Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

241–250 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#241

Post by fc417fc802 »

snuxoll wrote: post #216
phire wrote: post #202

Earlier quoted context omitted.

The firewall on your typical IPv4 router does basically nothing. It just drops all packets that aren’t a response to an active NAT session. If the firewall somehow didn’t exist (not really possible, because NAT and the firewall are implemented by the same code) incoming packets wouldn’t be dropped, but they wouldn’t make it through to any of the NATed machines. From the prospective any machine behind the router, noth…

NAT gateways that utilize connection tracking are effectively stateful firewalls. Whether a separate set of ‘firewall’ rules does much good because most SNAT implementations by necessity duplicate this functionality is a bit ignorant, IMO. Meanwhile, an IPv6 network behind your average Linux-based home router is 2-3 nftables rules to lock down in a similar fashion.

It's also trivial to roll your own version of dropbox. With IPv6 it's possible to fail to configure those nftables rules. The firewall could be turned off.

In theory you could turn off IPv4 NAT as well but in practice most ISPs will only give you a single address. That makes it functionally impossible to misconfigure. I inadvertently plugged the WAN cable directly into my LAN one time and my ISP's DHCP server promptly banned my ONT entirely.

Re: IPv6 is not insecure because it lacks a NAT

#242

Post by vladvasiliu »

fc417fc802 wrote: post #232
dannyobrien wrote: post #230

Earlier quoted context omitted.

What would be the obvious reasons? (I'm not being flippant here -- I'm genuinely interested in what arguments people have to not allow servers on that network)

High concentration of technically inept users with hardware that no longer receives security updates and has plenty of well known easily exploitable vulnerabilities. Which naturally is used to run banking apps and travels with users close to 24/7 while tracking their location. From a business perspective you'd want to charge extra. Just because you can, but also because you want to discourage excess bandwidth use. Th…

> From a business perspective you'd want to charge extra. Just because you can, but also because you want to discourage excess bandwidth use

Isn't that already the case with limited plans?

For example, mine has 40 GBs and I'm pretty sure it counts both upload and download, because I generally consume very little, except for one week when I was on holiday with no other internet access and wanted to upload my pictures to my home server and didn't otherwise use the phone more than usual.

Re: IPv6 is not insecure because it lacks a NAT

#244

Post by TiredOfLife »

fdr wrote: post #160

For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. This is all to underscore the author's point: NAT may necessitate s…

Mobile phones are also heavily sandboxed.

Re: IPv6 is not insecure because it lacks a NAT

#245

Post by fc417fc802 »

MPSimmons wrote: post #227
lazystar wrote: post #217

Earlier quoted context omitted.

It's scary how much of this thread comes from people who can't imagine a use for keeping internal traffic internal. in ipv4, if my laptop tries to use a printer with a public ipv4 address, that raises alarms. in ipv6, if my laptop tries to use a printer with an ipv6 address... its not about the firewall. there's just a lot of extra attack vectors without a nat.

I agree with the majority of your point, but hopefully your printer hasn't been assigned IPv6 IPs that are global in nature and is instead limited to site-local. For anyone who is reading this but hasn't use IPv6, IPv6 addresses are a large flat 128-bit contiguous address space, but they are not universally routable. The prefix of any specific address determines what group of other IPs can get to it. We often think o…

If you plug your printer into your home network, and if the local DHCP server is configured to hand out globally routable addresses from your ISP provided /64, then your printer will also be globally routable (as well as your "smart" fridge, "smart" TV, "smart" thermostat, etc). In my personal experience this is the default situation with consumer ISP IPv6 setups.

This difference in theory versus practice is precisely why we see people objecting that IPv4 is more secure as far as default configurations go when it comes to home use.

That said, I expect (hope?) that all ISP gear should default to enabling a stateful firewall. Hopefully there's no difference between the default security of an IPv4 and an IPv6 setup in practice. But given the history I'm not entirely optimistic.

Re: IPv6 is not insecure because it lacks a NAT

#246

Post by aragilar »

jcgl wrote: post #231
digitalPhonix wrote: post #187

Earlier quoted context omitted.

