Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv4 Declared Historic – Draft

datatracker.ietf.org

Post reply on HN
Print view View original

31–40 of 40 posts

Re: IPv4 Declared Historic – Draft

#31

Post by api »

chatmasta wrote: post #20
api wrote: post #9

Earlier quoted context omitted.

NAT is not a security feature. Please stop repeating this toxic drivel. NAT is not the same as firewalls, and firewalls do not require NAT. NAT is just an ugly hack to stretch IPV4's inadequate address space, and it's one that breaks quite a few protocols and generally makes a lot of things painful and complex. Remember back when there were two dozen different networking layers vying for the ability to link Docker co…

I didn't say NAT is a security feature. I said developers use NAT to benefit security. The security benefit of NAT is that it forces developers to assign a predictable, private IP address to each device/container/vm/box behind its "firewall," which the gateway can then use for enforcing QoS policies or port whitelisting. Sure, you can do this on IPv6. But IPv6 is more complicated to implement, because all tools suppo…

How does that help security?

IPv6 has usability problems (I've written on this), but these are unrelated to security in any direct way.

The reason I call it toxic is that the idea that NAT helps security is a harmful superstition that spooks people about IPv6 adoption. It's also driven some to actually implement IPv6 NAT, which is kind of like strapping a horse feed bag on the front of your car.

There's a ton of superstition and cargo cultism in network security, since most people -- even developers -- don't understand much about how networks work.

Re: IPv4 Declared Historic – Draft

#32

Post by jepler »

nandhp wrote: post #25
__david__ wrote: post #22

It's interesting to see this looks like it was drafted by a Time Warner Cable employee, and yet my twc internet still doesn't support IPv6. Though it gives me hope that maybe it's coming soon?

If your equipment is all IPv6-capable, you may just need to have swap out your modem. Time Warner Cable has achieved 100% IPv6 availability (possibly excluding certain phone customers): http://www.timewarnercable.com/en/support/faqs/faqs-internet...

.. except no static ipv6 even for commercial / business class users? wt---

Re: IPv4 Declared Historic – Draft

#33

Post by wtallis »

jepler wrote: post #32
nandhp wrote: post #25

Earlier quoted context omitted.

If your equipment is all IPv6-capable, you may just need to have swap out your modem. Time Warner Cable has achieved 100% IPv6 availability (possibly excluding certain phone customers): http://www.timewarnercable.com/en/support/faqs/faqs-internet...

.. except no static ipv6 even for commercial / business class users? wt---

What's the point? The addresses TWC assigns are extremely stable in my experience. Are you trying to run a public-facing DNS server or do you have some other need to hard-code IP addresses?

Re: IPv4 Declared Historic – Draft

#34

Post by abstractbeliefs »

wtallis wrote: post #33
jepler wrote: post #32

Earlier quoted context omitted.

.. except no static ipv6 even for commercial / business class users? wt---

What's the point? The addresses TWC assigns are extremely stable in my experience. Are you trying to run a public-facing DNS server or do you have some other need to hard-code IP addresses?

Well, DNS needs you to "hard"code the IP addresses you are available at against your domains.

Before you suggest DDNS, for some companies, the length of unavailability between a changed IP and the DDNS client noticing and updating can be fatal.

Re: IPv4 Declared Historic – Draft

#35

Post by yusyusyus »

api wrote: post #31
chatmasta wrote: post #20

Earlier quoted context omitted.

I didn't say NAT is a security feature. I said developers use NAT to benefit security. The security benefit of NAT is that it forces developers to assign a predictable, private IP address to each device/container/vm/box behind its "firewall," which the gateway can then use for enforcing QoS policies or port whitelisting. Sure, you can do this on IPv6. But IPv6 is more complicated to implement, because all tools suppo…

How does that help security? IPv6 has usability problems (I've written on this), but these are unrelated to security in any direct way. The reason I call it toxic is that the idea that NAT helps security is a harmful superstition that spooks people about IPv6 adoption. It's also driven some to actually implement IPv6 NAT, which is kind of like strapping a horse feed bag on the front of your car. There's a ton of supe…

NAT is so painful. Even the specs are written with grossly overloaded terminology.

>The reason I call it toxic is that the idea that NAT helps security is a harmful superstition that spooks people about IPv6 adoption.

