Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

321–330 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#321

Post by 7bit »

paulddraper wrote: post #97
lq9AJ8yrfs wrote: post #88

NAT causes security issues too. Reflection attacks are much harder to stop if the endpoint and its network address are decoupled. You can provoke loops and tangles of many sorts, some at the same protocol level and others going up and down. My memory is fading but I vaguely recall a time when all of AOL shared something like a dozen egress addresses for certain traffic -- might have been proxies as opposed to NAT/"PA…

The RFC introducing NAT -- RFC 1631 -- says: > Unfortunately, NAT reduces the number of options for providing security [1] Somehow, everyone forgot that, and it morphed into a cargo-culting security practice, even going so far as to propagate 1990s network limitations into the cloud(!) [1] https://www.rfc-editor.org/rfc/rfc1631.html

Thanks for that quote. Finally something to slap into the faces of those who just refuse to acknowledge that NAT is not a security feature.

Re: IPv6 is not insecure because it lacks a NAT

#322

Post by user3939382 »

quotemstr wrote: post #306
1dom wrote: post #292

John, your post opens saying it's addressing the point: “the NAT-by-default of IPv4 effectively means that I get the benefit of a default-deny security strategy.” Your title is "IPv6 is not insecure because it lacks NAT" I'm sure anyone who understands how NAT offers the equivalent of a default block rule also understands that the absence of NAT alone doesn't make IPv6 insecure. This makes the title feel a little cli…

> There's more security to be had in an intrinsic architectural feature No, there is not. Even ignoring the question of whether the concept of an ordinal ranking in amount of security even makes sense, this claim doesn't make sense. If the invariant is that incoming connections are blocked by default, an IPv4 NAT and an IPv6 default deny rule are equivalent in security: both uphold the invariant. If the claim is that…

You talked right past the key point which is valid:

> There's more security to be had in an intrinsic architectural feature (like IPv4 NAT being necessary due to limited IPv4 space meaning most IPv4 devices behind CANNOT be addressed from the internet without NAT) then there are in policy features (most firewalls SHOULD have the default deny IPv6 rule that will stop their address being reached from the internet.)

One security property is architectural, one isn’t. They’re not the same.

Re: IPv6 is not insecure because it lacks a NAT

#323

Post by torginus »

I think there's a philosophical difference between IPv4 and IPv6.

IPv4 is from the era of local computer networks, which feature clients and servers. Clients talk to servers, but servers are not supposed to care or even know about clients unless clients decide to reach out to them. Client-to-Client communication is generally discouraged. The IP address is just a technicality and outside of local networks, just a part of the routing strategy.

IPv6 on the other hand is like an URL - an address you can use to find any device from anywhere on the planet. It makes no distinction between client and server. Which is why its pushed in places like IoT and smartphones - a voip call has no conceptual client and server.

One could make ones smartphones Ipv6 address openly available, and anyone could initiate a voip call to their phones. Would this be wise? I'd argue there's no scenario under which this doesn't cause an unacceptable level of risk, as even if the software is perfect, they'd be still vulnerable to DDOS attacks.

This means that NAT-equivalent firewall rules are necessary, which makes the whole discussion kind of moot, but it's not a good portent for Ipv6 that it makes previously unfeasible kinds of attacks potentially practical.

NAT also allows for other neat tricks, like IP level load balancing.

I'd say one huge and unambiguous advantage of IPv6 is that it makes UDP trivial.

Re: IPv6 is not insecure because it lacks a NAT

#324

Post by da_chicken »

DaSHacka wrote: post #143
da_chicken wrote: post #91

Earlier quoted context omitted.

I'm sorry, this is just an elaborate argument of obscurity-as-security. You're clinging to privacy as though it were security, in stark avoidance of Kerckhoffs's principle.

> You're clinging to privacy as though it were security, in stark avoidance of Kerckhoffs's principle. TIL that IPv6 is a cryptosystem

You can use Shannon's maxim instead if you're going to be deliberately obtuse. The point is true for any system intended to be secure, and a network is such a system, as is the security software such as the claimed NAT software.

Or do you really want to argue that Linux Netfilter/nftables or BSD pf being open source is a security problem?