It’s still conflating things. You can have a stateless NAT: device x.x.x.y will get outbound source ports rewritten to (orignal port) This is a (dumb) NAT but has no state so it cannot possibly implement a default deny or any firewall adjacent features.

And that kind of NAT effectively doesn't exist in practice, so that's quite beside the point. Such a NAT doesn't scale to more than 24 devices behind it.

No, it very much does. If you want to join two network segments such that on one side all devices are on 10.1.X.X and the other all devices are 10.2.X.X, you'd use a mapping between 10.1.a.b and 10.2.a.b

See https://en.wikipedia.org/wiki/Network_address_translation#Me...

Re: IPv6 is not insecure because it lacks a NAT

#247

Post by fc417fc802 »

stackghost wrote: post #218
reincarnate0x14 wrote: post #114

Earlier quoted context omitted.

UPNP and a dozen other NAT defeating tactics exist and have since the early 2000s. NAT translates addresses. Thinking a non-routable range is safe because it's behind NAT is at this point grossly ignorant of how modern network equipment works. It's kind of like port-knocking; yes it makes the attack slightly harder, but doesn't prevent it. e.g. symmetric NAT exists and often doesn't come with a stateful firewall. Jus…

>UPNP and a dozen other NAT defeating tactics exist and have since the early 2000s. I know that, and you know that, but squillions of people think that turning the UPnP setting off (if they even know what that is) is sufficient, which is why the myth persists.

UPnP is only relevant for software that's already running on your machine locally. People here aren't generally talking about outbound connections and I think you both know that. The practical effect of NAT as commonly encountered in a residential setting is to drop inbound unsolicited connection attempts.

And yes, everyone is aware that you could also do that with a stateful firewall. And no, none of us care about arguments of definition that attempt to frame NAT as technically being a firewall based on how it operates in practice. Being intentionally obtuse by refusing to acknowledge the obvious isn't going to convince anyone.

Re: IPv6 is not insecure because it lacks a NAT

#249

Post by fc417fc802 »

fsh wrote: post #172
kortilla wrote: post #158

Earlier quoted context omitted.

> NAT is not for security, it does not provide security. It’s not for security but it absolutely does provide security and pretending otherwise continues to harm discussions. I have a pile of ipv4-only IoT devices that have no firewalls of their own that are being protected by the symmetric NAT in my home router. Kick and scream all you want but there is security there and nothing on the internet can reach those devi…

If you really don't have a stateful v4 firewall, your ISP can happily connect to all of your devices.

First they will have to change their policy of only providing one IPv4 address per ONT connection. Then they will have to convince me to disable NAT on my router, disable the DHCP server on my router, and bridge the WAN port with the LAN block.

Meanwhile in IPv6 land the ISP provided router that my relative has came configured by default to hand out globally routable addresses from the ISP provided /64. Thankfully it also had a stateful firewall enabled by default so there was no difference in practice.

Re: IPv6 is not insecure because it lacks a NAT

#250

Post by nottorp »

jeroenhd wrote: post #240
nottorp wrote: post #221

Earlier quoted context omitted.

> many of them don't seem to be open to the idea of learning something new To the idea of learning something designed by commitee, over complex and stinking of enterprise and that you simply can't deploy "by hand". One of the advantages of NAT by the way is that your "outside" configuration and "inside" configurations are completely independent with the exception of the snat rule.

The "inside" is your /56 or /48. You can add more local-only "inside"s if you'd like, which is useful for terrible ISPs with rotating network prefixes. The "outside" is everything on the internet. If you can make your way through the absolute slog that is ARP+DHCP, you can get through NDP+SLAAC. Or even NDP+DHCPv6 if you're a control freak. > One of the advantages of NAT by the way is that your "outside" configuratio…

> The "inside" is your /56 or /48.

No it's not mine. It's the ISPs.

> which is useful for terrible ISPs with rotating network prefixes

... which is what you said :)

> If you can make your way through the absolute slog that is ARP+DHCP, you can get through NDP+SLAAC. Or even NDP+DHCPv6 if you're a control freak.

Oo enterprise. I believe you missed another 5 or 6 acronyms that are also required for having ipv6 internally.

Post reply on HN