Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux: Limit IPv6 connectivity to specific programs

fds-team.de

Post reply on HN
Print view View original

21–30 of 33 posts

Re: Linux: Limit IPv6 connectivity to specific programs

#21

Post by GauntletWizard »

noja wrote: post #13
IgorPartola wrote: post #10

Earlier quoted context omitted.

There is nothing special about firewalling off IPv6. NAT is not a security feature. The problem is that most consumer "routers" that people use nowadays are really: a router, a switch, a wireless access point, a firewall, and who knows what else. Here are some sample rules for firewalling off IPv4 (typed from memory, so use with caution): iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTA…

> NAT is not a security feature. Why?

Because it was never intended as such and does not necessarily need to add any. The fact that many NAT implementations do add some security (by dropping inbound connections by default) is a side effect. I've seen NAT implementations that get it precisely wrong (consumer routers that set up .2 as the default DMZ), but that's still entirely valid.

Re: Linux: Limit IPv6 connectivity to specific programs

#22

Post by noja »

GauntletWizard wrote: post #21
noja wrote: post #13

Earlier quoted context omitted.

> NAT is not a security feature. Why?

Because it was never intended as such and does not necessarily need to add any. The fact that many NAT implementations do add some security (by dropping inbound connections by default) is a side effect. I've seen NAT implementations that get it precisely wrong (consumer routers that set up .2 as the default DMZ), but that's still entirely valid.

Whether or not NAT was designed with security in mind doesn't matter.

Using NAT increases security simply by having deny by default.

Re: Linux: Limit IPv6 connectivity to specific programs

#23

Post by vy8vWJlco »

noja wrote: post #22
GauntletWizard wrote: post #21

Earlier quoted context omitted.

Because it was never intended as such and does not necessarily need to add any. The fact that many NAT implementations do add some security (by dropping inbound connections by default) is a side effect. I've seen NAT implementations that get it precisely wrong (consumer routers that set up .2 as the default DMZ), but that's still entirely valid.

Whether or not NAT was designed with security in mind doesn't matter. Using NAT increases security simply by having deny by default.

But that is not a feature of NAT, that is a feature of a firewall (for example, it is possible to route incoming packets via the WAN as well as masquerade outgoing ones from the LAN - most people wouldn't even know their pants are down). It is a coincidence that home routers sometimes provide both leading people to conflate their firewall with their NAT system - but if a firewall is what is wanted (and is arguably the only valuable component), NAT is not the thing to ask for. Conflating NAT with firewalls also promotes the idea that NAT has a place in any network with abundant addresses. IMHO, it does not.

Re: Linux: Limit IPv6 connectivity to specific programs

#24

Post by kiallmacinnes »

noja wrote: post #22
GauntletWizard wrote: post #21

Earlier quoted context omitted.

Because it was never intended as such and does not necessarily need to add any. The fact that many NAT implementations do add some security (by dropping inbound connections by default) is a side effect. I've seen NAT implementations that get it precisely wrong (consumer routers that set up .2 as the default DMZ), but that's still entirely valid.

Whether or not NAT was designed with security in mind doesn't matter. Using NAT increases security simply by having deny by default.

No, using a firewall increases security. It just so happens that most routers which do NAT, also have a firewall. You are, in my opinion, confusing two functions provided by one device.

I'm willing to bet that any IPv6 capable router also has a firewall.

Re: Linux: Limit IPv6 connectivity to specific programs

#25

Post by dspillett »

noja wrote: post #22
GauntletWizard wrote: post #21

Earlier quoted context omitted.

Because it was never intended as such and does not necessarily need to add any. The fact that many NAT implementations do add some security (by dropping inbound connections by default) is a side effect. I've seen NAT implementations that get it precisely wrong (consumer routers that set up .2 as the default DMZ), but that's still entirely valid.

Whether or not NAT was designed with security in mind doesn't matter. Using NAT increases security simply by having deny by default.

That doesn't increase security unless your baseline is broken. All NAT is potentially replacing from a security perspective is a single default drop (or default reject) rule, which should have been there to start with.

While it could be argued that NAT adds an extra layer to security-in-depth by making it harder to accidentally open things up by missing out the default drop/reject rule, but I'd argue that all the faf that NAT can create by making it difficult to arrange point-to-point connections where they are actually desirable is not worth that little bit of protection against failing to configure the firewall correctly.

Re: Linux: Limit IPv6 connectivity to specific programs

#26

Post by nitrogen »

vy8vWJlco wrote: post #23
noja wrote: post #22

Earlier quoted context omitted.

