Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One bad apple can spoil your IPv6 privacy (2022)

arxiv.org

Post reply on HN
Print view View original

51–60 of 64 posts

Re: One bad apple can spoil your IPv6 privacy (2022)

#51

Post by ranger_danger »

kstrauser wrote: post #28
JohnFen wrote: post #24

Earlier quoted context omitted.

> NAT is not a security feature and never has been. True, and I don't think of it as such -- after all, NAT or not, it's my firewall doing the protecting. What NAT would buy me here is convenience, not security. I could have the same level of security without NAT, but managing it properly is easier and less error-prone with it.

Having managed both, it is absolutely, 100%, not easier to manage NAT than a firewall. For example, here's a valid OpenBSD pf configuration: pass out on $ext_if from any to any That's it. That's the entire stateful firewall config: Don't allow anything inbound at all, except directly in response to an outbound connection. If your firewall has a GUI, it'll be as easy to configure that as it is the NAT. If your firewal…

Depending on your threat level and exact firewall configuration, any bidirectional connection can be used to punch through in some way.

Re: One bad apple can spoil your IPv6 privacy (2022)

#52

Post by Dagger2 »

JohnFen wrote: post #19
adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

NAT is actually less restrictive for inbound connections, because it allows people to connect with just the correct port and not the correct IP+port. Instead of needing to provide the correct 80-bit number to connect, they only need the correct 16-bit number, which is small enough to brute-force.

NAT doesn't even stop machines opening ports; it's your firewall doing that. It's not NAT giving you a single point of presence, that's your router. It doesn't normally restrict outbound connections either, so what's the point? All it's doing is presenting your servers in a way that makes them easier to find.

NAT doesn't do any of the things you've claimed to need it for.

Re: One bad apple can spoil your IPv6 privacy (2022)

#53

Post by Dagger2 »

noinsight wrote: post #21
JohnFen wrote: post #19

Earlier quoted context omitted.

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

> I don't want any random machines behind my router to be able to open ports to the internet at large. The solution to this is a firewall, not NAT. As has always been. NAT is not a security feature and never has been. The fact that it blocks uninitiated inbound connectivity is an implementation detail, not its purpose.

It doesn't even do that much. NAT is something you apply to outbound connections, not to inbound ones. Unless there's a firewall blocking it, you can connect inwards over a router that's NATing its outbound connections.

Re: One bad apple can spoil your IPv6 privacy (2022)

#54

Post by tenebrisalietum »

_carbyau_ wrote: post #48

Everytime IPv6 comes up there's back and forth on NAT vs firewall etc etc. That's easy. IPv6 has more flexibility. You do what you want and leave everyone else to do what they want. Networking stuff will break sure, but hasn't it always... I haven't gone to IPv6 at home because working with an IPv6 string is so much harder. I can't always copy'n'paste addresses. I often shout/phone an address to someone else to type…

> I haven't gone to IPv6 at home because working with an IPv6 string is so much harder.

Setup DNS, configure something mdns based like Avahi, or use the hosts file.

> I can't always copy'n'paste addresses. I often shout/phone an address to someone else to type in.

This is weird and not a normal need on a well-run network, or if you have the above working.

Re: One bad apple can spoil your IPv6 privacy (2022)

#55

Post by chipdart »

toast0 wrote: post #50
drdaeman wrote: post #42

Earlier quoted context omitted.

I think the real question is "what the hell IoT is doing on a globally-routable network?" Put it on an isolated VLAN with no Internet connectivity. Or a minimal connectivity only to what's absolutely necessary (e.g. I haven't seen IoT devices that need inbound connections, so drop any inbound packets unless conntrack says otherwise). There there will be probably no need for weird NAT66 contraptions or anything like t…

> Put it on an isolated VLAN with no Internet connectivity. It's hardly an Internet of Things if your Things aren't connected to the Internet :p

From the very first paragraph of Wikipedia's article on IoT:

> "Internet of things" has been considered a misnomer because devices do not need to be connected to the public internet; they only need to be connected to a network[6] and be individually addressable.[7][8]

Re: One bad apple can spoil your IPv6 privacy (2022)

#56

Post by m463 »

adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

I just use ipv4 in my network.

it's my personal network (and my personal opinion/solution).

