Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

11–20 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#11

Post by kibwen »

omgJustTest wrote: post #8

NAT is not inherently a security feature, however where NAT happens is somewhat important. A local router that I can control deals with how to map from my public IP to my private IPs. This is not security but is obfuscation of the traffic. Obfuscation becomes almost impossible in the IPV6 context where NAT isn't necessary, it becomes optional, and given the likely trajectory that option will be exercised by sophistic…

As the article mentions, if you want to use NAT with IPv6, you can. The fact that it's optional doesn't mean that address obfuscation is suddenly impossible.

Re: IPv6 is not insecure because it lacks a NAT

#12

Post by ghshephard »

ggm wrote: post #2

Not wishing to undermine the central point, NAT for v6 is a thing. The point of the article is that it's not "NAT by default" the way home IPv4 is because so few places worldwide get more than a single IP per customer: The NAT is not there in v4 for security, it's to provide for multiple devices inside the home. Or, in the case of Carrier-Grade NAT, to manage multiple customers, behind a small pool of v4. NAT doesn't…

Just to nitpick a bit. What people typically mean when they say "IPV4 NAT" is Network and Port translation. My 192.168.0.1 internally becomes 172.217.12.100 and my port gets converted to something that is tracked so that the return packet can find it's target.

In IPv6, Prefix-Translation is similar, in that the /64 prefix is translated 1:1 - but the /64 Host address is (in my experience) left alone - so that renumber a network becomes trivial when you change ISPs - you just just change the prefix.

I don't actually know if "IPv4 NAT" behavior even exists in the IPv6 world, except in the form of a lab experiment.

Re: IPv6 is not insecure because it lacks a NAT

#13

Post by tptacek »

This has been gospel among snooty network engineers for decades, but NAT was initially introduced to the wider market as a security feature, and it is absolutely a material factor in securing networks. The network engineers are wrong about this.

(IPv6 is still good for lots of other reasons, and NAT isn't good security; just material.)

Re: IPv6 is not insecure because it lacks a NAT

#14

Post by tptacek »

ghshephard wrote: post #9

This is the first thing that as a Network Engineer I was taught - and every formal security class I've taken (typically from Cisco - they have awesome course) - repeats the same thing. I believe the common knowledge is somewhat more nuanced than people would have you believe I present to you two separate high-value targets whose IP address has leaked: IPv4 Target: 192.168.0.1 IPv6 Target: 2001:1868:209:FFFD:0013:50FF…

Deeply ironic that Cisco would teach this, because it's the opposite of what they said when they introduced NAT.

Re: IPv6 is not insecure because it lacks a NAT

#15

Post by tadfisher »

Sohcahtoa82 wrote: post #5

This is going to depend on the router and on IP distribution. My ISP does not give me an IPv6 address, only a single IPv6 which all my network devices have to NAT through. NAT is not intended to be a security feature, for sure, but it creates security as a side effect . If I start up a web server on one of my devices, I know that it is unreachable from the Internet unless I go out of my way to set a port forward on m…

> If each of my devices gets an Internet routable IPv6 address, at that point, that security-as-a-side-effect is not guaranteed unless my router has a default-deny firewall. I would hope that any routers would ship with that.

They usually do, and they also ship with the most wonderful technology ever specified within a 67 MB compressed archive [0]: UPnP! Now your attacker's job is to convince you to initiate an outgoing connection, which automatically forwards an incoming port to your device behind the NAT and bypassing the router's default-deny firewall! Nothing has ever gone wrong with a zero-configuration port-forwarding protocol from the 1990s rammed through the ISO!

[0]: https://openconnectivity.org/developer/specifications/upnp-r...

Re: IPv6 is not insecure because it lacks a NAT

#16

Post by MobiusHorizons »

Fun fact I have actually had an sbc get hacked because I didn’t change the default password. I thought it would be reasonably safe for a few days because I knew the VLAN it was on had NAT and the associated firewall rules that deny inbound packets without outbound. But it turned out ipv6 was also enabled on that VLAN with no firewall. Left a bad taste in my mouth over a decade later even if it was a misconfigured firewall rather than an inherent issue with ipv6.

Re: IPv6 is not insecure because it lacks a NAT

#17

Post by ghshephard »

tptacek wrote: post #14
ghshephard wrote: post #9

This is the first thing that as a Network Engineer I was taught - and every formal security class I've taken (typically from Cisco - they have awesome course) - repeats the same thing. I believe the common knowledge is somewhat more nuanced than people would have you believe I present to you two separate high-value targets whose IP address has leaked: IPv4 Target: 192.168.0.1 IPv6 Target: 2001:1868:209:FFFD:0013:50FF…

Deeply ironic that Cisco would teach this, because it's the opposite of what they said when they introduced NAT.

Well - I can't say they have always said this - but at least for Circa 1998 CCNP onwards that's been their position. The instructors were very adamant - to the point that I'm recalling this 27+ years later.

Re: IPv6 is not insecure because it lacks a NAT

#18

Post by Dagger2 »

radlad wrote: post #4
Dagger2 wrote: post #3

> The consequence of this is that when receiving inbound traffic, the router needs needs to be configured with where to send the traffic on the local network. As a result, it will drop any traffic that doesn’t appear in the “port forwarding” table for the NAT. As I keep trying to explain each time this comes up: no, it doesn't and it won't. When your router receives incoming traffic that isn't matched by a NAT state…

That's a great point - the packet is not dropped by the firewall as a result of NAT - but it still won't route anywhere because the IP in the packet is that of the router itself. I've updated the article as a result of your comment, thanks.

It might be the IP of the router, in which case the router itself will accept the connection if something is listening (like the web interface perhaps). But whoever sent you the L2 frame has full control over the contents of the IP in the packet, so it could be anything.

NAT doesn't protect you from either of these.

Re: IPv6 is not insecure because it lacks a NAT

#19

Post by tptacek »

ghshephard wrote: post #17
tptacek wrote: post #14

Earlier quoted context omitted.

Deeply ironic that Cisco would teach this, because it's the opposite of what they said when they introduced NAT.

Well - I can't say they have always said this - but at least for Circa 1998 CCNP onwards that's been their position. The instructors were very adamant - to the point that I'm recalling this 27+ years later.

This probably has more to do with network engineers (and CCNP instructors) not being security engineers (or even conversant with Cisco's security SBU).
Post reply on HN