Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

301–310 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#301

Post by everdrive »

Latty wrote: post #262
muvlon wrote: post #254

Earlier quoted context omitted.

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…

Except in the real world everyone is also running UPnP, so NAT is also one misconfiguration away from exposing something publicly. In the real world your ISP might enable IPv6 one day and suddenly you do have a public address. Relying on NAT is a bad idea because it's less explicit, a firewall is saying you only want to allow these things through, of course nothing is perfect, you can mess up, but NAT is just less cl…

>Except in the real world everyone is also running UPnP

Definitely not. I've been disabling that for years.

Re: IPv6 is not insecure because it lacks a NAT

#303

Post by sylware »

IPv4 is not secure because it requires a NAT in order to be?

Big centralized online services does not want IPv6 because it "unlocks" internet as intended, full p2p at scale. They won't let that happen easily.

And please stop with that 'computers security', we all know here it does not exist (NAT or not), it is a fantasy. Saying otherwise is engaging in bad faith.

Re: IPv6 is not insecure because it lacks a NAT

#304

Post by mikkupikku »

simonra wrote: post #214
dehrmann wrote: post #142

Earlier quoted context omitted.

This goes against Hyrum's law. NAT provides the behavior 99.9% of users want, usually by default, out of the box. True firewalls can do the same thing, but not necessarily by default, the firewall might not even by on by default, and there's more room for misconfiguration. IPv6 is a security regression for most people, regardless of its architectural merits or semantics of what's a firewall.

I wouldn’t put the number so high. I’ve on several occasions seen not very technical people unnecessarily burn money on VPSes or dedicated hosting providers because they couldn’t expose a game server for a evening session with their friends with the spare capacity on their gaming machine, because of their ISPs NAT setup. 90% would be fairer. However we still shouldn’t be sacrificing securing agency of individual cons…

Dynamic DNS and port forwarding work fine if you really do want to run a server from your residential IPv4 connection. I've done it many times.

Re: IPv6 is not insecure because it lacks a NAT

#305

Post by zrail »

phire wrote: post #266
fc417fc802 wrote: post #241

Earlier quoted context omitted.

It's also trivial to roll your own version of dropbox. With IPv6 it's possible to fail to configure those nftables rules. The firewall could be turned off. In theory you could turn off IPv4 NAT as well but in practice most ISPs will only give you a single address. That makes it functionally impossible to misconfigure. I inadvertently plugged the WAN cable directly into my LAN one time and my ISP's DHCP server promptl…

> In theory you could turn off IPv4 NAT as well but in practice most ISPs will only give you a single address So, I randomly discovered the other day that my ISP has given me a full /28. But I have no idea how to actually configure my router to forward those extra IP addresses inside my network. In practice, modern routers just aren't expecting to handle this, there is no easy "turn of NAT" button. It's possible (at…

Out of curiosity how did you discover this?

Re: IPv6 is not insecure because it lacks a NAT

#306

Post by quotemstr »

1dom wrote: post #292

John, your post opens saying it's addressing the point: “the NAT-by-default of IPv4 effectively means that I get the benefit of a default-deny security strategy.” Your title is "IPv6 is not insecure because it lacks NAT" I'm sure anyone who understands how NAT offers the equivalent of a default block rule also understands that the absence of NAT alone doesn't make IPv6 insecure. This makes the title feel a little cli…

> There's more security to be had in an intrinsic architectural feature

No, there is not. Even ignoring the question of whether the concept of an ordinal ranking in amount of security even makes sense, this claim doesn't make sense. If the invariant is that incoming connections are blocked by default, an IPv4 NAT and an IPv6 default deny rule are equivalent in security: both uphold the invariant. If the claim is that a misconfiguration of the gateway can make the system vulnerable, again, the two kinds of firewall configuration are equivalent: you can configure an IPv6 firewall to pass traffic and you can configure a DMZ host or port forwarding in the NAT case.

There's no basis for claiming the two schemes differ in the level of security provided.

Re: IPv6 is not insecure because it lacks a NAT

#307

Post by redsnake »

Security is a state of mind. So, whatever makes you feel secure, it's your security tool. NAT can be used for security, like VLANs gets a lot used for LAN security. And BTW, NAT can alter destination of IPv4 packet, but also the source. Which is not necessarily only masquerading, and it's seen a lot as embedded security, especially for home Internet. A firewall does not provide security by itself, it has to be configured in the specific way for the situation. I've seen a lot of firewalls with 100s of rules, but the first one was accept all forward, forgotten there by an admin after a test several days/months/years ago.

