IPv6 is not insecure because it lacks a NAT • Hacker News Board

Re: IPv6 is not insecure because it lacks a NAT

#201

Post by Dylan16807 » Wed, Jan 21, 2026, 7:32 AM UTC

kortilla wrote: post #175

Dylan16807 wrote: post #132

Earlier quoted context omitted.

The PIX evidence above doesn't make it look like a retcon. Do you have something better to show about those hundreds of networks?

> Since there's no way for anyone on the Internet to know which machine on the corporate network is using a Class C address at any given time, it's impossible to establish a telnet or FTP session with any particular device. This is a security feature ad, nothing else. And it’s 100% because of NAT, not anything else in the PIX feature set.

That came up earlier and I know it's a gray area but I agree with the idea that a line tossed into the marketing and not backed up by the manual weakens the importance. The firewall in the PIX is the security workhorse.

Also that sentence implies you can get a connection to a device, you just know less about which one it is. Is that really a meaningful security feature? To the extent that connections are actually blocked, it's not because of the NAT scrambling they quoted in the first half of that sentence. That sentence is somewhere between unhelpful and flat-out wrong.

Re: IPv6 is not insecure because it lacks a NAT

#202

Post by phire » Wed, Jan 21, 2026, 7:32 AM UTC

bigstrat2003 wrote: post #177

dehrmann wrote: post #142

Earlier quoted context omitted.

This goes against Hyrum's law. NAT provides the behavior 99.9% of users want, usually by default, out of the box. True firewalls can do the same thing, but not necessarily by default, the firewall might not even by on by default, and there's more room for misconfiguration. IPv6 is a security regression for most people, regardless of its architectural merits or semantics of what's a firewall.

This is a terrible argument. First, NAT doesn't provide the security behavior users want. The firewall on their router is doing that, not the address translation. Second, that firewall is on by default, blocking inbound traffic by default, so why on earth would you conjecture that router manufacturers will suddenly stop doing that if NAT isn't on by default? Third, it's not remotely likely that a user will misconfigu…

The firewall on your typical IPv4 router does basically nothing. It just drops all packets that aren’t a response to an active NAT session.

If the firewall somehow didn’t exist (not really possible, because NAT and the firewall are implemented by the same code) incoming packets wouldn’t be dropped, but they wouldn’t make it through to any of the NATed machines. From the prospective any machine behind the router, nothing changes, they get the same level of protection they always got.

So for those machines, the NAT is inherently acting as a firewall.

The only difference is the incoming packets would reach the router itself (which really shouldn’t have any ports open on the external IP) reach a closed port, and the kernel responds with a NAK. Sure, dropping is slightly more secure, but bouncing off a closed port really isn’t that problematic.

Re: IPv6 is not insecure because it lacks a NAT

#203

Post by dcminter » Wed, Jan 21, 2026, 7:32 AM UTC

fsh wrote: post #179

oofbey wrote: post #140

Earlier quoted context omitted.

I understand ipv4 networks pretty well. And I would say that any device doing NAT is acting as a basic firewall. Do “true” firewalls do more? Sure. But saying NAT doesn’t provide security is flat out wrong.

If your router had only NAT and someone (i.e. your ISP) sends it a package addressed to somewhere inside your internal IP range, it will happily forward it. A firewall would block it.

Does your ISP attack you often?

Re: IPv6 is not insecure because it lacks a NAT

#204

Post by iso1631 » Wed, Jan 21, 2026, 7:33 AM UTC

cyberax wrote: post #134

I wrote that comment, and you can write to yourself how many times you want that NAT is not a firewall. The truth of the matter is that NAT absolutely _is_ a firewall in _practice_. Not in theory "because it doesn't drop packets" or "because it was not meant to be a security feature". But in the actual real-world practice. It effectively protects most networks from most attackers without ANY additional configuration,…

If you don't have RPF enabled on your router in theory your upstream peer can send traffic to 192.168.80.26 and it would pass through. Reply traffic may or may not be natted depending on how it's entered in the connection tracking table.

