Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

171–180 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#171

Post by iso1631 »

freetime2 wrote: post #138

I think two things can be true here: the article's assertion that "IPv6 is not insecure because it lacks NAT" is correct, and other peoples' assertions that NAT provides an extra layer of security are also correct. A correctly configured IPv6 firewall provides equivalent protection to a correctly configured IPv4 firewall and NAT. Either way, connections that do not originate from within the local network are going to…

Ipv6 also creates real world problems that NAT solves -- multi upstream WAN with path selection for example

Dual stack introduces security problems (you now have two things to secure). There are still devices which will fail to run on an ipv6 network -- even with a 64 gateway (software which communicates to a specific IP address for example - e.g. a device which "checks internet connectivity" by pinging 1.1.1.1 and 8.8.8.8, yes it's terrible, and yes it happens)

Re: IPv6 is not insecure because it lacks a NAT

#172

Post by fsh »

kortilla wrote: post #158
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

> NAT is not for security, it does not provide security. It’s not for security but it absolutely does provide security and pretending otherwise continues to harm discussions. I have a pile of ipv4-only IoT devices that have no firewalls of their own that are being protected by the symmetric NAT in my home router. Kick and scream all you want but there is security there and nothing on the internet can reach those devi…

If you really don't have a stateful v4 firewall, your ISP can happily connect to all of your devices.

Re: IPv6 is not insecure because it lacks a NAT

#173

Post by silon42 »

ggm wrote: post #2

Not wishing to undermine the central point, NAT for v6 is a thing. The point of the article is that it's not "NAT by default" the way home IPv4 is because so few places worldwide get more than a single IP per customer: The NAT is not there in v4 for security, it's to provide for multiple devices inside the home. Or, in the case of Carrier-Grade NAT, to manage multiple customers, behind a small pool of v4. NAT doesn't…

Why would you not use ULA if you have a network with multiple machines?

Re: IPv6 is not insecure because it lacks a NAT

#174

Post by aidenn0 »

tucnak wrote: post #123
Sohcahtoa82 wrote: post #5

This is going to depend on the router and on IP distribution. My ISP does not give me an IPv6 address, only a single IPv6 which all my network devices have to NAT through. NAT is not intended to be a security feature, for sure, but it creates security as a side effect . If I start up a web server on one of my devices, I know that it is unreachable from the Internet unless I go out of my way to set a port forward on m…

> my ISP still gives me only a single IPv6 address This is criminal, and also incredibly uncommon. You should talk to your ISP, it's most definitely a misconfiguration of some kind, if not deliberate torture. Normally you get a /56 at least because there are so many and they cost nothing.

Datapoint of 1: With Cox as my ISP, I can get a /64 just by configuring my DHCPv6 client to request it, but if I wanted a /56 or /48 I would have to contact someone at my ISP.

Re: IPv6 is not insecure because it lacks a NAT

#175

Post by kortilla »

Dylan16807 wrote: post #132
tptacek wrote: post #110

Earlier quoted context omitted.

I can't emphasize enough how much of a retcon it is to say "it's not technically a lie" that NAT is a security feature. It was deployed in hundreds of networks specifically as a security feature, and it is part of the security posture of hundreds of thousands of home networks today. People who say "NAT isn't a security feature" are simply wrong. There are lots of security features I personally don't like either. I do…

The PIX evidence above doesn't make it look like a retcon. Do you have something better to show about those hundreds of networks?

> Since there's no way for anyone on the Internet to know which machine on the corporate network is using a Class C address at any given time, it's impossible to establish a telnet or FTP session with any particular device.

This is a security feature ad, nothing else. And it’s 100% because of NAT, not anything else in the PIX feature set.

Re: IPv6 is not insecure because it lacks a NAT

#176

Post by kortilla »

Dagger2 wrote: post #38
freeopinion wrote: post #24

Earlier quoted context omitted.

