Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

291–300 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#291

Post by deng »

Latty wrote: post #262
muvlon wrote: post #254

Earlier quoted context omitted.

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…

Except in the real world everyone is also running UPnP, so NAT is also one misconfiguration away from exposing something publicly. In the real world your ISP might enable IPv6 one day and suddenly you do have a public address. Relying on NAT is a bad idea because it's less explicit, a firewall is saying you only want to allow these things through, of course nothing is perfect, you can mess up, but NAT is just less cl…

UPnP is not tied to NAT, where do you have this from? UPnP is used to request direct connections, a firewall can implement UPnP just as well as a NAT.

Re: IPv6 is not insecure because it lacks a NAT

#292

Post by 1dom »

John, your post opens saying it's addressing the point: “the NAT-by-default of IPv4 effectively means that I get the benefit of a default-deny security strategy.”

Your title is "IPv6 is not insecure because it lacks NAT"

I'm sure anyone who understands how NAT offers the equivalent of a default block rule also understands that the absence of NAT alone doesn't make IPv6 insecure. This makes the title feel a little clickbaity-strawmanny, sorry.

Your response seems to be: "most firewalls have a default block rule too meaning they're no worse than IPv4 w/ NAT."

There's more security to be had in an intrinsic architectural feature (like IPv4 NAT being necessary due to limited IPv4 space meaning most IPv4 devices behind CANNOT be addressed from the internet without NAT) then there are in policy features (most firewalls SHOULD have the default deny IPv6 rule that will stop their address being reached from the internet.)

That doesn't make IPv6 insecure because no NAT. But it does mean - IMO - that the intrinsic block that comes with IPv4 NAT is a better security measure for making devices inaccessible than relying on default firewall rules.

What point are you trying to make here, and is it actually more useful than the point you say you're addressing?

Re: IPv6 is not insecure because it lacks a NAT

#293

Post by deng »

pregnenolone wrote: post #289

As someone with limited networking knowledge, I’m not really getting smarter here. Some say it adds security; others disagree. Let me ask this: does IPv6 benefit me in any way if I have multiple devices at home behind a router and I'm not running any servers or similar services?

No

Re: IPv6 is not insecure because it lacks a NAT

#294

Post by deng »

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5

Several things can be correct at the same time:

* NAT is not a firewall

* NAT can still filter traffic (and practically always does)

* NAT can hence still provide security features

* The real world often does not care about original definitions of a term. NAT was originally meant to just do address translation, but it has evolved.

* Of course, ipv6 is not less secure because it doesn't have NAT, as the same filtering behavior can be replicated with a firewall. That may even have advantages over NAT.

Re: IPv6 is not insecure because it lacks a NAT

#295

Post by dspillett »

mannyv wrote: post #163
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

You are wrong because you are being overly pedantic. NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate). Your definition of security is too narrow. And saying that NAT is broken a…

> NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side.

Any good firewall does the same, by having a default “no” rule for incoming connections.

> A firewall is not required for NAT to work

Do you have any examples of NAT that isn't implemented in a more general firewall subsystem?

> NAT effectively reduces the attack surface for a home network to the router.

While true, this doesn't add to the argument for/against IPv6. That is just security provided by default configuration, which can be provided many other ways and could be before the subset of NAT you are talking about was common.

Re: IPv6 is not insecure because it lacks a NAT

#296

Post by dist-epoch »

iso1631 wrote: post #204
cyberax wrote: post #134

I wrote that comment, and you can write to yourself how many times you want that NAT is not a firewall. The truth of the matter is that NAT absolutely _is_ a firewall in _practice_. Not in theory "because it doesn't drop packets" or "because it was not meant to be a security feature". But in the actual real-world practice. It effectively protects most networks from most attackers without ANY additional configuration,…

If you don't have RPF enabled on your router in theory your upstream peer can send traffic to 192.168.80.26 and it would pass through. Reply traffic may or may not be natted depending on how it's entered in the connection tracking table. There may be situations where your router can be tricked too, I can't think of one off the top of my head which wouldn't also apply to a stateful firewall sitting on a routed network…

For 99%+ of residential users, the upstream peer is the router owner/operator, so they can just direct the router to hack you if they wished. So this NAT "vulnerability" is not useful in practice, since it can only be used by your upstream which already "owns" you.

Re: IPv6 is not insecure because it lacks a NAT

#297

Post by IncRnd »

dannyobrien wrote: post #230
fdr wrote: post #160

For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. This is all to underscore the author's point: NAT may necessitate s…

What would be the obvious reasons? (I'm not being flippant here -- I'm genuinely interested in what arguments people have to not allow servers on that network)

The phone providers oversell bandwidth. They also limit the use of already purchased bandwidth when it gets legitimately used.

Similar to many industries, their business model is selling monthly usage, while simultaneously restricting the actual usage. They are not in the business of being an ISP for people running software on their phones.

Re: IPv6 is not insecure because it lacks a NAT

#299

Post by wongarsu »

lunar_rover wrote: post #234
dannyobrien wrote: post #230

Earlier quoted context omitted.

What would be the obvious reasons? (I'm not being flippant here -- I'm genuinely interested in what arguments people have to not allow servers on that network)

The most common use case for mobile data servers is probably pwned cheap/old phones forming DDoS swarms. Pure P2P over internet is very rare on mobile, no sense not blocking ingress from the perspective of ISPs.

However for that having the phone's IP not reachable has at best marginal benefits. The DDoS itself is an outgoing connection, and for command and control having the compromised phone periodically fetch instructions from a server is simpler to implement than the phone offering a port where it is reachable to receive instructions

Re: IPv6 is not insecure because it lacks a NAT

#300

Post by mikkupikku »

With IPv4, if NAT isn't working right then I simply cannot get online and I need to fix it. Fail safe. With IPv6, when my computers being globally addressable is the norm, if my firewall is misconfigured my computers will probably still be online. Fail unsafe.

Arguing this is pointless anyway because it's not even my decision, it's my ISP. I am however quite happy with my ISP's choices in this regard.

Post reply on HN