Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

111–120 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#111

Post by kingstnap »

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

If the end effect of security is dropping packets NAT and Firewalls both in effect drop packets.

Its kind of just silly pedantry to say NATs aren't security because sure you can't do things like block specific ranges of IPs spamming you (or make outbound rules to control local devices) but 99% of people don't need.

Re: IPv6 is not insecure because it lacks a NAT

#112

Post by Spivak »

ghshephard wrote: post #57
zamadatix wrote: post #35

Earlier quoted context omitted.

I'm not sure I buy the "you get a leak of the address of a high value target you believe can be routed to over the internet in some fashion, but it's the internal address which leaked and you have no idea who could own said high value target either" story. I agree if it's an actual concern then you can use NAT66 to hide the prefix, I just don't see how this achieves security when the only publicly accessible attack p…

NAT66 doesn't add much in the way of security here, because the external address is fully routable and maps 1:1 to the internal address. You are once again fully dependent on a correctly configured firewall. The IPv6 address that I shared was, in fact, a static (and real) IPv6 address, belonging to a real device - with the possible exception of the last 3 bytes, was likely one I worked on frequently. Put another way…

Hardest to attack:

fcab:cdef:1234:5678:9abc:def0:1234:5678

The whole point is that your devices on the inside of your network can't be routed to at all.

Re: IPv6 is not insecure because it lacks a NAT

#113

Post by Sohcahtoa82 »

Dagger2 wrote: post #85
Spivak wrote: post #80

Earlier quoted context omitted.

With NAT your device does not have a publicly routable address. Attackers have no way of contacting you at all. Without NAT you have a publicly routable address and attackers can try reaching out to your device. You rely entirely on your device's and your router's firewall. So it's not really about NAT although it ends up being a consequence—it's about having a truly private network "air gapped" from the public inter…

No, NAT only affects which IP your connections appear to be coming from. It doesn't change which IPs your devices actually have. The person I replied to said that they only get a single v6 address. If that's true, it doesn't matter whether they have NAT or not; their network isn't going to have publicly-routable addresses either way. If your network is air-gapped then no connections will be happening at all, in or ou…

> No, NAT only affects which IP your connections appear to be coming from. It doesn't change which IPs your devices actually have.

Well no shit. The NAT is a requirement for devices without a publicly routable IP because if my router just sends packets out with a source address being my 192.168.1.101 local IP, my ISP is most likely just going to drop the packets.

You know this, I'm sure, so I'm really unsure what point you're trying to make.

> The person I replied to said that they only get a single v6 address. If that's true, it doesn't matter whether they have NAT or not; their network isn't going to have publicly-routable addresses either way.

Correction: It will have ONE publicly-routable IP, and if I assign it to my router, but don't use NAT, then none of my devices on the network will be able to talk to the Internet, either in or out.

Re: IPv6 is not insecure because it lacks a NAT

#114

Post by reincarnate0x14 »

stackghost wrote: post #101
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

I think the confusion stems from the fact that my mom's laptop with its 192.168.0.43/24 v4 address is not routable except via NAT, and people believe (rightly or wrongly) that that confers a degree of security.

UPNP and a dozen other NAT defeating tactics exist and have since the early 2000s. NAT translates addresses. Thinking a non-routable range is safe because it's behind NAT is at this point grossly ignorant of how modern network equipment works. It's kind of like port-knocking; yes it makes the attack slightly harder, but doesn't prevent it.

e.g. symmetric NAT exists and often doesn't come with a stateful firewall. Just because the linux box with iptables is protecting your network uses NAT doesn't mean NAT is doing the heavy lifting here. I can see the OMG MY PRIVACY crew is out in force here apparently misunderstanding that NAT does not do that either. I mean, we can explain things to you, but we can't understand it for you.

Re: IPv6 is not insecure because it lacks a NAT

#116

Post by solaris2007 »

MobiusHorizons wrote: post #16

Fun fact I have actually had an sbc get hacked because I didn’t change the default password. I thought it would be reasonably safe for a few days because I knew the VLAN it was on had NAT and the associated firewall rules that deny inbound packets without outbound. But it turned out ipv6 was also enabled on that VLAN with no firewall. Left a bad taste in my mouth over a decade later even if it was a misconfigured fir…

That's pretty embarrassing lol

Re: IPv6 is not insecure because it lacks a NAT

#117

Post by Sohcahtoa82 »

ImPostingOnHN wrote: post #108
Sohcahtoa82 wrote: post #104

Earlier quoted context omitted.

That's an entirely different attack scenario. To succeed at that attack, my computer would already need to be running malware. At that point, they've already won.

Or you visit a webpage that makes a request to an arbitrary server on an arbitrary port while not running a default-deny application firewall

I don't believe that opens a port to accept an incoming connection.

Even if it did, a web page making a request can't control the source port for the connection. They still couldn't make a local network service exposed to the Internet.

Re: IPv6 is not insecure because it lacks a NAT

#118

Post by MobiusHorizons »

alanfranz wrote: post #83
MobiusHorizons wrote: post #16

Fun fact I have actually had an sbc get hacked because I didn’t change the default password. I thought it would be reasonably safe for a few days because I knew the VLAN it was on had NAT and the associated firewall rules that deny inbound packets without outbound. But it turned out ipv6 was also enabled on that VLAN with no firewall. Left a bad taste in my mouth over a decade later even if it was a misconfigured fir…

…and they did really guess an ipv6 address? Full scans of the ipv6 address space looks infeasible. Or did the sbc reach out to the internet thus having its address exposed? Otherwise just the huge amount of addresses should make ipv6 “more secure” imho.

I don’t have any idea how they got the ip, it could certainly have been making outbound connections, though. I think it had NTP, although I might have pointed it at a local server we had for that.

Re: IPv6 is not insecure because it lacks a NAT

#119

Post by MobiusHorizons »

solaris2007 wrote: post #116
MobiusHorizons wrote: post #16

Fun fact I have actually had an sbc get hacked because I didn’t change the default password. I thought it would be reasonably safe for a few days because I knew the VLAN it was on had NAT and the associated firewall rules that deny inbound packets without outbound. But it turned out ipv6 was also enabled on that VLAN with no firewall. Left a bad taste in my mouth over a decade later even if it was a misconfigured fir…

That's pretty embarrassing lol

In my defense I was in college at the time, and I did actually run some tests to ensure my understanding of the firewall was correct. I just didn’t even think to account for ipv6 or especially for that range having different firewall rules.

Re: IPv6 is not insecure because it lacks a NAT

#120

Post by tucnak »

valleyer wrote: post #90
Gigachad wrote: post #32

Earlier quoted context omitted.

Every router I’ve ever used has blocked incoming connections on v6 exactly the same as on v4. Really the only difference is you can have multiple devices on your network allowed to receive on the same port if you want.

The Apple AirPort Extreme didn't by default until recently: https://support.apple.com/en-nz/103996

More like Extreme-ly bad router.
Post reply on HN