Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

121–130 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#121

Post by cyberax »

denkmoon wrote: post #7

Invoking NAT "security" as a reason against IPv6 is a surefire indicator the person invoking it has absolutely no idea what they're talking about and should not be allowed within typing distance of any network infrastructure

Please. _I_ invoked that argument, and I bet I know more about IPv6 than you do.

All my services and networks have IPv6. And my first operational issues with IPv6 were in 2008, when my Asterisk SIP server started failing after ~12 hours.

Culprit? Privacy addresses kept accumulating until they overflowed the SIP UDP packet size because it listed all the combinations of supported codecs/endpoints.

Oh, btw, do try to answer this message: https://www.reddit.com/r/VOIP/comments/131ex1x/ipv6_sip_trun... - it's still relevant to this day.

Re: IPv6 is not insecure because it lacks a NAT

#122

Post by cyberax »

tptacek wrote: post #21
denkmoon wrote: post #7

Invoking NAT "security" as a reason against IPv6 is a surefire indicator the person invoking it has absolutely no idea what they're talking about and should not be allowed within typing distance of any network infrastructure

As a reason not to IPv6? I guess. As a thing, not scare-quoted, but really security? No. Be careful with things like "absolutely no idea what they're talking about".

I don't think that the inherent security of NATs is a _good_ reason to not do IPv6.

But it _is_ a reason, and it _is_ true.

Re: IPv6 is not insecure because it lacks a NAT

#123

Post by tucnak »

Sohcahtoa82 wrote: post #5

This is going to depend on the router and on IP distribution. My ISP does not give me an IPv6 address, only a single IPv6 which all my network devices have to NAT through. NAT is not intended to be a security feature, for sure, but it creates security as a side effect . If I start up a web server on one of my devices, I know that it is unreachable from the Internet unless I go out of my way to set a port forward on m…

> my ISP still gives me only a single IPv6 address

This is criminal, and also incredibly uncommon. You should talk to your ISP, it's most definitely a misconfiguration of some kind, if not deliberate torture. Normally you get a /56 at least because there are so many and they cost nothing.

Re: IPv6 is not insecure because it lacks a NAT

#124

Post by dunder_cat »

wiredpancake wrote: post #87
alanfranz wrote: post #83

Earlier quoted context omitted.

…and they did really guess an ipv6 address? Full scans of the ipv6 address space looks infeasible. Or did the sbc reach out to the internet thus having its address exposed? Otherwise just the huge amount of addresses should make ipv6 “more secure” imho.

There was a report a few years back about people running NTP servers to harvest IPv6 addresses. Security via obscurity will only get you so far.

In theory, IPv6 Privacy Extensions (https://datatracker.ietf.org/doc/html/rfc4941) could mitigate this. In practice, I imagine when you bind to `[::]:port`, that also means that the randomized addresses would work for new inbound connections, too. Not sure how long they typically last, but you'd be fighting against the clock at least before a new randomized address.

That being said, on a slightly less common note: it is quite possible to have each individual service running on a /128. E.g. on IPv6 k8s clusters, each pod can have a publicly addressable /128, so activities like NTP would require the container to have an NTP client in it to expose in that way. That'd mitigate a good chunk of information exposure -- that being said, I agree with the larger point about security via obscurity being insufficient.

Re: IPv6 is not insecure because it lacks a NAT

#125

Post by cyberax »

lelandbatey wrote: post #34
radlad wrote: post #4

Earlier quoted context omitted.

That's a great point - the packet is not dropped by the firewall as a result of NAT - but it still won't route anywhere because the IP in the packet is that of the router itself. I've updated the article as a result of your comment, thanks.

That's only because your ISP won't have routed that packet to you if someone gave it to _them_. However, if someone was able to get to the ISP-side of the connection that you have with your ISP, and send a packet down the fiber/copper line from the ISP side towards your router, and that packet has a dst of your internal network (192.168.0.1 or whatever), your router will happily route that straight on to whatever int…

If somebody is wishing to tap fiber optics lines to the ISP or to hack the ISP just to get to your router, then you probably are not going to be saved by a "default deny" firewall anyway.

