Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

191–200 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#191

Post by eqvinox »

MobiusHorizons wrote: post #118
alanfranz wrote: post #83

Earlier quoted context omitted.

…and they did really guess an ipv6 address? Full scans of the ipv6 address space looks infeasible. Or did the sbc reach out to the internet thus having its address exposed? Otherwise just the huge amount of addresses should make ipv6 “more secure” imho.

I don’t have any idea how they got the ip, it could certainly have been making outbound connections, though. I think it had NTP, although I might have pointed it at a local server we had for that.

> I don’t have any idea how they got the ip,

You might've been using DHCPv6 assigning sequential addresses starting at 1?

Remember: friends don't let friends use DHCPv6[*]. Help out, uninstall DHCPv6 today.

[*] in IA_NA mode (address assignment). PD and stateless info-only are fine.

Re: IPv6 is not insecure because it lacks a NAT

#192

Post by kstrauser »

BatteryMountain wrote: post #169
vaylian wrote: post #144

Earlier quoted context omitted.

The article says: > Modern routers ship with firewall policies that deny inbound traffic by default, even when a NAT is not being used. So no, not every device needs its own firewall. You can have a single firewall at the entrance of your network.

Not always the case and differs by router software.

Not really. I’m sure there exists some brain dead CPE without a default-deny firewall. It’s just that I’ve never physically seen once, since around 1999 or so.

Bigger commercial gear, sure, but those would be special-purpose equipment that don’t support NAT either.

To a rounding error, everything which has NAT enabled by default also has a default-deny inbound firewall enabled by default.

Re: IPv6 is not insecure because it lacks a NAT

#193

Post by iso1631 »

Gigachad wrote: post #33
layman51 wrote: post #27

Maybe it’s because I don’t consider myself a super technical person, but I find it so hard to parse the title of this blog post. When I first read it, I thought it was saying something like, “The protocol is not insecure, and the reason is that it lacks a NAT”. However, after reading the blog post, it seems like it is intending a different meaning. The meaning I think is, “the protocol is not insecure just because it…

The lack of NAT has no bearing on security. Despite an old mistaken belief.

Defence in depth is a valid security approach, and NAT provides another defence in depth

If you have a vulnerable ipv4 machine on 192.168.0.24 port 2345 which is hidden behind a public IP of 1.2.3.4, and you set your firewall rule to allow any inbound traffic, with no nat rules then it will be exceedingly difficult for a remote attacker to reach that vulnerable port (they have to trick your router's connection table into routing it)

If the same machine is on 2100:1234:5678:a::24 then that port is exposed.

Now sure your firewall could block the traffic, and that's great. But having multiple layers of active configuration to allow the traffic through is more secure than having a single layer as it means you need to screw up twice.

Worse than that with dual stack you may think you have set your firewall to block non-established connections at the ipv4 stage, but your device is sat there on an open ipv6 address you didn't even consider. Dual stack is certainly less secure than single stack as there are two opportunities to screw up.

Re: IPv6 is not insecure because it lacks a NAT

#194

Post by jeroenhd »

aidenn0 wrote: post #168
dunder_cat wrote: post #124

Earlier quoted context omitted.

In theory, IPv6 Privacy Extensions ( https://datatracker.ietf.org/doc/html/rfc4941 ) could mitigate this. In practice, I imagine when you bind to `[::]:port`, that also means that the randomized addresses would work for new inbound connections, too. Not sure how long they typically last, but you'd be fighting against the clock at least before a new randomized address. That being said, on a slightly less common note:…

It's a pain in the ass to configure the /128 setup, particularly when your ISP can change your /64 at any point in time.

If you have a shitty ISP that rotates prefixes like it's 2005, hosting anything public is a massive pain already. DDNS works just as well on IPv6, though.

Internally, a ULA will keep things reachable even if you move ISPs. You could even set up a NAT66 setup to translate your changing prefix to your stable ULA so you don't need to update any firewall rules, but that's a pretty terrible workaround for a problem that shouldn't be on you to fix in the first place.

