Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

91–100 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#91

Post by da_chicken »

ghshephard wrote: post #9

This is the first thing that as a Network Engineer I was taught - and every formal security class I've taken (typically from Cisco - they have awesome course) - repeats the same thing. I believe the common knowledge is somewhat more nuanced than people would have you believe I present to you two separate high-value targets whose IP address has leaked: IPv4 Target: 192.168.0.1 IPv6 Target: 2001:1868:209:FFFD:0013:50FF…

I'm sorry, this is just an elaborate argument of obscurity-as-security. You're clinging to privacy as though it were security, in stark avoidance of Kerckhoffs's principle.

Re: IPv6 is not insecure because it lacks a NAT

#92

Post by simoncion »

tptacek wrote: post #76
zamadatix wrote: post #73

Earlier quoted context omitted.

One could see the inlined, sourced, and dated references I placed above about the PIX rather than searching online from scratch or making assumptions of others reasons or intentions. What some people do or don't want in the 2020s has no relevance to the reasoning in the 1990s, nor does it redefine the purpose or use of NAT the same. The above is clearly and directly stated from the sourced material of the era itself:…

Your own sources confirm what I'm saying.

> Your own sources confirm what I'm saying.

I don't see where they do. I see them talking almost exclusively about working around address depletion.

Hell, look at Cisco's press release for its acquisition of Network Translation, Inc. [0] It's all about address depletion and resource efficiency; security is mentioned as an afterthought. I'll quote the relevant paragraphs (and leave in the line break mangling present in the original).

  SAN JOSE, Calif., October 27, 1995 - Cisco Systems Inc. today announced anagreement to purchase privately-held Network Translation, Inc. (NTI), anetworking manufacturer of cost-effective, low maintenance network addresstranslation (NAT) and Internet firewall equipment. The investment isintended to broaden Cisco's offerings for security conscious networkadministrators who want to dynamically map between reusable private networkaddresses and globally unique, registered Internet addresses. Through itsacquisition, Cisco will gain NTI's Private Internet Exchange (PIX) solutionwhich helps network administrators resolve their growing need forregistered IP address space. NTI's 10 employees and products will beincorporated into Cisco's Business Development efforts reporting to VicePresident Ed Kozel. The financial terms of the purchase are not beingdisclosed. The transaction is expected to close by the end of November andis not subject to the Hart-Scott-Rodino filing.
  
  The NTI investment is the second action by Cisco in recent months tostrengthen its expertise in resource-effective Internet access technology.NTI technology will interoperate with and integrate several functions ofthe Cisco Internetwork OperatingSystem(tm) (Cisco IOS) software,facilitating use throughout the enterprise. NTI addresses two of the morecompelling problems facing the IP Internet -- IP address depletion andInternet security. Customers using the NATalgorithm can take advantage ofa larger than assigned pool of addresses. NAT makes it possible to useeither your existing IP addresses or the addresses set aside in InternetAssigned Number Authority's (IANA) reserve pool (RFC 1597). Cisco's goal ofintegrating NTI's technology and personnel is to ease the complexity ofInternet access for applications including telecommuting and World Wide Webaccess.
[0] https://newsroom.cisco.com/c/r/newsroom/en/us/a/y1995/m10/ci...>

Re: IPv6 is not insecure because it lacks a NAT

#93

Post by mbreese »

NewJazz wrote: post #89
theamk wrote: post #81

Earlier quoted context omitted.

No, that's the whole point. Imagine I've shared output of "ifconfig" on my machine, or "netstat" output, or logs for some network service which listed local addresses. For IPv4, this will is totally fine and leaks minimal information. For IPv6, it'll be a global, routable address.

That's a pretty weird threat model. Like, yeah commands you run on your machine can expose information about that machine.

Especially as if someone is able to capture ifconfig data, they can probably send a curl request to a malicious web server and expose the NAT IP as well.

Re: IPv6 is not insecure because it lacks a NAT

#94

Post by otterley »

zamadatix wrote: post #63
otterley wrote: post #40

Earlier quoted context omitted.

It depends on how you've configured the router. It's quite common to reject or drop ingress traffic received on an egress interface destined to a NATed network address. In fact, I would flag any configuration that didn't have that.

Yes, but we've just successfully rewritten the article in the comment section as "it's not having NAT that provides the security itself, but other configuration any sane person would expect on a device doing NAT to prevent unexpected inbound connections" is exactly what the article set out to separate.