Re: IPv6 is not insecure because it lacks a NAT

#126

Post by xl-brain »

da_chicken wrote: post #86
xl-brain wrote: post #42

The tension here is the difference between theory and reality. In reality, IPv4 NAT is the only thing protecting most users in their homes. If you force IPv6 on this same population, you have to give them an equivalent posture by default. This is kind of like writing an argument that motorcycles are not unsafe because they lack 4 wheels. This is true, but if you put my grandmother on one and ask her to drive across t…

No, the reality is that every modern network device running NAT for a user device network is also already a fully stateful firewall , because the software required to do one is virtually identical to the other. You can't buy a home router with NAT and no firewall, and no home routers ship that don't also have a default deny rule on that firewall. The same is true for SOHO routers and effectively every consumer networ…

Nope, I agree with the findings here:

https://arxiv.org/abs/2509.04792?

Re: IPv6 is not insecure because it lacks a NAT

#127

Post by ghshephard »

Spivak wrote: post #112
ghshephard wrote: post #57

Earlier quoted context omitted.

NAT66 doesn't add much in the way of security here, because the external address is fully routable and maps 1:1 to the internal address. You are once again fully dependent on a correctly configured firewall. The IPv6 address that I shared was, in fact, a static (and real) IPv6 address, belonging to a real device - with the possible exception of the last 3 bytes, was likely one I worked on frequently. Put another way…

Hardest to attack: fcab:cdef:1234:5678:9abc:def0:1234:5678 The whole point is that your devices on the inside of your network can't be routed to at all.

Okay - I'll bite - Why is FC/7 harder to attack than FD/8?

Re: IPv6 is not insecure because it lacks a NAT

#128

Post by solaris2007 »

MobiusHorizons wrote: post #119
solaris2007 wrote: post #116

Earlier quoted context omitted.

That's pretty embarrassing lol

In my defense I was in college at the time, and I did actually run some tests to ensure my understanding of the firewall was correct. I just didn’t even think to account for ipv6 or especially for that range having different firewall rules.

Have you tried setting up an IPv6-only LAN?

Re: IPv6 is not insecure because it lacks a NAT

#129

Post by ahefner »

Dagger2 wrote: post #79
mzajc wrote: post #75

I have yet to see a "NAT is not security" rebuttal that does not make either one or both of these points: - NAT is not a security feature because it wasn't designed as one (this post), and/or - NAT is not a security feature because it does not, without a firewall, protect against an attacker on the WAN subnet, or another difficult-to-exploit scenario. And yet making LAN devices unroutable from the Internet does on it…

You should read my other comments on this post. I've attempted, multiple times (but apparently without much success) to make the point that NAT is not a security feature because it does not, without a firewall, protect against an attacker. You don't need a qualifier like "on the WAN subnet". It just doesn't do anything to protect you from inbound connections at all.

I think you're not technically wrong, but you're defining NAT differently than the majority of people you're arguing with (those who assume NAT also implies a firewall blocking inbound connections), and the remaining minority (the "on the WAN subnet" crowd) are dismissing outright the idea as a reasonable attack vector that an attacker close enough to be able to send packets destined for non-internet routable addresses to your router.

Is the latter something that was/is actively exploited?

Re: IPv6 is not insecure because it lacks a NAT

#130

Post by xl-brain »

dissent wrote: post #78
xl-brain wrote: post #42

The tension here is the difference between theory and reality. In reality, IPv4 NAT is the only thing protecting most users in their homes. If you force IPv6 on this same population, you have to give them an equivalent posture by default. This is kind of like writing an argument that motorcycles are not unsafe because they lack 4 wheels. This is true, but if you put my grandmother on one and ask her to drive across t…

NAT isn't protecting them. Not being on the public internet at all is protecting them. NAT is then unprotecting them a little by letting them punch out again. It's super easy for routers to implement this behaviour by default if your LAN is publicly addressable, and removes a whole class of exploits caused by applications making NAT hacks.

This is splitting hairs. The point stands that PAT is the de facto firewall for most soho users.
Post reply on HN