IPv6 without NAT is not insecure; I can and do have a stateful firewall that denies unwanted inbound connections. But it does not matter if my auditors think otherwise and the whole Internet tells me that arguing with them will end my career.
[dead]
IPv6 is not insecure because it lacks a NAT
271–280 of 606 posts
Re: IPv6 is not insecure because it lacks a NAT
#272Earlier quoted context omitted.
If you really don't have a stateful v4 firewall, your ISP can happily connect to all of your devices.
How do they manage that?
If your public IP from your ISP is 12.13.14.15, and your internal block is 192.168.0.0/24, then your ISP can send a packet to 12.13.14.15 destined for 192.168.0.7, and without a firewall your router will happily forward it. An attacker who can convince intervening routers to send traffic destined for 192.168.0.7 to 12.13.14.15 (and these attacks do exist, particularly over UDP) can also do that.
Re: IPv6 is not insecure because it lacks a NAT
#273Earlier quoted context omitted.
It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…
Except in the real world everyone is also running UPnP, so NAT is also one misconfiguration away from exposing something publicly. In the real world your ISP might enable IPv6 one day and suddenly you do have a public address. Relying on NAT is a bad idea because it's less explicit, a firewall is saying you only want to allow these things through, of course nothing is perfect, you can mess up, but NAT is just less cl…
No, not everyone is running UPnP. Maybe on most home networks, but that’s not the audience that even knows or cares about NAT.
Re: IPv6 is not insecure because it lacks a NAT
#274If IPv6 is behind firewall, apps can't use it for P2P connections, so the major point of IPv6 network becomes moot. And IPv4 NAT is actually possible to penetrate sometimes. So for some networks, IPv4 provides better P2P connectivity, than IPv6.
[dead]
Re: IPv6 is not insecure because it lacks a NAT
#275Earlier quoted context omitted.
I think the confusion stems from the fact that my mom's laptop with its 192.168.0.43/24 v4 address is not routable except via NAT, and people believe (rightly or wrongly) that that confers a degree of security.
It doesn't confer much since it COULD be only NAT and no firewall. It's INCREDIBLY unlikely to find a case of that in the wild, but possible. A common example of a host that might have such an address but lacks that sort of security is anything as the default route for inbound packets, E.G. like you'd want your _own_ router / firewall rather than the ISP's modem.
I've managed networks where a publicly-routable block was NATed behind their router
Re: IPv6 is not insecure because it lacks a NAT
#276Earlier quoted context omitted.
How do they manage that?
If your public IP from your ISP is 12.13.14.15, and your internal block is 192.168.0.0/24, then your ISP can send a packet to 12.13.14.15 destined for 192.168.0.7, and without a firewall your router will happily forward it. An attacker who can convince intervening routers to send traffic destined for 192.168.0.7 to 12.13.14.15 (and these attacks do exist, particularly over UDP) can also do that.
Okay, so not only do you have to create a bogus packet, you have to convince every piece of equipment in between you and the end user to collude with it, in the hopes that the final router is so woefully misconfigured as to act upon it?
Re: IPv6 is not insecure because it lacks a NAT
#277Earlier quoted context omitted.
> The distinction you're trying to draw here, between exclusively using NAT to provide security, versus it being one component of a stack of network controls that could just as easily be replaced with others, isn't meaningful. That's not the distinction I, or TFA, set out to make. It's not that NAT is a component of controls that could be replaced by others, it's that whether NAT was put in place for security or if i…
The whole point of NAT firewalls is that the devices behind it don't have routable addresses. "Statefulness" improves the situation, but the translation itself provides a material control.
Which, again, only helps you against attackers who are on the other side of a router you trust. Do you trust your ISP?
Re: IPv6 is not insecure because it lacks a NAT
#278Earlier quoted context omitted.
> The "inside" is your /56 or /48. No it's not mine. It's the ISPs. > which is useful for terrible ISPs with rotating network prefixes ... which is what you said :) > If you can make your way through the absolute slog that is ARP+DHCP, you can get through NDP+SLAAC. Or even NDP+DHCPv6 if you're a control freak. Oo enterprise. I believe you missed another 5 or 6 acronyms that are also required for having ipv6 internal…
> Oo enterprise. I believe you missed another 5 or 6 acronyms that are also required for having ipv6 internally. It's not 2010 anymore, IPv6 works internally out of the box. If you don't know what ARP means then you will have no problems using IPv6.
> IPv6 works internally out of the box
Works if you rely on the ISP provided box?
And why pick on ARP and not on SLAAC, NDS, DAD, RS, RA... ?
Re: IPv6 is not insecure because it lacks a NAT
#279I hate NAT with a passion. It's a terrible technology, whose disruptive nature has probably prevented any novelty on the transport layer. But this article is oversimplifying things. It is well known that NAT is not meant for security and that NAT is not a firewall. But one cannot deny that it implicitly brings some "default" security to the table. With NAT it's basically impossible to screw you over because there is…
> there is no meaningful practical way to allow inbound connections without the client explicitly defining them
This... just isn't true though. Your router knows it has one network on one interface and one network on another interface and if it receives a packet on the one interface destined for the network on the other interface will happily route it unless something (a firewall) tells it not to. All the protection comes from trusting your ISP and its peers to not route RFC1918-private networks
Re: IPv6 is not insecure because it lacks a NAT
#280Earlier quoted context omitted.
I don’t have any idea how they got the ip, it could certainly have been making outbound connections, though. I think it had NTP, although I might have pointed it at a local server we had for that.
> I don’t have any idea how they got the ip, You might've been using DHCPv6 assigning sequential addresses starting at 1? Remember: friends don't let friends use DHCPv6[*]. Help out, uninstall DHCPv6 today. [*] in IA_NA mode (address assignment). PD and stateless info-only are fine.
More useless crap to remember for a useless protocol.