Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

131–140 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#131

Post by mjevans »

stackghost wrote: post #101
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

I think the confusion stems from the fact that my mom's laptop with its 192.168.0.43/24 v4 address is not routable except via NAT, and people believe (rightly or wrongly) that that confers a degree of security.

It doesn't confer much since it COULD be only NAT and no firewall.

It's INCREDIBLY unlikely to find a case of that in the wild, but possible.

A common example of a host that might have such an address but lacks that sort of security is anything as the default route for inbound packets, E.G. like you'd want your _own_ router / firewall rather than the ISP's modem.

Re: IPv6 is not insecure because it lacks a NAT

#132

Post by Dylan16807 »

tptacek wrote: post #110
simoncion wrote: post #109

Earlier quoted context omitted.

Ah, I see what you're driving at. It's a security feature in the same way that a power-cut switch is a security feature. A power-cut switch's purpose is cut power to a machine so that it can -say- be safely worked on or relocated (or simply to not draw power when the machine's not in use), the machine also happens to be inaccessible while its power is cut. Sure. It's not technically a lie to call a power-cut switch a…

I can't emphasize enough how much of a retcon it is to say "it's not technically a lie" that NAT is a security feature. It was deployed in hundreds of networks specifically as a security feature, and it is part of the security posture of hundreds of thousands of home networks today. People who say "NAT isn't a security feature" are simply wrong. There are lots of security features I personally don't like either. I do…

The PIX evidence above doesn't make it look like a retcon. Do you have something better to show about those hundreds of networks?

Re: IPv6 is not insecure because it lacks a NAT

#133

Post by reincarnate0x14 »

ghshephard wrote: post #12
ggm wrote: post #2

Not wishing to undermine the central point, NAT for v6 is a thing. The point of the article is that it's not "NAT by default" the way home IPv4 is because so few places worldwide get more than a single IP per customer: The NAT is not there in v4 for security, it's to provide for multiple devices inside the home. Or, in the case of Carrier-Grade NAT, to manage multiple customers, behind a small pool of v4. NAT doesn't…

Just to nitpick a bit. What people typically mean when they say "IPV4 NAT" is Network and Port translation. My 192.168.0.1 internally becomes 172.217.12.100 and my port gets converted to something that is tracked so that the return packet can find it's target. In IPv6, Prefix-Translation is similar, in that the /64 prefix is translated 1:1 - but the /64 Host address is (in my experience) left alone - so that renumber…

You can do the many-to-few (or one) NAT behavior with port rewrites in IPv6 if you want to, there are just few circumstances it makes any sense.

FWIW the broad IPv6 network-prefix NAT behavior ALSO EXISTS in IPv4, it's just less applicable.

Re: IPv6 is not insecure because it lacks a NAT

#134

Post by cyberax »

I wrote that comment, and you can write to yourself how many times you want that NAT is not a firewall.

The truth of the matter is that NAT absolutely _is_ a firewall in _practice_. Not in theory "because it doesn't drop packets" or "because it was not meant to be a security feature". But in the actual real-world practice.

It effectively protects most networks from most attackers without ANY additional configuration, making it inherently foolproof.

Here, I put a private key for a wallet with 0.01 bitcoin at this address: http://192.168.80.26/ Go on and take it. It's not protected by anything else I disabled everything but NAT. Heck, here's my real IPv4 even: 172.56.107.111

Is this a _good_ reason to not do IPv6? No. But it absolutely _is_ a reason and needs to be acknowledged.

Re: IPv6 is not insecure because it lacks a NAT

#135

Post by krackers »

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

RFC 4787 is useful in distinguishing NAT mapping vs filtering. Surprisingly symmetric NAT actually seems quite rare today.

Re: IPv6 is not insecure because it lacks a NAT

#136

Post by Dylan16807 »

mystraline wrote: post #99
Dagger2 wrote: post #18

Earlier quoted context omitted.

It might be the IP of the router, in which case the router itself will accept the connection if something is listening (like the web interface perhaps). But whoever sent you the L2 frame has full control over the contents of the IP in the packet, so it could be anything. NAT doesn't protect you from either of these.