We are trying too much to put things in unique and well defined boxex. Universe does'n work like this. Security is just a state of mind.

Re: IPv6 is not insecure because it lacks a NAT

#308

Post by reincarnate0x14 »

pregnenolone wrote: post #289

As someone with limited networking knowledge, I’m not really getting smarter here. Some say it adds security; others disagree. Let me ask this: does IPv6 benefit me in any way if I have multiple devices at home behind a router and I'm not running any servers or similar services?

No idea what you're doing on a daily basis, but let's grab a not-exactly random example. You and your friends are at your house trying to play an online game of King's Court (it's super checkers!) with some friends in Denmark. For whatever reason the developers decided all clients will use port 12345 to communicate. In ipv4 with NAT, local connections will be possible but only the first one to try to communicate out will ever possibly succeed. You and your friend are thwarted and have to find some NAT-defeating means or just give up on doing 10-jump moves to ruin each other's evenings and have an internet drinking game. With IPv6, all of it works fine.

Most casual users have lived with NAT so long they assume its limitations are natural. But they are not. You can achieve the same result with a firewall or ACLs or whatever on ipv6, but that's a choice and not a limitation.

Re: IPv6 is not insecure because it lacks a NAT

#309

Post by jonathanlydall »

This article may have been prompted by my (or similar) response to John's comment on [1] yesterday.

He stated:

> NAT is not a firewall: all it does is rewrite packets, it does not drop them.

I noted (without quoting at the time) that the article actually mentions this aspect of NAT, here is a quote from yesterday's article:

> Time and time again we are lectured that NATs are not a good security device, but in practice NATs offer a reasonable front-line defence against network side malware scanning and injection, so there may be a larger story behind the use of NATs and device-based networks than just a simple conservative preference to continue to use an IPv4 protocol stack.

Since I didn't state it before, I don't see any need to add NAT to IPv6 and certainly not for security reasons when a firewall is the correct way to secure networks. I don't feel that IPv6 is inherently more or less secure than IPv4, regardless of NAT. I also agree that even for IPv4, firewalls should be used and that NAT should not be relied on as a security measure for any remotely high stakes situation.

The reason I made my comment though is because I seem to share the same opinion as yesterday's article's author that people stating "NATs are not a good security device" are missing the point that in regard to IPv4, NAT may not be a "fully proper" security measure, but in practice it is "plenty good enough" for the vast majority of internet users.

People proclaiming how NAT is not a security measure seem to me to be ignoring our reality where 100s of millions of consumer routers, incidentally but nevertheless effectively, use it as one. Even without a firewall to drop packets on these devices doing NAT, they effectively block a whole class of automated malicious activity.

Is it safe to have unprotected network devices shielded only by NAT without a firewall? No, not really.

Should you use a proper firewall even if you have NAT? Yes, absolutely, but a lot of people don't and are nevertheless adequately protected considering they probably have no "open" devices on their network and have no particular reason to be targeted by a truly determined malicious actor.

[1] https://news.ycombinator.com/item?id=46691835

Re: IPv6 is not insecure because it lacks a NAT

#310

Post by 7bit »

ifh-hn wrote: post #156

I find the discussion about whether or not NAT is a security feature or not interesting. To my mind NAT was intended to make ipv4 last longer in a clever way as address space dried up. A happy accident of this solution is a basic security feature. Ipv6 doesn't (currently, will it ever?) have the same address space problem so each device anywhere could be globally routable. But we know that's not really a good thing s…

You said it yourself. NAT was introduced to solve the address space issue. At that point firewall were already a thing.

You also acknowledged correctly that IPv6 Will botnrun into the same address space limitations.

You said NAT is not a good thing Security-wise. Then you follow up the question, why we shouldn't add that to IPv6 as a security feature. It's hard to understand the train of thought.

So let me answer this. While NAT incidently does something similar to a firewall, it is not a security feature. NAT must track any outgoing network connection in order to understand where to route incoming packets. If a packet it not a reply to an established connection, it is dropped. Otherwise the NAT must look up who opened the connection. A NAT can only work if stateful.

In a routable connection, ALL of that can be based on the static routing table.

Imagine a university with 10,000 computer, all of them having opened maybe 100 concurrent connections. The NAT must track every single connection and do a lookup for every packet.

In a routable network, it just looks up the destination IP in the packet and sends it to the next hop for the destination IP.

All while hopefully a firewall is in front of it.

So why would you want to reintroduce NAT to IPv6, when both issues are efficiently solved already?

Post reply on HN