In all fairness, the common NAT implementation involves L4 params and the requisite state for ingress traffic. It makes like a filter that is "drop any" with respect to the NAT IP address (with the exception of in-state traffic). Further, it also limits the IP protocols available. Example, you will not likely be doing SCTP across your NAT and certainly it would be difficult to send directed OSPF packets during this[0] fun thing. It still leaves things to be done (like dropping internal IP space traffic on the external IFs), but the requisite components supply a lot.

I think I've seen the problem though. In general, network engineers have failed to break down the components of NAT: 1) State, 2) Rewrite, 3) A filter dropping traffic not matched by state. Fundamentally, the only thing we need to do in IPv6 is 1) state and 2) a filter. Their failure, combined with the packaging of components that NAT provides, feeds the valid points of the superstition while neglecting the details (what happens when we look at too big of a picture, or philosophical thing).

>It's also driven some to actually implement IPv6 NAT, which is kind of like strapping a horse feed bag on the front of your car.

The ignorance of management and "netwerk sekurity esperts" aside, NAT does have use cases in IPv6. Example, if we're performing renumbering frequently, does it make operational sense to roll over prefixes with RAs/DHCP? Maybe the expectation is for multiple prefix advertisement, but then which IP should be used for internal vs. external? Should all applications always rely on DNS? What are the implications for routing networks that may be designed with separate number spaces? The reasons for why these things may be done are not absolutely "wrong" or "bad design" and should not necessarily adopt a purist model.

[0]https://tools.cisco.com/security/center/content/CiscoSecurit...

Re: IPv4 Declared Historic – Draft

#36

Post by zurn »

azdle wrote: post #5

Everyone take note that this is an individual v0 draft, it says "Type: Active Internet-Draft (individual)" and "Intended status: Standards Track". Before this becomes and RFC (if it ever does at all) it has to go through discussions as an individual draft, then it has to be voted to become standards track, at which point it will become a working group draft where it goes through more comments, editing, and waiting, a…

It's not voting exactly at the IETF, they nominally reject it[1]. Approximately it goes through the relevant working group (without voting but by "rough consensus"), IESG, various reviews and RFC editor.

[1] “We reject kings, presidents, and voting. We believe in rough consensus and running code” - Dave Clark, quoted by http://arstechnica.com/tech-policy/2011/01/25-years-of-ietf-... for example

Re: IPv4 Declared Historic – Draft

#37

Post by sergioocon »

Wow, I released and RFI 12 years ago on IPv6 when I was working in a Telco, and every vendor talked about it as a reality... I am still waiting for that reality to be an actual one. I am still waiting for my ISP to activate IPv6 in my WLAN at home... after all those years

Re: IPv4 Declared Historic – Draft

#38

Post by solidangle »

lisivka wrote: post #27
solidangle wrote: post #10

Earlier quoted context omitted.

NAT is not a security feature, it never was and it will never be. Stateful connection tracking however is a security feature. NAT uses it to route the right packets to the right computers, but firewalls can also use the same feature to drop unsolicited packets. It's nearly trivial to do this with iptables, OpenWRT does it by default, and I'm sure most other IPv6-capable routers do it too. I'm just as secure on IPv6 a…

I use IPv4 (NAT) and IPv6 at home. I can access my desktop behind NAT using IPv6, which is good, but I see attempts to bruteforce root password via SSH, which is bad.

So why don't you just run a firewall on your router?

Re: IPv4 Declared Historic – Draft

#39

Post by pyvpx »

abstractbeliefs wrote: post #34
wtallis wrote: post #33

Earlier quoted context omitted.

What's the point? The addresses TWC assigns are extremely stable in my experience. Are you trying to run a public-facing DNS server or do you have some other need to hard-code IP addresses?

Well, DNS needs you to "hard"code the IP addresses you are available at against your domains. Before you suggest DDNS, for some companies, the length of unavailability between a changed IP and the DDNS client noticing and updating can be fatal.

why are they hosting services on their dynamically addressed business line? everyone offers static addressing on business lines. it's a completely rip off; and conveniently makes the proper route -- colocation, a dedicated server, "the cloud" -- more financially sound.

Re: IPv4 Declared Historic – Draft

#40

Post by danyork »

__david__ wrote: post #22

It's interesting to see this looks like it was drafted by a Time Warner Cable employee, and yet my twc internet still doesn't support IPv6. Though it gives me hope that maybe it's coming soon?

The draft is written by a Time Warner Cable employee, Lee Howard. Lee has been an outspoken advocate for IPv6 for many years and has been very involved with TWC's rollout of IPv6. (I am a TWC customer and did get IPv6 in Keene, NH, about 2 years ago.)
Post reply on HN