Re: IPv6 is not insecure because it lacks a NAT

#195

Post by denkmoon »

cyberax wrote: post #121
denkmoon wrote: post #7

Invoking NAT "security" as a reason against IPv6 is a surefire indicator the person invoking it has absolutely no idea what they're talking about and should not be allowed within typing distance of any network infrastructure

Please. _I_ invoked that argument, and I bet I know more about IPv6 than you do. All my services and networks have IPv6. And my first operational issues with IPv6 were in 2008, when my Asterisk SIP server started failing after ~12 hours. Culprit? Privacy addresses kept accumulating until they overflowed the SIP UDP packet size because it listed all the combinations of supported codecs/endpoints. Oh, btw, do try to an…

Having read and considered your position I see no reason to update my opinion.

Re: IPv6 is not insecure because it lacks a NAT

#196

Post by kijin »

fsh wrote: post #179
oofbey wrote: post #140

Earlier quoted context omitted.

I understand ipv4 networks pretty well. And I would say that any device doing NAT is acting as a basic firewall. Do “true” firewalls do more? Sure. But saying NAT doesn’t provide security is flat out wrong.

If your router had only NAT and someone (i.e. your ISP) sends it a package addressed to somewhere inside your internal IP range, it will happily forward it. A firewall would block it.

Find me a consumer IPv4 router sold in the last ~10 years that does that by default.

Security comparisons should be between proposed new tech vs. existing tech, not vs. hypothetical straw-man tech.

Re: IPv6 is not insecure because it lacks a NAT

#197

Post by deknos »

Of course it's not insecure because of NAT.

NAT (in all its forms) is just a very convenient technology for many people and niche situations.

And adoption of IPv6 will be hindered as long as NAT is not a first class citizen.

And of course, mostly NAT should not be used as "firewall replacement". But what many firewall proponents forget here:

NON-IT People at home cannot run and manage a firewall (and proxies). For them, NAT is a convenient and mostly okayish replacements.

Another niche would be IP Packet Handling of VMs.

Re: IPv6 is not insecure because it lacks a NAT

#198

Post by bigstrat2003 »

MobiusHorizons wrote: post #119
solaris2007 wrote: post #116

Earlier quoted context omitted.

That's pretty embarrassing lol

In my defense I was in college at the time, and I did actually run some tests to ensure my understanding of the firewall was correct. I just didn’t even think to account for ipv6 or especially for that range having different firewall rules.

Unlike the other poster, I'm not going to blame you for getting things wrong. It happens, we all were learning at one point. But I do think it's incredibly unreasonable to use a mistake you made as an argument against IPv6. This would be like if I rm -rf'ed my Linux box into oblivion when I was first learning and then avoided Linux after that because I had bad vibes about it. Sometimes you need to accept the L and not blame the tools.

Re: IPv6 is not insecure because it lacks a NAT

#199

Post by fsh »

kijin wrote: post #196
fsh wrote: post #179

Earlier quoted context omitted.

If your router had only NAT and someone (i.e. your ISP) sends it a package addressed to somewhere inside your internal IP range, it will happily forward it. A firewall would block it.

Find me a consumer IPv4 router sold in the last ~10 years that does that by default. Security comparisons should be between proposed new tech vs. existing tech, not vs. hypothetical straw-man tech.

Find me a consumer IPv6 router sold in the last ~10 years without a restrictive firewall enabled by default. I have never seen one.

Re: IPv6 is not insecure because it lacks a NAT

#200

Post by mrsssnake »

xl-brain wrote: post #74
mrsssnake wrote: post #70

Earlier quoted context omitted.

France with >85% IPv6 adoption mostly made of grandmothers driving a motorcycles across the town manually delivering packets like in their youth.

https://arxiv.org/abs/2509.04792 ? "Collectively, our results show that NAT has indeed acted as the de facto firewall of the Internet, and the v4-to-v6 transition of residential networks is opening up new devices to attack."

ISP hosting a virtual machine you remote desktop into from internal network as the only way to access the external internet can also work as a "de facto firewall".

But the best de facto firewall is a proper firewall.

Post reply on HN