Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

251–260 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#251

Post by MPSimmons »

fc417fc802 wrote: post #245
MPSimmons wrote: post #227

Earlier quoted context omitted.

I agree with the majority of your point, but hopefully your printer hasn't been assigned IPv6 IPs that are global in nature and is instead limited to site-local. For anyone who is reading this but hasn't use IPv6, IPv6 addresses are a large flat 128-bit contiguous address space, but they are not universally routable. The prefix of any specific address determines what group of other IPs can get to it. We often think o…

If you plug your printer into your home network, and if the local DHCP server is configured to hand out globally routable addresses from your ISP provided /64, then your printer will also be globally routable (as well as your "smart" fridge, "smart" TV, "smart" thermostat, etc). In my personal experience this is the default situation with consumer ISP IPv6 setups. This difference in theory versus practice is precisel…

>This difference in theory versus practice is precisely why we see people objecting that IPv4 is more secure as far as default configurations go when it comes to home use.

I mean, I agree with them. I think people who say 'NAT is not security' are only correct in the absolute most pendantic way and that the way NAT is commonly configured is literally the only reason the internet doesn't consist mostly of botnets.

But I also suspect that if IPv6 were more common, we as a society would be better at it, and not do dumb things like hand out globally routable IPs via DHCP6

Re: IPv6 is not insecure because it lacks a NAT

#252

Post by Gigachad »

iso1631 wrote: post #193
Gigachad wrote: post #33

Earlier quoted context omitted.

The lack of NAT has no bearing on security. Despite an old mistaken belief.

Defence in depth is a valid security approach, and NAT provides another defence in depth If you have a vulnerable ipv4 machine on 192.168.0.24 port 2345 which is hidden behind a public IP of 1.2.3.4, and you set your firewall rule to allow any inbound traffic, with no nat rules then it will be exceedingly difficult for a remote attacker to reach that vulnerable port (they have to trick your router's connection table…

It’s the same layer. On router admin panels it’s literally the same UI for firewall rules and nat port forwarding. If you went in to your router admin and allowed all ports on v4 it would be exactly the same as allowing all on v6. The router will happily forward all connections to v4 devices the same.

Re: IPv6 is not insecure because it lacks a NAT

#253

Post by jeroenhd »

nottorp wrote: post #250
jeroenhd wrote: post #240

Earlier quoted context omitted.

The "inside" is your /56 or /48. You can add more local-only "inside"s if you'd like, which is useful for terrible ISPs with rotating network prefixes. The "outside" is everything on the internet. If you can make your way through the absolute slog that is ARP+DHCP, you can get through NDP+SLAAC. Or even NDP+DHCPv6 if you're a control freak. > One of the advantages of NAT by the way is that your "outside" configuratio…

> The "inside" is your /56 or /48. No it's not mine. It's the ISPs. > which is useful for terrible ISPs with rotating network prefixes ... which is what you said :) > If you can make your way through the absolute slog that is ARP+DHCP, you can get through NDP+SLAAC. Or even NDP+DHCPv6 if you're a control freak. Oo enterprise. I believe you missed another 5 or 6 acronyms that are also required for having ipv6 internal…

> Oo enterprise. I believe you missed another 5 or 6 acronyms that are also required for having ipv6 internally.

It's not 2010 anymore, IPv6 works internally out of the box. If you don't know what ARP means then you will have no problems using IPv6.

Re: IPv6 is not insecure because it lacks a NAT

#254

Post by muvlon »

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important.

I understand the difference between NAT and firewall perfectly well. I have deployed and configured both for many years. The strawman of "NAT without firewall" is pretty much irrelevant, because that's not what people run IRL.

Firewalls are policy-based security, NAT is namespacing. In other fields, we consider namespacing an important security mechanism. If an attacker can't even name a resource they're not allowed to access, that's quite a strong security property. And of course, anyone can spoof IP and try to send traffic to 192.168.0.6 or whatever. But if you're anywhere in the world other than right inside my ISP's access network, you can't actually get the internet to route this to my local 192.68.0.6. On the other hand, an IPv6 firewall is one misconfigured rule away from giving anybody on the planet access.

Re: IPv6 is not insecure because it lacks a NAT

#255

Post by globular-toast »

ifh-hn wrote: post #219
globular-toast wrote: post #165

Earlier quoted context omitted.

Why would you do that when a regular default-deny firewall is and has always been the security feature you need, without the complications and problems of NAT?

