Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New Internet

tailscale.com

Post reply on HN
Print view View original

291–300 of 315 posts

Re: The New Internet

#291

Post by MerManMaid »

Borg3 wrote: post #99
wmf wrote: post #24

Earlier quoted context omitted.

Apenwarr is kind of an IPv6 hater. He thinks it's not going to happen.

Because IPv6 is mistake. Thats why market does NOT want it. Unfortunately, we all start to feel the heat of IPv4 exhaustion. Anyway, remember IPv4 classes? Then they made it classless. IPv6 is not 128bit, its just 64bit with 64bit host address. So, first mistake. IPsec mandatory? pure stupidity. Crypto moves fast, every 10 years many protocols are obsoleted. How you will provide E2E connectivity with that? In 1997 IP…

>What IPng team should do, is just take IPv4, extended it to 64bit, call it IPv6 and we are done.

This is literally what they did, except they made it 128 bit rather than 64.

The thing you're missing is that literally every IPv4 protocol breaks the second you change bit count. Before you change the 32-bit header you need to (a) redefine bit for bit every IP protocol so it can be understood by each IP capable device (b) somehow send a full-proof update to every IPv4 device in the world redefining how they ought to interpret IPv4 headers.

Re: The New Internet

#292

Post by orangeboats »

pas wrote: post #268
superb_dev wrote: post #260

Earlier quoted context omitted.

So then what’s this default firewall rule I have that blocks all non-established connections? NAT is not required for any of the things you’re talking about.

okay now I'm curious what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox? without having a corresponding conntrack entry they will be dropped (and maybe even an ICMP message sent back, depending on the protocol), no? for example if there is an incoming TCP packet with a 4-tuple (src ip, src port, dst ip, dst port) ... by necessity "dst ip" is the public IP of the NAT box,…

>what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox?

You get a Full Cone NAT. Once the middlebox maps an (internal IP, port) tuple to an external port, every connection to that external port would lead to that internal tuple.

Why should Host C be able to reach Host A, when Host A is only speaking to Host B?

I am sure you know this but still, I have to stress that NAT is merely a mapper from one tuple to another tuple. If your router can handle NAT it certainly can handle an IPv6 firewall. And modern home/SOHO routers come with IPv6 firewall enabled by default (for the non-home routers, you have a bigger issue if your networking guys are not checking whether firewall is active) so I find the firewall discussions utterly as meaningless as someone fearing their DHCP server is not turned on by default. And frankly speaking, it's just an excuse for not implementing IPv6 -- saying that your ISP doesn't provide IPv6 connectivity would have been more convincing.

Re: The New Internet

#293

Post by orangeboats »

viraptor wrote: post #113
lockywolf wrote: post #106

Earlier quoted context omitted.

Double NAT is now almost everywhere in the world, except maybe USA.

What kind of Nat though? You can use upnp, predictable mapping, etc. and still allow the traffic through. And that's only with ipv4, because you can run zerotier over IPv6.

The vast majority of CGNATs across the world don't support the PCP protocol for predictable mapping.

Re: The New Internet

#294

Post by Borg3 »

MerManMaid wrote: post #291
Borg3 wrote: post #99

Earlier quoted context omitted.

Because IPv6 is mistake. Thats why market does NOT want it. Unfortunately, we all start to feel the heat of IPv4 exhaustion. Anyway, remember IPv4 classes? Then they made it classless. IPv6 is not 128bit, its just 64bit with 64bit host address. So, first mistake. IPsec mandatory? pure stupidity. Crypto moves fast, every 10 years many protocols are obsoleted. How you will provide E2E connectivity with that? In 1997 IP…

>What IPng team should do, is just take IPv4, extended it to 64bit, call it IPv6 and we are done. This is literally what they did, except they made it 128 bit rather than 64. The thing you're missing is that literally every IPv4 protocol breaks the second you change bit count. Before you change the 32-bit header you need to (a) redefine bit for bit every IP protocol so it can be understood by each IP capable device (…

I do NOT miss that point. The point is, new protocol should not be very different from previous one, unless its really necessary. After all those years and R&D put into IPv4 to make it better, we ended up with decent protocol. The only flaw is too small address space. With current IPv6, you have to throw up half of the stuff you know about IPv4 for, imo, no valid reason.

And I will tell it again to be clear. Im not fan of some IPv4+ contraption ideas like lets extend IPv4 address space and try to keep it IPv4. Thats DUMB. Make new protocol, improve things that were bad in IPv4 (are they any?) and try to make it one way interop to IPv4 (IPv6 -> IPv4) and we are done.

Remember that you are building protocol for entire planet. It have to be relativly simple and easy to implement. Any extras should be layer up. The whole IoT crap annoys me a lot. This stuff should NEVER ever be connected directly to internet. It creates huge security mess. There should be IoT GW to handle IP (whatever IoT proto) and provide security.