Whether or not NAT was designed with security in mind doesn't matter. Using NAT increases security simply by having deny by default.

But that is not a feature of NAT, that is a feature of a firewall (for example, it is possible to route incoming packets via the WAN as well as masquerade outgoing ones from the LAN - most people wouldn't even know their pants are down). It is a coincidence that home routers sometimes provide both leading people to conflate their firewall with their NAT system - but if a firewall is what is wanted (and is arguably th…

NAT will always have a place, because not everyone wants to expose a uniquely routable address for every device they own (probably based on a device's MAC address) to the world.

Re: Linux: Limit IPv6 connectivity to specific programs

#27

Post by vy8vWJlco »

nitrogen wrote: post #26
vy8vWJlco wrote: post #23

Earlier quoted context omitted.

But that is not a feature of NAT, that is a feature of a firewall (for example, it is possible to route incoming packets via the WAN as well as masquerade outgoing ones from the LAN - most people wouldn't even know their pants are down). It is a coincidence that home routers sometimes provide both leading people to conflate their firewall with their NAT system - but if a firewall is what is wanted (and is arguably th…

NAT will always have a place, because not everyone wants to expose a uniquely routable address for every device they own (probably based on a device's MAC address) to the world.

Can you give an example that isn't based on security (since the NAT isn't providing that)? I can only think of short-term (undesirable) transition or load-balancing mechanisms - all of which have better long-term solutions (anycast, multicast, and dynamic service discovery, etc)...

Re: Linux: Limit IPv6 connectivity to specific programs

#28

Post by dfc »

dfc wrote: post #16
lgbr wrote: post #6

Security aside, this is even useful for new deployments of IPv6. It seems a lot of people have IPv6 networks that are less favorable for some traffic than their IPv4 networks. Some are running their IPv6 through tunnels. As soon as you enable IPv6 on your desktop, suddenly Firefox or Chromium will prefer IPv6 for any website with a AAAA record, which adds a ton of latency and reduces bandwidth. But theoretically, I c…

At home my HE tunnel is snappier than the plain ipv4 from rr. The weird thing is it is not just a case of user perception (mine). One of the upstream s1 ntp boxes I sync with has ipv4 and ipv6 and is relatively close. I set one of my s1s to sync with both the ipv4 and ipv6 addresses of the machine and the ipv4 clock displayed a lower delay and less jitter while the offsets were seasonably close.

argh, for posterity's sake the last line should read:

"the ipv6 peer entry displayed a lower delay and less jitter while the offsets were reasonably close."

Re: Linux: Limit IPv6 connectivity to specific programs

#29

Post by nitrogen »

vy8vWJlco wrote: post #27
nitrogen wrote: post #26

Earlier quoted context omitted.

NAT will always have a place, because not everyone wants to expose a uniquely routable address for every device they own (probably based on a device's MAC address) to the world.

Can you give an example that isn't based on security (since the NAT isn't providing that)? I can only think of short-term (undesirable) transition or load-balancing mechanisms - all of which have better long-term solutions (anycast, multicast, and dynamic service discovery, etc)...

What's with the widespread fixation against attributing any positive security attributes to Network Address Translation? It's like the old warning about NAT not being enough to protect a private network got cargo culted into a universal anti-NAT maxim.

What would you call it when a router at the edge of a private network presents a single IP to the world no matter how many devices are behind it, for privacy reasons?

Re: Linux: Limit IPv6 connectivity to specific programs

#30

Post by IgorPartola »

nitrogen wrote: post #26
vy8vWJlco wrote: post #23

Earlier quoted context omitted.

But that is not a feature of NAT, that is a feature of a firewall (for example, it is possible to route incoming packets via the WAN as well as masquerade outgoing ones from the LAN - most people wouldn't even know their pants are down). It is a coincidence that home routers sometimes provide both leading people to conflate their firewall with their NAT system - but if a firewall is what is wanted (and is arguably th…

NAT will always have a place, because not everyone wants to expose a uniquely routable address for every device they own (probably based on a device's MAC address) to the world.

The simple and much more flexible answer to this is to have a firewall rule on the edge router that simply drops all packets to and from the hosts you do not want visible. Note that this is more flexible in that if you want some hosts visible and some not, you can do that. You cannot do that with NAT: you only have one port 80 and several servers for example.

In general, use the right tool for the job. NAT provides some blunt security features incidentally. It does not, for example, prevent your server from making connections to the outside world. The firewall is what is meant to be used to restrict traffic. That is its only job and it does that well.

Post reply on HN