NAT absolutely does provide good security. It denies all incoming traffic that is not part of an established connection. Of course, that can be accomplished trivially without NAT. It can be done in IPv4 and in IPv6 with the simplest of routing rules. So there is nothing about a lack of NAT in IPv6 that makes it less secure.

But... it doesn't do that. If incoming traffic isn't part of an established connection, NAT will just ignore it. It doesn't deny that traffic, it just lets it pass through to the router without translating the addresses in it. The router will then do exactly the same thing it would've done if no NAT was involved at all: if the dest IP in the packet is the router itself then the router will accept or refuse the connec…

That makes no sense. If a packet comes into a public IP to a session that doesn’t exist, there is nowhere to forward the packet onto. The public IP belongs to the router.

If the packet was going to a private RFC 1918 address, there wouldn’t be a way to get it to the router in the first place from the internet.

Re: IPv6 is not insecure because it lacks a NAT

#177

Post by bigstrat2003 »

dehrmann wrote: post #142
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

This goes against Hyrum's law. NAT provides the behavior 99.9% of users want, usually by default, out of the box. True firewalls can do the same thing, but not necessarily by default, the firewall might not even by on by default, and there's more room for misconfiguration. IPv6 is a security regression for most people, regardless of its architectural merits or semantics of what's a firewall.

This is a terrible argument. First, NAT doesn't provide the security behavior users want. The firewall on their router is doing that, not the address translation. Second, that firewall is on by default, blocking inbound traffic by default, so why on earth would you conjecture that router manufacturers will suddenly stop doing that if NAT isn't on by default? Third, it's not remotely likely that a user will misconfigure their firewall to not secure them any more. Non-technical users won't even try to get in there, and technical users will know better because it's extremely easy to set up the basics of a default deny config. There is no security regression here, just bad arguments.

Re: IPv6 is not insecure because it lacks a NAT

#178

Post by nottorp »

No one's complaining that IPV6 is insecure. It may as well be very secure, but no one bothers to understand it if they're not paid to do that.

Of course you can have default drop in your IPV6 firewall, but it's far easier to keep in your head that internal NATed IPs aren't accessible and "real" IPs are.

Re: IPv6 is not insecure because it lacks a NAT

#179

Post by fsh »

oofbey wrote: post #140
kingstnap wrote: post #111

Earlier quoted context omitted.

If the end effect of security is dropping packets NAT and Firewalls both in effect drop packets. Its kind of just silly pedantry to say NATs aren't security because sure you can't do things like block specific ranges of IPs spamming you (or make outbound rules to control local devices) but 99% of people don't need.

I understand ipv4 networks pretty well. And I would say that any device doing NAT is acting as a basic firewall. Do “true” firewalls do more? Sure. But saying NAT doesn’t provide security is flat out wrong.

If your router had only NAT and someone (i.e. your ISP) sends it a package addressed to somewhere inside your internal IP range, it will happily forward it. A firewall would block it.

Re: IPv6 is not insecure because it lacks a NAT

#180

Post by globular-toast »

doubled112 wrote: post #106
john01dav wrote: post #98

Earlier quoted context omitted.

I don't know how much impact this has in practice, but you do not need to scan the entirety of the ipv6 address space because you can just look at the IPs that are registered to known ISPs/ASs.

I'm also not sure how much it helps, but a friend and I were just talking about how big the numbers get today. My ISP provides my house a /56 allocation. There are 4,722,366,482,869,645,213,696 addresses. I should have enough for a couple of years, at least. I guess you could scan it. The IPs for most devices are chosen randomly within a /64 subnet, or they're based on MAC address, but they're not sequential by any m…

Unfortunately I think one of the problems with v6 is people are just unable to apply intuition to numbers this big. The minimum number of /64s an ISP will have is around 4 billion. They generally give subscribers a /56 which is 256 /64s. It's all simple power-of-2 arithmetic. Computer people used to get how big 2^64 is.
Post reply on HN