Like I said I'm not expert, and was likely talking shit. I was just speculating based on the discussion in this thread. I think the complications and problems of NAT seem to add a default layer of security to the whole thing. I know next to nothing about firewalls though, which might be the point here, but would a default deny present any problems for me that NAT would allow? That is is there a situation where as a l…

A firewall is the security feature you want. With a default-deny rule, which most will come configured out of the box with, it does exactly what you expect: block all unsolicited incoming traffic.

Most people are probably actually running a firewall with NAT anyway, they just don't know it because an appliance with default-deny is pretty much install and forget for most people. So, no, it doesn't cause any additional problems.

The only difference with IPv6 is you don't need to NAT any more, but you keep the firewall.

It's important to remember NAT is part of the IP routing layer. In its regular form, a router just forwards packets to where they should be going. So it's plugged in to one or more networks, receives packets on one interface and forwards them, unmolested (well, mostly), to another interface. It's almost completely analogous to letters going through the postal system. The postal service just forwards letters around by looking at the address. It doesn't modify them in any way.

NAT is a bastardisation and is like your postie scribbles out the "return to sender" address and replaces it with his own. If you were to reply to that address, your postie would remember he did that, and replace the address you wrote with the original address he scribbled out earlier. It's not how IP routing is supposed to work at all and, in fact, a device doing NAT cannot strictly be considered a router at all.

Something you can add to any device is a packet filter. A router must not filter packets as it then wouldn't be considered a router (similar to molesting the packets with NAT). But you can insert a packet filter before things get to the router. If you glue those two things together and bundle it in one device then, voila, you have a firewall. A stateful firewall is conceptually like a packet filter and router glued together and working closely together. But you can just think of it like telling your postie "I only want to receive letters from mum" and he just burns all the rest before they get to you front door. (In reality you also want to allow correspondence so it's more like "only allow letters that are replying to letters I sent, which you'll know because you're my postie, or if mum sends a letter first, allow that too").

Writing this up makes me think... why don't we just teach this stuff using the postal system as an analogy? It's an almost perfect analogy and surely even today anyone understands this concept.

Re: IPv6 is not insecure because it lacks a NAT

#256

Post by thayne »

dehrmann wrote: post #142
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

This goes against Hyrum's law. NAT provides the behavior 99.9% of users want, usually by default, out of the box. True firewalls can do the same thing, but not necessarily by default, the firewall might not even by on by default, and there's more room for misconfiguration. IPv6 is a security regression for most people, regardless of its architectural merits or semantics of what's a firewall.

For "most people" the router/gateway has a firewall by default. And there isn't any reason why you can't have a NAT for ipv6, it just isn't necessary.

Re: IPv6 is not insecure because it lacks a NAT

#258

Post by wink »

fc417fc802 wrote: post #237
mannyv wrote: post #163

Earlier quoted context omitted.

You are wrong because you are being overly pedantic. NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate). Your definition of security is too narrow. And saying that NAT is broken a…

Busses aren't for safety. Seatbelts and airbags and etc are. Busses are just for moving large numbers of people around efficiently. And yet statistically I'm safer on a bus. Therefore it's reasonable to ride the bus "for safety".

I would phrase it as: NAT accidentally "breaks" or "makes harder/impossible" something which yields increased security, under some circumstances.

Re: IPv6 is not insecure because it lacks a NAT

#259

Post by Latty »

Havoc wrote: post #257

>NAT isn’t actually a security feature Perhaps not in the high brow network security world, but in practice it really is used that way. Who here has never launched an unauthenticated server on their LAN?

That's what the firewall on your router is for. NAT might also stop someone connecting, but it's not a guarantee. You can get given a public address and be exposed, you can find out your server actually does UPNP automatically and so is exposed, etc... a firewall is more explicit and a better defence.

Re: IPv6 is not insecure because it lacks a NAT

#260

Post by kawsper »

Havoc wrote: post #257

>NAT isn’t actually a security feature Perhaps not in the high brow network security world, but in practice it really is used that way. Who here has never launched an unauthenticated server on their LAN?

When I was about 12 I was working on a PHP3 application, I had some issues with a MySQL query, and I pasted my code to pastebin (or whatever we used back then) and shared the link on IRC, the code included my database credentials.

Back then our ISP gave every computer a public IP.

The next thing that happened was that someone changed my MySQL password, and me being 12, I didn’t know how to change it back.

They made me beg for the password, to much amusement to the whole channel, and then they helped me secure it and taught me how to reset the password.

NAT would have saved me, but I wouldn’t have received a free, though a bit embarrassing, security lesson.

Post reply on HN