291–300 of 316 posts
Earlier quoted context omitted.
You need both firewalls and private addresses, of course. Anything else is amateur hour madness.
You don't need private addresses. You may need non-routable addresses, but they do not need to come from a "private" network range.
Earlier quoted context omitted.
> I don't understand why I will resist the urge to be snarky at your expense and politely point out that exposing your LAN to public routing tables is madness, from all perspectives. It brings no benefits and carries huge risks.
>exposing your LAN to public routing tables is madness And I don't understand why people think that. You are exposing a /64 network. That's 2^64 addresses, no one can scan your LAN if that's what you fear, nor can anyone reach your hosts if you build a stateful firewall that denies incoming connections - you know, just like NAT. But minus the packet modifications.
Are we really back to security by obscurity? Please don't tell me you are serious.
Anyways, you can't rely on ISP's handing out sufficiently large network ranges to make your security-by-obscurity scheme work.
Earlier quoted context omitted.
> I don't understand why I will resist the urge to be snarky at your expense and politely point out that exposing your LAN to public routing tables is madness, from all perspectives. It brings no benefits and carries huge risks.
Using global addresses is not, of course, "exposing your LAN to public routing tables", or any charitable interpretation thereof. Reachability != addressing.
Earlier quoted context omitted.
Can you remember what year it was? I’ve got a slight suspicion you were given some bullshit or at least a creative treatment of facts e.g. everything had IPv6 support but FUD-filled network engineers didn’t want to turn it on. Most network devices I’ve encountered were dual-stack way before anyone I knew seemed to care about actually using IPv6 — I always assumed it was added for US government/military requirements.
Right, if you worked at Amazon and didn't have incentive, then, you didn't do it. It was part of your job to not do things which you were not incentivized to do.
Earlier quoted context omitted.
> private addresses Private addresses offer no security benefit whatsoever. If you have no firewall, nothing at all prevents me from doing `ip route add 10.0.0.0/8 your.routers.ip.here`
Nothing prevents you from doing that, but your martian packets have zero chance of reaching my router.
You got faked out :)
IP is silly and refers to next hops by IP address, which fundamentally makes very little sense, because IP routing actually works by sending packets toward either whatever is on the other end of a point-to-point link irrespective of its address or toward a certain destination on a certain link, where that destination is addressed by a link-specific address (generally a MAC address). In common usage, the sole purposes of a next hop IP address are to identify the link (implicitly, while configuring the route) and to tell the router what IP address to ask for via ARP / neighbor discovery so it can actually route there.
With that in mind you are (on Linux, anyway) very much prevented from this particular mucking around:
$ sudo ip route add 1.2.3.4/32 via 5.6.7.8 Error: Nexthop has invalid gateway.
Because it's not actually possible to route a packet via a host that isn't locally reachable.
You can try to send packets using various encapsulation schemes to try to convince an intermediate router to decapsulate the packet and forward it to an attacker-controlled address, and someone manages to pull this off every now and then. Actually getting the evil packets in question to traverse the public Internet can be challenging but is not necessarily impossible. So the actual point stands -- relying on a private IPv4 address range to be unreachable by the general public merely by virtue of being private and without using an ACL is a mistake.
Earlier quoted context omitted.
You don't need private addresses. You may need non-routable addresses, but they do not need to come from a "private" network range.
A distinction without a difference. Private addresses are those that aren't globally routable by definition.
(a) addresses that are globally unique but not globally routable. (These are extremely common in IPv6. These are not so common in IPv4 because IPv4 addresses are expensive, so people try to minimize usage, so people will try to avoid using paid-for globally unique addresses for non-routable purposes.)
(b) addresses that are in ranges that are, per spec and actual usage, only even defined within an organization and are not globally unique. For example, 192.168.0.1.
(a) and (b) are not the same by any useful definition. Sorry.