Re: The New Internet

#295

Post by pas »

orangeboats wrote: post #292
pas wrote: post #268

Earlier quoted context omitted.

okay now I'm curious what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox? without having a corresponding conntrack entry they will be dropped (and maybe even an ICMP message sent back, depending on the protocol), no? for example if there is an incoming TCP packet with a 4-tuple (src ip, src port, dst ip, dst port) ... by necessity "dst ip" is the public IP of the NAT box,…

>what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox? You get a Full Cone NAT. Once the middlebox maps an (internal IP, port) tuple to an external port, every connection to that external port would lead to that internal tuple. Why should Host C be able to reach Host A, when Host A is only speaking to Host B? I am sure you know this but still, I have to stress that NAT is m…

Thanks, I wasn't familiar with this term!

I think you misunderstand my post. My "philosophical inquiry" is about trying to get to the bottom of this, and it seem to me that NAT, as virtually everywhere deployed and found in the unspeakably many SoHo setups, is a stateful NAT, and it's implicitly a bad firewall.

So when people say that this is "meme" should die .... well they are right, but not technically right, no?

Re: The New Internet

#296

Post by PLG88 »

johnklos wrote: post #259
mike_d wrote: post #236

Earlier quoted context omitted.

> TailScale has been at all times a good actor. This is the Cloudflare problem all over again. One day Matthew Prince will get hit by a bus, all the "trustworthy people" will leave, a PE firm will take the company private, and merge it with an ad network. Congrats, the entire internet now has a single companies ads all over it and we let it happen because we happened to like the people fucking us.

Matthew Prince is definitely not a good actor, but that's not the point. What Cloudflare did was they acted like good people, said good things, even did some good things, but once they got enough business and momentum, they then started doing shadier and shadier things, and now they're a protection racket that is happy to protect scammers for a fee. I think Cloudflare's most ardent fans would have trouble articulatin…

Check out OpenZiti then - https://openziti.io/. Its Tailscale on steroids, with. (IMHO) a much more scalable implementation of zero trust principles.

Re: The New Internet

#297

Post by PLG88 »

otabdeveloper4 wrote: post #269
teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

The problem with TCP/IP is the lack of a standard and robust VPN/overlay network protocol. Everything we have is extremely fragmented and/or proprietary. IPv6 is completely useless and doesn't solve this problem. Normal people don't care if they have to pay 5 dollars instead of 50 cents to rent an IP address. This is a problem specific only to the huge providers, and we don't need to rollout a whole internet upgrade…

We are trying to change that with OpenZiti - https://openziti.io/. Its an open source network overlay built with zero trust principles and deny by default in mind. We also built it for developers, so includes SDKs and other means to embed overlay networking directly into the SDLC.

Re: The New Internet

#298

Post by PLG88 »

teddyh wrote: post #142
tomjen3 wrote: post #137

Earlier quoted context omitted.

I think that is excessively negative take. Tailscales value proposition is also "you can connect to your network wherever you are, safely, and others cannot". That does not go away because of IPsec.

Network- and location-based security is ultimately unworkable. It’s like if you, in order to work, had to go to a ”virtual office” to even send mail to your colleagues. Mail, and related internet-enabled services, should be accessible from anywhere , and be secured at the end points, not at the network layer. (Most attacks are internal, anyway.)

secured at the endpoints yes... I would argue you can go one step further, doing it at the application level. This is what we built (and open sourced) with OpenZiti (https://openziti.io/), the ability to embed an overlay network, built on zero trust and deny by default principles, directly into the app as part of the SDLC.

If you do this, your application has no listening ports on the WAN, LAN, or host OS network and thus cannot be attacked from the external network/IP.

The asymmetry of risk now favours the defender, not attacker. Oh, plus we also have pre-built tunnelers for endpoints if you cannot do app embedded.

Re: The New Internet

#299

Post by PLG88 »

yjftsjthsd-h wrote: post #56
jgalt212 wrote: post #16

Earlier quoted context omitted.

If you had to move off of tailscale, what would you move to?

I think nebula is the obvious FOSS competitor? With the unfortunate exception of the Android client being closed source.

OpenZiti would be another - https://openziti.io/. I work on the project. 1 issue with Nebula is the provisioning new clients with identities. Its not completely open sourced by the Nebula company.

Re: The New Internet

#300

Post by aboardRat4 »

orangeboats wrote: post #292
pas wrote: post #268

Earlier quoted context omitted.

okay now I'm curious what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox? without having a corresponding conntrack entry they will be dropped (and maybe even an ICMP message sent back, depending on the protocol), no? for example if there is an incoming TCP packet with a 4-tuple (src ip, src port, dst ip, dst port) ... by necessity "dst ip" is the public IP of the NAT box,…

>what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox? You get a Full Cone NAT. Once the middlebox maps an (internal IP, port) tuple to an external port, every connection to that external port would lead to that internal tuple. Why should Host C be able to reach Host A, when Host A is only speaking to Host B? I am sure you know this but still, I have to stress that NAT is m…

> If your router can handle NAT it certainly can handle an IPv6 firewall.

The point is not that "it can", the point is that on ipv4 "it doesn't work without".

In order for ipv4 to work at all you MUST use NAT, and implicitly a firewall, those two always work together even if there the person installing the system doesn't know the word "firewall", which is usually the case.

Post reply on HN