I turn off ipv6. I don't want to maintain two sets of firewall rules, or have some weird routing problem that lets packets in or out.

I add this to my linux kernel command line:

  ipv6.disable=1 ipv6.ipv6_disable=1
sometimes in /etc/sysctl.d/00-nov6.conf:

  net.ipv6.conf.all.disable_ipv6=1
  net.ipv6.conf.default.disable_ipv6=1
in macos I do:

   networksetup -setv6off 'Ethernet 1'  (or whatever network interface)
helps me be more organized.

Re: One bad apple can spoil your IPv6 privacy (2022)

#57

Post by [deleted] »

jeroenhd wrote: post #37
kstrauser wrote: post #25

Earlier quoted context omitted.

> I don't want any random machines behind my router to be able to open ports to the internet at large. While it's hypothetically possible to have NAT without a firewall, I've never personally touched or seen such a thing. I can confidently state that if you have NAT, you also have a firewall. Use it.

Because of NAT ALGs, most consumer NAT devices actually allow plaintext protocols to bypass the internet-facing firewalls inside routers. Unless you program your own ALGs, you basically get to pick between "SIP, FTP, and a bunch of other protocols don't work without port forwards" or "your public firewall is off for almost anyone who can make your computer load an ad". NAT breaks internet protocols and as a result we…

[deleted]

Re: One bad apple can spoil your IPv6 privacy (2022)

#58

Post by adriancr »

kstrauser wrote: post #17
bb88 wrote: post #14

Earlier quoted context omitted.

NAT is broken by design. And CG-NAT can't do any kind of port forwarding on the routers. And adding more NAT is just breaking more networks. RFC 4941 is currently old enough to be taking it's SAT's and preparing itself for college... :)

I’m thrilled to have good end-to-end connectivity to the degree I’m willing to configure my firewall for it. When I hear people in other threads talking about the “security advantages” of NAT, I imagine someone filling their car’s engine with walnuts and talking about how it protects them from speeding tickets.

That's the thing, you don't have good end-to-end connectivity if you configure the firewall as you should and block everything similar to what NAT does.

After which, you have a question, how can you configure end-to-end connectivity securely?, which host(s) do you open up ports towards?

Re: One bad apple can spoil your IPv6 privacy (2022)

#59

Post by [deleted] »

Dagger2 wrote: post #52
JohnFen wrote: post #19

Earlier quoted context omitted.

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

NAT is actually less restrictive for inbound connections, because it allows people to connect with just the correct port and not the correct IP+port. Instead of needing to provide the correct 80-bit number to connect, they only need the correct 16-bit number, which is small enough to brute-force. NAT doesn't even stop machines opening ports; it's your firewall doing that. It's not NAT giving you a single point of pre…

[deleted]

Re: One bad apple can spoil your IPv6 privacy (2022)

#60

Post by labcomputer »

kstrauser wrote: post #8
adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

Going further still, forget all the NAT breakage and require all devices to actually use the privacy extensions described in RFC 4941 17 years ago. A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers. There are reasons you might want your desktop to have the same address for a long time. I can't think of any reason why I'd want that for a light bulb.

> A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers.

So… I’m not saying you don’t want to do that, but I do want to expand on this a bit:

4941 is not the only way to avoid having your MAC address in your IPv6 address. In fact RFC 3972 (from 2005! Almost old enough to buy beer!) describes a method for stable “cryptographic” addresses which enable the host to attest to the address’s authenticity in ND. That’s a really powerful feature because it means that another host can’t impersonate you like they can with ARP on v4. RFC 3972 is what macOS uses for the “non temporary” address (the one ifconfig labels “secured”). One of the things everyone should know about 3972 addresses is that a host will generate different addresses on different prefixes (so you can’t correlate a host moving between networks like you could with a MAC-derived address).

It is expected and normal that a host should have at least two “non temporary” addresses: a link local one, plus one generated by 3972 (or DHCPv6 or some other mechanism), in addition to one or more 4941 temporary addresses.

One way to block MAC-derived addresses without breaking e2e connectivity is to add a firewall rule blocking addresses with “FFFE” in the middle.

Post reply on HN