Many years ago when I was a junior dev at Amazon, there was a massive project internally to split up every internal system into regional versions with limited gateways allowing calls between regions. The reason? We had run out of internal IPv4 addresses. The Principal PM in charge of the "regionalization" effort was asked in a Q&A "why didn't we just switch to IPv6?". Her answer was something along the lines of "The…
> replacing all of the old network hardware may just be a project too large to do on a short timescale. If that is the case, then Amazon should hold off on charging for IPv4 on a short timescale until they have replaced all the old hardware and can support IPv6 internally everywhere.
Earlier quoted context omitted.
What? Private networks are defined as networks, that use private address ranges[0]. They are most certainly not AWS "rhetoric". And why are unique MAC addresses a problem? [0] https://en.wikipedia.org/wiki/Private_network
Private address ranges doesn’t make a network private. Firewall does. If I know the external, publicly addressable IP address of your router (e.g. 135.77.9.106), and no firewall whatsoever, there’s nothing at all preventing me from doing `ip route add 10.0.0.0/8 135.77.9.106`, and voila, I’d have a route to your “private” network. Using private addresses vs globally unique offers no security benefiy whatsoever.
This only works if you are on the same L2 segment as 135.77.9.106, or control and install this route on every router between you and it. Otherwise, 10/8 will get routed to the next hop for 135.77.9.106, i.e. your local gateway, which won't know anything about the intended 135.77.9.106 destination and will route it normally (which likely means dropping it).
It's true that firewall rules should be in place to prevent this attack from your direct neighbors, but it's not possible to perform it over multiple hops that you don't control.
Earlier quoted context omitted.
> Also some (most?) CGNAT implementations are buggy and is not a good user experience, even for users who don't understand the concept of IP at all. They're a pain, especially when you're visiting a website with CAPTCHAs, but the money they save on buying IP space seems to be worth the bad experience from an ISP point of view. Even here in the Netherlands, with its relatively high wages, a fiber ISP decided to use CG…
Assuming you’re referring to Delta/Caiway… I think they’re expanding quite quickly, considering both started out as smaller local ISPs; so it’s probably between CGNAT and having to acquire IP space for them. The fact that they’re owned by an investment fund also makes them probably very focused on profitability. As a point of comparison, the other players aggressively rolling out fiber (KPN, ODF/Odido) have been nati…
Ziggo's DS-Lite, which also CGNATs IPv4 traffic, is annoying but at least you get a normal IPv6 subnet. This would've been a much better solution looking forward.
Dutch ISPs in general have plenty of space. Dutch ISPs has 53 million IPv4 addresses for a country of 18 million according to the first result on Google. Every person in every household can have a home connection and two servers without anyone lacking IPv4 addressing if these addresses were all pooled together.
However, there's no guarantee that things will stay this way. Like I said, Ziggo already does a form of CGNAT, and as the price of IPv4 addresses keeps rising, I expect more cheap providers to start selling off address space. KPN will stick to normal IPv4 for a while, but I don't trust super cheap companies like Odido to have the benefit of the consumer in mind, especially after trying to route all traffic through their affiliated German exchange instead of AMS-IX a while back. Odido is owned by an American fund as well (which is why they had to change their name), as is VodafoneZiggo.
Earlier quoted context omitted.
The EU did have a mandate for government services to use IPv6, but the programme it was part of got replaced by another that didn't include IPv6. The European Commission did advocate for IPv6 use, but, the EU being the EU, motivated their recommendation by complaining that law enforcement had issues tracking down people behind CGNAT, and made clear that they wanted every IP address to point to a specific person for l…
> ISPs can CGNAT for cheap The problem is customers don't like CGNAT. You can't run Animal Crossing on Nintendo Switch in network mode as a host if you don't place the Switch as a catch-all in the DMZ. Wish I were joking here - especially due to the security risk involved in running something in all-ports-open on the Internet - but Nintendo doesn't seem to (want to) run STUN/TURN servers.
CGNAT brings tons of issues, but following Amazon's pricing model, I don't think consumers would be willing to pay $4 a month to rent an IP address. Better to sigh and shrug at the two of three games and programs that don't work than to spend $48 a year, especially with the current cost of living being on the rise.