Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

311–320 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#311

Post by Macha »

pregnenolone wrote: post #289

As someone with limited networking knowledge, I’m not really getting smarter here. Some say it adds security; others disagree. Let me ask this: does IPv6 benefit me in any way if I have multiple devices at home behind a router and I'm not running any servers or similar services?

Do you play video games with P2P networking? Then your choices are to pick one of the following:

- the hosting player enables upnp

- use ipv6

- the hosting player manually sets up port forwarding (consumer routers often talk about a DMZ option which takes an IP address - really this is just forwarding all ports not matched by any other rule)

Re: IPv6 is not insecure because it lacks a NAT

#312

Post by rnhmjoj »

everdrive wrote: post #298

Right, IPv6 is annoying because it lacks NAT. There's a big difference between something being a huge pain to deal with (IPv6) and being insecure.

Ok, I'll bite: why do you say that IPv6 lacking NAT (which is not true by the way) would be annoying? We can finally get rid of an ugly workaround from 30 years ago that broke one core principle of the Internet (end-to-end connectivity) and a ton of protocols that required even uglier hacks (FTP and SIP ALGs, TURN/STUN, etc.) to barely work. Why would this be annoying?

Re: IPv6 is not insecure because it lacks a NAT

#313

Post by craftkiller »

everdrive wrote: post #298

Right, IPv6 is annoying because it lacks NAT. There's a big difference between something being a huge pain to deal with (IPv6) and being insecure.

IPv6 doesn't "lack" NAT. There is nothing preventing you from using ULA addresses inside your network (IPv6's version of RFC-1918) and then running NAT for those addresses on your router. IPv6 just doesn't _need_ NAT, but it is still an option.

Re: IPv6 is not insecure because it lacks a NAT

#314

Post by rnhmjoj »

cyberax wrote: post #121
denkmoon wrote: post #7

Invoking NAT "security" as a reason against IPv6 is a surefire indicator the person invoking it has absolutely no idea what they're talking about and should not be allowed within typing distance of any network infrastructure

Please. _I_ invoked that argument, and I bet I know more about IPv6 than you do. All my services and networks have IPv6. And my first operational issues with IPv6 were in 2008, when my Asterisk SIP server started failing after ~12 hours. Culprit? Privacy addresses kept accumulating until they overflowed the SIP UDP packet size because it listed all the combinations of supported codecs/endpoints. Oh, btw, do try to an…

You should have just disabled temporary addresses, they don't make a lot of sense on a server.

Re: IPv6 is not insecure because it lacks a NAT

#316

Post by jcgl »

aragilar wrote: post #246
jcgl wrote: post #231

Earlier quoted context omitted.

And that kind of NAT effectively doesn't exist in practice, so that's quite beside the point. Such a NAT doesn't scale to more than 24 devices behind it.

No, it very much does. If you want to join two network segments such that on one side all devices are on 10.1.X.X and the other all devices are 10.2.X.X, you'd use a mapping between 10.1.a.b and 10.2.a.b See https://en.wikipedia.org/wiki/Network_address_translation#Me...

The general context here is about NATting to the public internet at large, not between particular segments. And the parent of my comment was talking specifically about NAPT, which is different from the non-port-based NAT that you're talking about.

Re: IPv6 is not insecure because it lacks a NAT

#317

Post by ErroneousBosh »

bandrami wrote: post #282
ErroneousBosh wrote: post #276

Earlier quoted context omitted.

Okay, so not only do you have to create a bogus packet, you have to convince every piece of equipment in between you and the end user to collude with it, in the hopes that the final router is so woefully misconfigured as to act upon it?

The ISP is the primary threat vector here (do you trust yours? Along with their contractors and anyone who might have compromised them?). But like I said route-poisoning attacks do exist.

Yes, I trust everyone who works at it, mostly because I know where they live.

Re: IPv6 is not insecure because it lacks a NAT

#318

Post by Macha »

nottorp wrote: post #278
jeroenhd wrote: post #253

Earlier quoted context omitted.

> Oo enterprise. I believe you missed another 5 or 6 acronyms that are also required for having ipv6 internally. It's not 2010 anymore, IPv6 works internally out of the box. If you don't know what ARP means then you will have no problems using IPv6.

> IPv6 works internally out of the box Works if you rely on the ISP provided box? And why pick on ARP and not on SLAAC, NDS, DAD, RS, RA... ?

Been running IPv6 for years on both my home network and internet servers, and I've never had to think about NDS, DAD, RS. SLAAC is something I've only had to think about once at network setup time, less than I think about DHCP on my IPv4 network. RAs I have actually had to think about because Unifi has had some regressions in IPv6 support over the years, but that's fixed these days so it's likely going into the "don't need to think about it" bucket too.

Of course I'm sure you think about DHCP address management, DHCPDISCOVER and DHCPOFFER packets, mDNS, ACD, etc., since clearly you like to get into the weeds of your network

Re: IPv6 is not insecure because it lacks a NAT

#319

Post by phire »

zrail wrote: post #305
phire wrote: post #266

Earlier quoted context omitted.

> In theory you could turn off IPv4 NAT as well but in practice most ISPs will only give you a single address So, I randomly discovered the other day that my ISP has given me a full /28. But I have no idea how to actually configure my router to forward those extra IP addresses inside my network. In practice, modern routers just aren't expecting to handle this, there is no easy "turn of NAT" button. It's possible (at…

Out of curiosity how did you discover this?

Went to double check what my static IP address was, and noticed the router was displaying it as 198.51.100.48/28 (not my real IP).

I don't think the router used to show subnets like that, but it recently got a major firmware update... Or maybe I just never noticed, I've had that static IP allocation for over 5 years. My ISP gave it to me for free after I complained about their CGNAT being broken for like the 3th time.

Guess they decided it was cheaper to just gave me a free static IPv4 address rather than actually looking at the Wireshark logs I had proving their CGNAT was doing weird things again.

Not sure if they gave me a full /28 by mistake, or as some kind of apology. Guess they have plenty of IPs now thanks to CGNAT.

Re: IPv6 is not insecure because it lacks a NAT

#320

Post by mono442 »

krackers wrote: post #135
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

RFC 4787 is useful in distinguishing NAT mapping vs filtering. Surprisingly symmetric NAT actually seems quite rare today.

It's not surprising. Symmetric nat breaks some software.
Post reply on HN