IPv6 is not insecure because it lacks a NAT • Hacker News Board

Re: IPv6 is not insecure because it lacks a NAT

#151

Post by remix2000 » Wed, Jan 21, 2026, 6:36 AM UTC

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

Of course symmetric or even carrier grade NAT is not a firewall, but it's so silly to ignore real world implications thereof in an IPv4 only deployment scenario. Firewalls aren't foolproof and in real life you average NAT is more likely to be closer to that.

Re: IPv6 is not insecure because it lacks a NAT

#152

Post by [deleted] » Wed, Jan 21, 2026, 6:37 AM UTC

krackers wrote: post #135

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

RFC 4787 is useful in distinguishing NAT mapping vs filtering. Surprisingly symmetric NAT actually seems quite rare today.

[deleted]

Re: IPv6 is not insecure because it lacks a NAT

#153

Post by fsh » Wed, Jan 21, 2026, 6:38 AM UTC

dehrmann wrote: post #142

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

This goes against Hyrum's law. NAT provides the behavior 99.9% of users want, usually by default, out of the box. True firewalls can do the same thing, but not necessarily by default, the firewall might not even by on by default, and there's more room for misconfiguration. IPv6 is a security regression for most people, regardless of its architectural merits or semantics of what's a firewall.

NAT implementations get broken all the time (NAT slipstreaming attacks). If a manufacturer is incompetent enough not to have a firewall on by default, they are probably also shipping a vulnerable NAT.

Re: IPv6 is not insecure because it lacks a NAT

#154

Post by eknkc » Wed, Jan 21, 2026, 6:39 AM UTC

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

It quacks like a duck though.

Re: IPv6 is not insecure because it lacks a NAT

#155

Post by nemothekid » Wed, Jan 21, 2026, 6:40 AM UTC

notepad0x90 wrote: post #137

I disagree with this strongly. The intended use case of NAT or the existence of inbound connections being blocked by routers is irrelevant. For NAT, of course it isn't meant for security, but it has a side-effect of creating a network boundary, and that has positive security implications. If your router doesn't have a firewall blocking any connections, NAT still has security implications as it is deployed typically o…

The problem is, as I understand it, is this hypothetical network where there is a NAT but no firewall just does not exist.

>In commercial grade routers, the same applies except even if the external IP knew to direct the router to the right internal IP, or if the route knew to direct the traffic to the right external IP for outbound connections, unless you configure a default route, or a more explicit route, it won't forward such traffic.

This is typically handled by the firewall, not the NAT. You can easily come up with scenarios that without the firewall, the NAT could be trivially defeated, e.g. by port scanning.

Re: IPv6 is not insecure because it lacks a NAT

#156

Post by ifh-hn » Wed, Jan 21, 2026, 6:43 AM UTC

I find the discussion about whether or not NAT is a security feature or not interesting. To my mind NAT was intended to make ipv4 last longer in a clever way as address space dried up. A happy accident of this solution is a basic security feature.

Ipv6 doesn't (currently, will it ever?) have the same address space problem so each device anywhere could be globally routable. But we know that's not really a good thing security-wise. But why couldn't we implement NAT for it as a security mechanism, instead of an address space solution?

Admittedly I'm not expert so I might be talking shit.

Re: IPv6 is not insecure because it lacks a NAT

#157

Post by kortilla » Wed, Jan 21, 2026, 6:44 AM UTC

fsh wrote: post #153

dehrmann wrote: post #142

Earlier quoted context omitted.

This goes against Hyrum's law. NAT provides the behavior 99.9% of users want, usually by default, out of the box. True firewalls can do the same thing, but not necessarily by default, the firewall might not even by on by default, and there's more room for misconfiguration. IPv6 is a security regression for most people, regardless of its architectural merits or semantics of what's a firewall.

NAT implementations get broken all the time (NAT slipstreaming attacks). If a manufacturer is incompetent enough not to have a firewall on by default, they are probably also shipping a vulnerable NAT.

NAT slipstreaming depends on confusing fragmentation assemblers and application aware parsers. Those exist in firewalls as well. It’s not NAT specific.

Re: IPv6 is not insecure because it lacks a NAT

#158

Post by kortilla » Wed, Jan 21, 2026, 6:48 AM UTC

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

> NAT is not for security, it does not provide security.

It’s not for security but it absolutely does provide security and pretending otherwise continues to harm discussions.

I have a pile of ipv4-only IoT devices that have no firewalls of their own that are being protected by the symmetric NAT in my home router. Kick and scream all you want but there is security there and nothing on the internet can reach those devices unsolicited, just like a stateful v4 firewall would provide.

Re: IPv6 is not insecure because it lacks a NAT

#159

Post by iso1631 » Wed, Jan 21, 2026, 6:50 AM UTC

NAT is a trivial feature on top of a connection tracking firewall. It also provides a large number of benefits - the ability to route traffic via different routes with PBR, without having BGP upstream, to keep routing decisions in the router rather than on each device, to not have to renumber internal IP addessing when the ISP changes, to have consistent view of what happens at a network level

Re: IPv6 is not insecure because it lacks a NAT

#160

Post by fdr » Wed, Jan 21, 2026, 6:52 AM UTC

For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons.

This is all to underscore the author's point: NAT may necessitate stateful tracking, but firewalls without translation has been deployed at massive scale for one of the most numerous types of device in existence.