I actually wanted to write this article myself but every time I started writing it up I thought "fuck, this is too obvious, I'm being condescending". But then I read these comments and I'm sad again.
IPv6 is not insecure because it lacks a NAT
161–170 of 606 posts
Re: IPv6 is not insecure because it lacks a NAT
#162It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT
When we say "NAT" we are specifically talking about stateful one-to-many NAT implementations as found in consumer IPv4 hardware. Such a NAT is largely isomorphic to a firewall with default-deny semantics for incoming connections and default-allow semantics for outgoing connections.
There are other possible NAT implementations that are much less like a firewall, but saying that a NAT does not provide security is a misunderstanding of the terms as they are used.
Not you specifically, but others in other threads have pointet to UPnP as proof that NATs don't provide security. If the existence of UPnP means that NATs don't provide security, then the existence of PCP means that Firewalls also don't provide security.
Re: IPv6 is not insecure because it lacks a NAT
#163It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT
You are wrong because you are being overly pedantic.
NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side.
A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate).
Your definition of security is too narrow.
And saying that NAT is broken all the time, implying that NAT is not security, is ridiculous. SSH is 'broken' all the time. TLS is broken all the time.
Here's the end point: NAT effectively reduces the attack surface for a home network to the router. That is security, practically speaking.
Re: IPv6 is not insecure because it lacks a NAT
#164I disagree with this strongly. The intended use case of NAT or the existence of inbound connections being blocked by routers is irrelevant. For NAT, of course it isn't meant for security, but it has a side-effect of creating a network boundary, and that has positive security implications. If your router doesn't have a firewall blocking any connections, NAT still has security implications as it is deployed typically o…
The problem is, as I understand it, is this hypothetical network where there is a NAT but no firewall just does not exist. > In commercial grade routers, the same applies except even if the external IP knew to direct the router to the right internal IP, or if the route knew to direct the traffic to the right external IP for outbound connections, unless you configure a default route, or a more explicit route, it won't…
The nat is a belt and braces approach - especially when combined with rpf. How will your packet reach 192.168.0.1 from the internet without having a nat rule to translate the packet, even if there is a firewall rule allowing all traffic
(If you control the next hop and the router doesn't have rpf checks on the wan interfaces you can forge a packet with a destination of 192.168.0.1 and route it via the public IP of 40.50.60.70)
Re: IPv6 is not insecure because it lacks a NAT
#165I find the discussion about whether or not NAT is a security feature or not interesting. To my mind NAT was intended to make ipv4 last longer in a clever way as address space dried up. A happy accident of this solution is a basic security feature. Ipv6 doesn't (currently, will it ever?) have the same address space problem so each device anywhere could be globally routable. But we know that's not really a good thing s…
Why would you do that when a regular default-deny firewall is and has always been the security feature you need, without the complications and problems of NAT?
Re: IPv6 is not insecure because it lacks a NAT
#166Re: IPv6 is not insecure because it lacks a NAT
#167NAT is just one slice of IPv4. Granted your private IP is not routable (with CGNAT now your gateway is also no longer routable), but think of other features of IPv6 that are congruent:
SLAAC basically means your routable IPv6 address changes so many times in a day (and there are multiple of those at any given instant) that even if the attackers know your prefix, its going to be very difficult to do anything meaningful. the address space is too big.
And we are assuming here that there is no firewall.
Note : macOS firewall on a new install is disabled iirc.
Re: IPv6 is not insecure because it lacks a NAT
#168Earlier quoted context omitted.
There was a report a few years back about people running NTP servers to harvest IPv6 addresses. Security via obscurity will only get you so far.
In theory, IPv6 Privacy Extensions ( https://datatracker.ietf.org/doc/html/rfc4941 ) could mitigate this. In practice, I imagine when you bind to `[::]:port`, that also means that the randomized addresses would work for new inbound connections, too. Not sure how long they typically last, but you'd be fighting against the clock at least before a new randomized address. That being said, on a slightly less common note:…
It's a pain in the ass to configure the /128 setup, particularly when your ISP can change your /64 at any point in time.
Re: IPv6 is not insecure because it lacks a NAT
#169I basically disable all ipv6 on my routers & firewalls completely. Waiting for the day we can disable ipv4 completely instead and use only ipv6 without NAT. But then each device will need its own firewall. NAT basically forces you to use some kind of firewall, which applies to all devices behind the NAT. But if we go all-in on IPv6, the firewall-by-default becomes much harder to implement in practice. Then we will ne…
The article says: > Modern routers ship with firewall policies that deny inbound traffic by default, even when a NAT is not being used. So no, not every device needs its own firewall. You can have a single firewall at the entrance of your network.
Not always the case and differs by router software.
Re: IPv6 is not insecure because it lacks a NAT
#170It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT
The competency crisis is very real.