Re: IPv6 is not insecure because it lacks a NAT

#325

Post by tbrownaw »

torginus wrote: post #323

I think there's a philosophical difference between IPv4 and IPv6. IPv4 is from the era of local computer networks, which feature clients and servers. Clients talk to servers, but servers are not supposed to care or even know about clients unless clients decide to reach out to them. Client-to-Client communication is generally discouraged. The IP address is just a technicality and outside of local networks, just a part…

> IPv4 is from the era of local computer networks, which feature clients and servers. Clients talk to servers, but servers are not supposed to care or even know about clients unless clients decide to reach out to them. Client-to-Client communication is generally discouraged.

No, it was meant to be a global address space where anything could talk to anything. That became unworkable due to scale and the limit inherent in using only 32 bits for the address space.

Some older protocols (ftp) don't play nice with NAT and need special handling, because address multiplexing was never intended to be a thing.

Re: IPv6 is not insecure because it lacks a NAT

#326

Post by zajio1am »

deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…

RFC 4787 does not really describe how real world implementations behave. As almost all SOHO routers are Linux-based, i prefer to discuss Linux netfilter-based NAT behavior than some hypothetical RFC 4787 NAT. There are clear differences. For example, RFC 4787 says:

> REQ-1: A NAT MUST have an "Endpoint-Independent Mapping" behavior

While Linux netfilter behavior is "Address and Port-Dependent Mapping".

As Linux netfilter implements both NAT and firewall behavior, it is relevant for the discussion which parts of overall netfilter behavior falls into 'NAT part' and which into 'firewall part'. There is clear distinction - DNAT/SNAT rules in nat table represent NAT behavior, while REJECT/DROP rules in filter table represent firewall behavior.

As Linux-based SOHO routers are usually configured with both NAT and firewall netfilter rules to implement both NAT and firewall behavior, one cannot answer question 'Does NAT filter traffic?' based on external behavior of such SOHO routers, but has to analyze which part of the network stack is responsible for such behavior, or how the same network stack configured with just NAT rules and no firewall rules would behave. And here the answer is no, it would pass traffic (that do not match existing connections) unmodified.

Re: IPv6 is not insecure because it lacks a NAT

#327

Post by arka2147483647 »

pregnenolone wrote: post #289

As someone with limited networking knowledge, I’m not really getting smarter here. Some say it adds security; others disagree. Let me ask this: does IPv6 benefit me in any way if I have multiple devices at home behind a router and I'm not running any servers or similar services?

Smart home and lighting standard Matter over Thread requires it. Discovered this after i bought some Ikea smart lights. Though you don't need a public IP6, a local static IP6 with SLAAC is enough.

Re: IPv6 is not insecure because it lacks a NAT

#328

Post by [deleted] »

AnssiH wrote: post #287
fdr wrote: post #160

For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. This is all to underscore the author's point: NAT may necessitate s…

> These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. FWIW, I was interested so I tested this on my phone here in Finland (Elisa, the largest carrier here): IPv6 inbound TCP connections work just fine, unlike IPv4 which is behind CGNAT. On mobile broadband (no calls) plans they also offer optional free public IPv4 address, but not on the regular phone plans.…

[deleted]

Re: IPv6 is not insecure because it lacks a NAT

#329

Post by tbrownaw »

> NAT isn’t actually a security feature—it’s an address conservation mechanism that became necessary because we ran out of IPv4 addresses.

> But the security benefits people attribute to NAT actually come from the stateful firewall that’s typically bundled with NAT routers.

1. It requires a stateful firewall.

2. It isn't possible to accidentally a default-allow rule on that firewall.

It may not be intended as a security feature, but it can't not act as one in practice.

Re: IPv6 is not insecure because it lacks a NAT

#330

Post by sedawkgrep »

Latty wrote: post #262
muvlon wrote: post #254

Earlier quoted context omitted.

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…

Except in the real world everyone is also running UPnP, so NAT is also one misconfiguration away from exposing something publicly. In the real world your ISP might enable IPv6 one day and suddenly you do have a public address. Relying on NAT is a bad idea because it's less explicit, a firewall is saying you only want to allow these things through, of course nothing is perfect, you can mess up, but NAT is just less cl…

> Except in the real world everyone

...and goes on to ignore enterprise businesses, which consume most of the v4 space and are among the biggest resisters of v6.

Post reply on HN