Repeating the same wrong points doesnt make you right. Every NAT based product will have a firewall built in also by default. And it'll be deny-all except for conn-tracked. And that L2 attack is a martian packet. Why are you allowing reserved IPs talk on public network interfaces (hello, spoofing and obvious at that)? These are always blocked due to the reasons you describe. https://en.wikipedia.org/wiki/Martian_pack…

> Every NAT based product will have a firewall built in also by default.

Well that's the point of the article isn't it? That the firewall is the important part, not the NAT.

Re: IPv6 is not insecure because it lacks a NAT

#137

Post by notepad0x90 »

I disagree with this strongly. The intended use case of NAT or the existence of inbound connections being blocked by routers is irrelevant.

For NAT, of course it isn't meant for security, but it has a side-effect of creating a network boundary, and that has positive security implications.

If your router doesn't have a firewall blocking any connections, NAT still has security implications as it is deployed typically on consumer networks, which is a one-way port-address-translation for outbound traffic.

The important bit here is not NAT or firewalls, but layer 3 network segments!!!

An RFC1918 private addrerss space is not internet routable. Furthermore, routers shouldn't "default route" traffic from arbitrary connected networks by default. But "should" aside, the typical default consumer router behavior is that they don't NAT translate inbound traffic, they can't!

If a random internet IP wanted to connect to port 80 on a device at 192.168.1.200 in your home network, it doesn't know how to tell your router what IP to translate it's request to the router's public IP to. That is the essential positive security implication. In commercial grade routers, the same applies except even if the external IP knew to direct the router to the right internal IP, or if the route knew to direct the traffic to the right external IP for outbound connections, unless you configure a default route, or a more explicit route, it won't forward such traffic.

With IPv6, end devices in your network get a globally routed address, someone can try to connect to that same internal device as my earlier example and succeed with the same exact default behavior in place.

IPv6 is thus, by relative metrics, insecure by default. It does not mean it cannot be secured, but it is less secure than IPv4 in typical deployments where extra care isn't taken to secure it properly. If your answer to this is "well that's just because people who deploy networks are dumb" then save your self the effort or arguing that, it is irrelevant. That is how networks are deployed in the real world, period. People make mistakes in the real world. People don't know best practices in the real world. So out of the box, things need to consider real world hazards, and IPv6 does not do that.

You can support the adaption of IPv6 nonetheless and I would have no disagreement there.

Re: IPv6 is not insecure because it lacks a NAT

#138

Post by freetime2 »

I think two things can be true here: the article's assertion that "IPv6 is not insecure because it lacks NAT" is correct, and other peoples' assertions that NAT provides an extra layer of security are also correct.

A correctly configured IPv6 firewall provides equivalent protection to a correctly configured IPv4 firewall and NAT. Either way, connections that do not originate from within the local network are going to be rejected.

But if the firewall is misconfigured, then NAT will make it more difficult for an attacker on the internet to discover and exploit vulnerabilities on the local network.

"Defense in depth" is a valid security principle. But NAT also creates real-world problems that IPv6 solves. As with all things, there are tradeoffs, and whether or not you should enable IPv6 on your local network depends on your use case.

Re: IPv6 is not insecure because it lacks a NAT

#139

Post by dissent »

xl-brain wrote: post #130
dissent wrote: post #78

Earlier quoted context omitted.

NAT isn't protecting them. Not being on the public internet at all is protecting them. NAT is then unprotecting them a little by letting them punch out again. It's super easy for routers to implement this behaviour by default if your LAN is publicly addressable, and removes a whole class of exploits caused by applications making NAT hacks.

This is splitting hairs. The point stands that PAT is the de facto firewall for most soho users.

Not in the context of claiming NAT offers protection.

An ipv6 lan with default ingress deny is more secure than ipv4+nat

Re: IPv6 is not insecure because it lacks a NAT

#140

Post by oofbey »

kingstnap wrote: post #111
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

If the end effect of security is dropping packets NAT and Firewalls both in effect drop packets. Its kind of just silly pedantry to say NATs aren't security because sure you can't do things like block specific ranges of IPs spamming you (or make outbound rules to control local devices) but 99% of people don't need.

I understand ipv4 networks pretty well. And I would say that any device doing NAT is acting as a basic firewall. Do “true” firewalls do more? Sure. But saying NAT doesn’t provide security is flat out wrong.
Post reply on HN