Fair point!

Re: IPv6 is not insecure because it lacks a NAT

#95

Post by tptacek »

simoncion wrote: post #92
tptacek wrote: post #76

Earlier quoted context omitted.

Your own sources confirm what I'm saying.

> Your own sources confirm what I'm saying. I don't see where they do. I see them talking almost exclusively about working around address depletion. Hell, look at Cisco's press release for its acquisition of Network Translation, Inc. [0] It's all about address depletion and resource efficiency; security is mentioned as an afterthought. I'll quote the relevant paragraphs (and leave in the line break mangling present i…

Read the Data Communications article they provided:

PIX also increases network security. Since there's no way for anyone on the Internet to know which machine on the corporate network is using a Class C address at any given time, it's impossible to establish a telnet or FTP session with any particular device.

And what about hosts that should be recognizable from the Internet, such as mail servers? These either can be directly attached to the Internet and assigned a public address or can be attached through PIX. In the latter case, the translator is config- ured to map one of the external addresses to the device not just for the duration of an application session but on a permanent basis.

At some point you're going to have to find a way to argue that the Cisco PIX was not a security device; again: it was the flagship product of the security SBU.

I was there at the time, doing IP network engineering (for a Chicagoland ISP). The PIX was a security device, and NAT was understood as a security feature (for sure, also an address depletion feature, but the argument that's being made in the post isn't merely that it was an address depletion thing, but also that it categorically wasn't a security feature, which is just obviously false.)

Re: IPv6 is not insecure because it lacks a NAT

#97

Post by paulddraper »

lq9AJ8yrfs wrote: post #88

NAT causes security issues too. Reflection attacks are much harder to stop if the endpoint and its network address are decoupled. You can provoke loops and tangles of many sorts, some at the same protocol level and others going up and down. My memory is fading but I vaguely recall a time when all of AOL shared something like a dozen egress addresses for certain traffic -- might have been proxies as opposed to NAT/"PA…

The RFC introducing NAT -- RFC 1631 -- says:

> Unfortunately, NAT reduces the number of options for providing security [1]

Somehow, everyone forgot that, and it morphed into a cargo-culting security practice, even going so far as to propagate 1990s network limitations into the cloud(!)

[1] https://www.rfc-editor.org/rfc/rfc1631.html

Re: IPv6 is not insecure because it lacks a NAT

#98

Post by john01dav »

alanfranz wrote: post #83
MobiusHorizons wrote: post #16

Fun fact I have actually had an sbc get hacked because I didn’t change the default password. I thought it would be reasonably safe for a few days because I knew the VLAN it was on had NAT and the associated firewall rules that deny inbound packets without outbound. But it turned out ipv6 was also enabled on that VLAN with no firewall. Left a bad taste in my mouth over a decade later even if it was a misconfigured fir…

…and they did really guess an ipv6 address? Full scans of the ipv6 address space looks infeasible. Or did the sbc reach out to the internet thus having its address exposed? Otherwise just the huge amount of addresses should make ipv6 “more secure” imho.

I don't know how much impact this has in practice, but you do not need to scan the entirety of the ipv6 address space because you can just look at the IPs that are registered to known ISPs/ASs.

Re: IPv6 is not insecure because it lacks a NAT

#99

Post by mystraline »

Dagger2 wrote: post #18
radlad wrote: post #4

Earlier quoted context omitted.

That's a great point - the packet is not dropped by the firewall as a result of NAT - but it still won't route anywhere because the IP in the packet is that of the router itself. I've updated the article as a result of your comment, thanks.

It might be the IP of the router, in which case the router itself will accept the connection if something is listening (like the web interface perhaps). But whoever sent you the L2 frame has full control over the contents of the IP in the packet, so it could be anything. NAT doesn't protect you from either of these.

Repeating the same wrong points doesnt make you right.

Every NAT based product will have a firewall built in also by default. And it'll be deny-all except for conn-tracked.

And that L2 attack is a martian packet. Why are you allowing reserved IPs talk on public network interfaces (hello, spoofing and obvious at that)? These are always blocked due to the reasons you describe.

https://en.wikipedia.org/wiki/Martian_packet

Re: IPv6 is not insecure because it lacks a NAT

#100

Post by amarant »

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall.

NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

Post reply on HN