There may be situations where your router can be tricked too, I can't think of one off the top of my head which wouldn't also apply to a stateful firewall sitting on a routed network segment with no nat, and it would typically be a vulnerability to patch

But your principal is right -- it's far harder to exploit than just connecting to an ip of say 2001:172:56:107:111::192.168.80.25 on port 80

Re: IPv6 is not insecure because it lacks a NAT

#205

Post by bigstrat2003 » Wed, Jan 21, 2026, 7:35 AM UTC

tptacek wrote: post #13

This has been gospel among snooty network engineers for decades, but NAT was initially introduced to the wider market as a security feature, and it is absolutely a material factor in securing networks. The network engineers are wrong about this. (IPv6 is still good for lots of other reasons, and NAT isn't good security; just material.)

NAT isn't security at all, good or otherwise. If it was sold as such, then the people selling it were giving out inaccurate info. But just because some people wrongly said that NAT provides security back in the beginning doesn't somehow make those claims true today.

Re: IPv6 is not insecure because it lacks a NAT

#206

Post by bigstrat2003 » Wed, Jan 21, 2026, 7:38 AM UTC

xl-brain wrote: post #49

denkmoon wrote: post #47

Earlier quoted context omitted.

This is entirely untrue. Every shitty router shipped by ISPs this side of the doctom bubble has a stateful firewall enabled by default. NAT is distinctly not the only thing protecting most home users. Not to mention every OS I know of shipping with its own firewall enabled with default deny on inbound.

You are stuck on the theory of what is protecting this population. In practice, less than 1% of these users can or will turn NAT off. Can you imagine how great things would work out with a public IP on all your nana's computers, NAT turned off, protected by the prowess of her Arris gateway's stateful firewall?

It would work out just fine, because NAT was never providing any actual security to your nana. It was only ever the firewall which made her secure, not NAT.

Re: IPv6 is not insecure because it lacks a NAT

#207

Post by NewJazz » Wed, Jan 21, 2026, 7:40 AM UTC

mbreese wrote: post #93

NewJazz wrote: post #89

Earlier quoted context omitted.

That's a pretty weird threat model. Like, yeah commands you run on your machine can expose information about that machine.

Especially as if someone is able to capture ifconfig data, they can probably send a curl request to a malicious web server and expose the NAT IP as well.

Or if you happened to curl ipinfo

Or if you had a script that did that and put the public v4 address in your taskbar.

Re: IPv6 is not insecure because it lacks a NAT

#208

Post by jiehong » Wed, Jan 21, 2026, 7:40 AM UTC

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

Just like a load balancer is a kind of NAT, but I don’t think people would conflate this with a security measure / FW.

Re: IPv6 is not insecure because it lacks a NAT

#209

Post by bigstrat2003 » Wed, Jan 21, 2026, 7:41 AM UTC

cyberax wrote: post #134

I wrote that comment, and you can write to yourself how many times you want that NAT is not a firewall. The truth of the matter is that NAT absolutely _is_ a firewall in _practice_. Not in theory "because it doesn't drop packets" or "because it was not meant to be a security feature". But in the actual real-world practice. It effectively protects most networks from most attackers without ANY additional configuration,…

> The truth of the matter is that NAT absolutely _is_ a firewall in _practice_.

No it's not. NAT is not ever a firewall. By definition it is not.

Re: IPv6 is not insecure because it lacks a NAT

#210

Post by self_awareness » Wed, Jan 21, 2026, 7:43 AM UTC

I'm on ipv6 since 2 years and I am very happy.

I profit from NAT-less network, can connect to my home device from a VPS without thinking it's sitting behind 2 routers. No port forwarding needed, just connect and it works. Well, I guess I still need to enable connection to this device on a firewall, but that's obvious.

We really should move on from IPv4.

By the way, IPv6 also supports NAT if that's what you want. But using NAT in IPv6 is like saying "i want to have my own personal universe so I can put 2 Raspberry PIs in it".