's hypothetically possible to have NAT without a firewall, I've never personally touched or seen such a thing. I can confidently state that if you have NAT, you also have a firewall. Use it.

I never said a thing about not using a firewall. My firewall is what protects my LAN, after all.

Re: One bad apple can spoil your IPv6 privacy (2022)

#28

Post by kstrauser »

JohnFen wrote: post #24
noinsight wrote: post #21

Earlier quoted context omitted.

> I don't want any random machines behind my router to be able to open ports to the internet at large. The solution to this is a firewall, not NAT. As has always been. NAT is not a security feature and never has been. The fact that it blocks uninitiated inbound connectivity is an implementation detail, not its purpose.

> NAT is not a security feature and never has been. True, and I don't think of it as such -- after all, NAT or not, it's my firewall doing the protecting. What NAT would buy me here is convenience, not security. I could have the same level of security without NAT, but managing it properly is easier and less error-prone with it.

Having managed both, it is absolutely, 100%, not easier to manage NAT than a firewall. For example, here's a valid OpenBSD pf configuration:

  pass out on $ext_if from any to any
That's it. That's the entire stateful firewall config: Don't allow anything inbound at all, except directly in response to an outbound connection.

If your firewall has a GUI, it'll be as easy to configure that as it is the NAT. If your firewall has a CLI, I guarantee there's no NAT in the world that's easier to configure than the above stateful firewall.

Re: One bad apple can spoil your IPv6 privacy (2022)

#29

Post by Arnavion »

JohnFen wrote: post #26
Arnavion wrote: post #22

Earlier quoted context omitted.

Since every IPv6 discussion on HN has to repeat this misunderstanding, I'll just link to what I posted last time: https://news.ycombinator.com/item?id=39997078

What misunderstanding? I am familiar with what you wrote, and am not disagreeing. There is nuance here that seems to get lost whenever this topic comes up.

The misunderstanding that "I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic." is something that happens with v4 and not with v6, or that it has anything at all to do with NAT.

Re: One bad apple can spoil your IPv6 privacy (2022)

#30

Post by kstrauser »

JohnFen wrote: post #27
kstrauser wrote: post #25

Earlier quoted context omitted.

> I don't want any random machines behind my router to be able to open ports to the internet at large. While it's hypothetically possible to have NAT without a firewall, I've never personally touched or seen such a thing. I can confidently state that if you have NAT, you also have a firewall. Use it.

I never said a thing about not using a firewall. My firewall is what protects my LAN, after all.

Then you’re not getting any extra protection from a NAT.
Post reply on HN