Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

221–230 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#221

Post by nottorp »

jeroenhd wrote: post #184
nottorp wrote: post #178

No one's complaining that IPV6 is insecure. It may as well be very secure, but no one bothers to understand it if they're not paid to do that. Of course you can have default drop in your IPV6 firewall, but it's far easier to keep in your head that internal NATed IPs aren't accessible and "real" IPs are.

I've seen plenty of discussions here on HN where people have made that claim. Even more elsewhere on the discussion side of other news websites by sysadmins that disable IPv6 because one of their industrial routers didn't come with a default deny rule that one time which made them think that's normal. The people who are supposed to know IPv6 never seemed to have learned it and many of them don't seem to be open to th…

> many of them don't seem to be open to the idea of learning something new

To the idea of learning something designed by commitee, over complex and stinking of enterprise and that you simply can't deploy "by hand".

One of the advantages of NAT by the way is that your "outside" configuration and "inside" configurations are completely independent with the exception of the snat rule.

Re: IPv6 is not insecure because it lacks a NAT

#222

Post by cyberax »

bigstrat2003 wrote: post #209
cyberax wrote: post #134

I wrote that comment, and you can write to yourself how many times you want that NAT is not a firewall. The truth of the matter is that NAT absolutely _is_ a firewall in _practice_. Not in theory "because it doesn't drop packets" or "because it was not meant to be a security feature". But in the actual real-world practice. It effectively protects most networks from most attackers without ANY additional configuration,…

> The truth of the matter is that NAT absolutely _is_ a firewall in _practice_. No it's not. NAT is not ever a firewall. By definition it is not.

What is the definition of a "firewall"?

And it doesn't really matter. You can call it "alksjfaliskdfgh" if you wish. The fact is, NAT adds a security barrier that is incredibly effective in practice.

Re: IPv6 is not insecure because it lacks a NAT

#223

Post by ivanjermakov »

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

Difference between NAT and firewall? You can punch a hole in one of them https://en.wikipedia.org/wiki/Hole_punching_(networking)

Re: IPv6 is not insecure because it lacks a NAT

#224

Post by xurukefi »

I hate NAT with a passion. It's a terrible technology, whose disruptive nature has probably prevented any novelty on the transport layer. But this article is oversimplifying things.

It is well known that NAT is not meant for security and that NAT is not a firewall. But one cannot deny that it implicitly brings some "default" security to the table. With NAT it's basically impossible to screw you over because there is no meaningful practical way to allow inbound connections without the client explicitly defining them (port forwarding). With IPv6, you could have a lazy vendor that does not do any firewalling or a has a default allow policy or maybe buggy firewall. With NAT that is not possible. There is no lazy/buggy NAT implementation that allows inbound connections for your entire network, because it is technically not possible. When a NATting device receives a packet with a destination port that has not previously been opened by a client, it does not decide to drop this packet because of a decision by the vendor. It drops the packet because there is simply no other option due to the nature of NAT. That is what people mean when they talk about the inherent "security" of NAT.

Again, NAT is terrible. We need to finally get rid globally of IPv4 and all the NATting that comes with it. But let's keep it to the facts.

Re: IPv6 is not insecure because it lacks a NAT

#225

Post by ErroneousBosh »

fsh wrote: post #172
kortilla wrote: post #158

Earlier quoted context omitted.

> NAT is not for security, it does not provide security. It’s not for security but it absolutely does provide security and pretending otherwise continues to harm discussions. I have a pile of ipv4-only IoT devices that have no firewalls of their own that are being protected by the symmetric NAT in my home router. Kick and scream all you want but there is security there and nothing on the internet can reach those devi…

If you really don't have a stateful v4 firewall, your ISP can happily connect to all of your devices.

How do they manage that?

Re: IPv6 is not insecure because it lacks a NAT

#226

Post by ErroneousBosh »

fsh wrote: post #179
oofbey wrote: post #140

Earlier quoted context omitted.

I understand ipv4 networks pretty well. And I would say that any device doing NAT is acting as a basic firewall. Do “true” firewalls do more? Sure. But saying NAT doesn’t provide security is flat out wrong.

If your router had only NAT and someone (i.e. your ISP) sends it a package addressed to somewhere inside your internal IP range, it will happily forward it. A firewall would block it.

Okay, I'm running tcpdump on my desktop. Send me some packets to 192.168.1.127 and I'll watch out for them.

Re: IPv6 is not insecure because it lacks a NAT

#227

Post by MPSimmons »

lazystar wrote: post #217
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

It's scary how much of this thread comes from people who can't imagine a use for keeping internal traffic internal. in ipv4, if my laptop tries to use a printer with a public ipv4 address, that raises alarms. in ipv6, if my laptop tries to use a printer with an ipv6 address... its not about the firewall. there's just a lot of extra attack vectors without a nat.

I agree with the majority of your point, but hopefully your printer hasn't been assigned IPv6 IPs that are global in nature and is instead limited to site-local.

For anyone who is reading this but hasn't use IPv6, IPv6 addresses are a large flat 128-bit contiguous address space, but they are not universally routable. The prefix of any specific address determines what group of other IPs can get to it.

We often think of a computer as having an IP address, but with IPv6, computers will have several addresses, all with different prefixes to handle different types of traffic.

This site does a decent job of explaining - https://networklessons.com/ipv6/ipv6-address-types

Re: IPv6 is not insecure because it lacks a NAT

#228

Post by ErroneousBosh »

freeopinion wrote: post #30
ghshephard wrote: post #9

This is the first thing that as a Network Engineer I was taught - and every formal security class I've taken (typically from Cisco - they have awesome course) - repeats the same thing. I believe the common knowledge is somewhat more nuanced than people would have you believe I present to you two separate high-value targets whose IP address has leaked: IPv4 Target: 192.168.0.1 IPv6 Target: 2001:1868:209:FFFD:0013:50FF…

It took me less than 1 second to access that 192.168.0.1 address! It wasn't that hard to find. (;-)

Fast, too, isn't it? Must be on at least a 1Gbps connection.

Re: IPv6 is not insecure because it lacks a NAT

#229

Post by ErroneousBosh »

Dagger2 wrote: post #18
radlad wrote: post #4

Earlier quoted context omitted.

That's a great point - the packet is not dropped by the firewall as a result of NAT - but it still won't route anywhere because the IP in the packet is that of the router itself. I've updated the article as a result of your comment, thanks.

It might be the IP of the router, in which case the router itself will accept the connection if something is listening (like the web interface perhaps). But whoever sent you the L2 frame has full control over the contents of the IP in the packet, so it could be anything. NAT doesn't protect you from either of these.

So, if you have NAT but a grossly misconfigured router, it might not be secure?

Quick question - do you think that "security by obscurity is not security"? And, as a follow-up, when you park your car do you ensure your laptop bag is out of sight, maybe locked away in the boot?

Because here's a mindblowing concept that'll change the way you see the world - you can have a door lock but it won't make you secure. You need to actually fit the lock to some sort of door.

Re: IPv6 is not insecure because it lacks a NAT

#230

Post by dannyobrien »

fdr wrote: post #160

For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. This is all to underscore the author's point: NAT may necessitate s…

What would be the obvious reasons? (I'm not being flippant here -- I'm genuinely interested in what arguments people have to not allow servers on that network)
Post reply on HN