Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux: Limit IPv6 connectivity to specific programs

fds-team.de

Post reply on HN
Print view View original

1–10 of 33 posts

Re: Linux: Limit IPv6 connectivity to specific programs

#3

Post by akira2501 »

This seems to take the long way around. I wonder why they didn't consider just using the firewall to control network traffic; unless you really need your applications to be completely unaware of IPv6, but so far, I've not experienced that problem.

Also, requiring root privileges for launch is a bit of a burden in some use-case scenarios.

Re: Linux: Limit IPv6 connectivity to specific programs

#5

Post by Tomdarkness »

> "The main problem is to secure an IPv6 network which is much more complicated than using a typical IPv4 network consisting of a router and several devices behind it."

Does anyone know why this is the case? I'm not a network security expert but to me I don't see how IPv4/v6 makes a different in terms of security. I'd assume that each computer on the network could most likely be assigned a public IPv6 address rather than using NAT in which case how is configuring your perimeter firewall to drop incoming connections by default any different from not having any port forwarding setup by default? Even your average domestic router has some sort of basic firewall built in.

Re: Linux: Limit IPv6 connectivity to specific programs

#6

Post by lgbr »

Security aside, this is even useful for new deployments of IPv6. It seems a lot of people have IPv6 networks that are less favorable for some traffic than their IPv4 networks. Some are running their IPv6 through tunnels. As soon as you enable IPv6 on your desktop, suddenly Firefox or Chromium will prefer IPv6 for any website with a AAAA record, which adds a ton of latency and reduces bandwidth.

But theoretically, I could enable IPv6 for sshd (where I stand the most benefit) and leave it off for wget and browsers with this.

Re: Linux: Limit IPv6 connectivity to specific programs

#7

Post by wmf »

lgbr wrote: post #6

Security aside, this is even useful for new deployments of IPv6. It seems a lot of people have IPv6 networks that are less favorable for some traffic than their IPv4 networks. Some are running their IPv6 through tunnels. As soon as you enable IPv6 on your desktop, suddenly Firefox or Chromium will prefer IPv6 for any website with a AAAA record, which adds a ton of latency and reduces bandwidth. But theoretically, I c…

IPv6 is no longer necessarily preferred due to happy eyeballs. http://tools.ietf.org/html/rfc6555

Re: Linux: Limit IPv6 connectivity to specific programs

#8

Post by stephen_g »

Tomdarkness wrote: post #5

> "The main problem is to secure an IPv6 network which is much more complicated than using a typical IPv4 network consisting of a router and several devices behind it." Does anyone know why this is the case? I'm not a network security expert but to me I don't see how IPv4/v6 makes a different in terms of security. I'd assume that each computer on the network could most likely be assigned a public IPv6 address rather…

I agree - that line from the article makes no sense. Not having NAT is awesome because NAT is a nasty hack that doesn't add any security.

The tunnelling scenario is valid though - because they add quite a bit of latency so you might not want to use it for everything.

Re: Linux: Limit IPv6 connectivity to specific programs

#9

Post by ajasmin »

Tomdarkness wrote: post #5

> "The main problem is to secure an IPv6 network which is much more complicated than using a typical IPv4 network consisting of a router and several devices behind it." Does anyone know why this is the case? I'm not a network security expert but to me I don't see how IPv4/v6 makes a different in terms of security. I'd assume that each computer on the network could most likely be assigned a public IPv6 address rather…

What's the point of assigning an address to every node on the Internet if you can't connect to these addresses.

The advantage of IPv6 is that any computer can act as a server again. NAT makes it unnecessarily difficult to build simple peer to peer applications such as for telephony, remote access or file transfer.

Re: Linux: Limit IPv6 connectivity to specific programs

#10

Post by IgorPartola »

Tomdarkness wrote: post #5

> "The main problem is to secure an IPv6 network which is much more complicated than using a typical IPv4 network consisting of a router and several devices behind it." Does anyone know why this is the case? I'm not a network security expert but to me I don't see how IPv4/v6 makes a different in terms of security. I'd assume that each computer on the network could most likely be assigned a public IPv6 address rather…

There is nothing special about firewalling off IPv6. NAT is not a security feature. The problem is that most consumer "routers" that people use nowadays are really: a router, a switch, a wireless access point, a firewall, and who knows what else. Here are some sample rules for firewalling off IPv4 (typed from memory, so use with caution):

  iptables -A INPUT -i lo -j ACCEPT
  iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
  iptables -A INPUT -p icmp -j ACCEPT
  iptables -A INPUT -j DROP
  
  iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  iptables -A FORWARD -s 192.168.1.0/24 -j ACCEPT
  iptables -A FORWARD -p icmp -j ACCEPT
  iptables -A FORWARD -j DROP
Here are the IPv6 rules:

  ip6tables -A INPUT -i lo -j ACCEPT
  ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  ip6tables -A INPUT -s 2001:xx:xx:xx::/64 -j ACCEPT
  ip6tables -A INPUT -p ipv6-icmp -j ACCEPT
  ip6tables -A INPUT -j DROP
  
  ip6tables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  ip6tables -A FORWARD -s 2001:xx:xx:xx::/64 -j ACCEPT
  ip6tables -A FORWARD -p ipv6-icmp -j ACCEPT
  ip6tables -A FORWARD -j DROP
Does that look like it would be hard to do? Your router should come with these rules already. If it does not, ditch it and buy one that is supported by OpenWRT, where IPv6 support is not a second class citizen.

Edit: Naturally, IPv4 rules would have to be more complicated since you'll want to have your NAT setup in there. In this way, configuring IPv6 is actually easier :). Also, a real router would have rules set up for throttling certain types of traffic (e.g.: you don't want more than, say, 1000 ICMP messages per second). However, all those steps are identical for IPv6.

Post reply on HN