Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

331–340 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#331

Post by sedawkgrep »

dspillett wrote: post #295
mannyv wrote: post #163

Earlier quoted context omitted.

You are wrong because you are being overly pedantic. NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate). Your definition of security is too narrow. And saying that NAT is broken a…

> NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. Any good firewall does the same, by having a default “no” rule for incoming connections. > A firewall is not required for NAT to work Do you have any examples of NAT that isn't implemented in a more general firewall subsystem? > NAT effectively reduces the attack surface for a home network…

> Do you have any examples of NAT that isn't implemented in a more general firewall subsystem?

When I was a network engineer, we did NAT on edge routers for B2B connections all the time. Like literally hundreds of thousands of them. I am 100% serious on this.

Re: IPv6 is not insecure because it lacks a NAT

#332

Post by throw0101a »

torginus wrote: post #323

I think there's a philosophical difference between IPv4 and IPv6. IPv4 is from the era of local computer networks, which feature clients and servers. Clients talk to servers, but servers are not supposed to care or even know about clients unless clients decide to reach out to them. Client-to-Client communication is generally discouraged. The IP address is just a technicality and outside of local networks, just a part…

> IPv4 is from the era of local computer networks, which feature clients and servers.

IPv4 on the ARPANET 'went live' in January 1983,[1] but the concept of a firewall didn't really happen until about a decade later (with some protocols having to be altered[2]):

* https://en.wikipedia.org/wiki/Firewalls_and_Internet_Securit...

Some of us still remember open (SMTP) relays and the openness of the early Internet:

* https://en.wikipedia.org/wiki/Open_mail_relay

IPv4 has always not been only about local computer networks: end-to-end connectivity was there at the start and only got choked off later.

[1] https://en.wikipedia.org/wiki/Flag_day_(computing)

[2] https://datatracker.ietf.org/doc/html/rfc1579

Re: IPv6 is not insecure because it lacks a NAT

#333

Post by deng »

zajio1am wrote: post #326
deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…

RFC 4787 does not really describe how real world implementations behave. As almost all SOHO routers are Linux-based, i prefer to discuss Linux netfilter-based NAT behavior than some hypothetical RFC 4787 NAT. There are clear differences. For example, RFC 4787 says: > REQ-1: A NAT MUST have an "Endpoint-Independent Mapping" behavior While Linux netfilter behavior is "Address and Port-Dependent Mapping". As Linux netfi…

The problem is: what is an implementation detail, and what is NAT as a concept? This line is very blurry. The RFC does not really distinguish this and also doesn't want to. As it says, it tries to document behavior and explicitly uses the term "NAT filtering". When we say "This box here does NAT", then we implicitly assume this behavior. You might argue that implicit is not good, and I would agree (this is the advantage of ipv6 with firewall: filtering is explicit rather than implicit). However, if someone tells me "Well actually, NAT does not do filtering, the firewall does", then to me this is similar to arguing with staff in a supermarket that the tomato belongs in the berries section.

I also want to make clear that I fully agree with the article's main point: NAT's primary purpose was and still is address conservation, and that ipv6 is no less secure than ipv4. I do disagree though with the notion that "NAT does not do filtering" or that "NAT does not provide any security".

Re: IPv6 is not insecure because it lacks a NAT

#334

Post by user3939382 »

I’m not using any networking implementation that’s less tested and ipv6 is less tested. Network routing means there are dozens of TCPIP implementations touching traffic. The benefit of ipv6 for my case isn’t worth the risk. If you’ve never run into an ipv6 specific bug good for you.

Re: IPv6 is not insecure because it lacks a NAT

#335

Post by sedawkgrep »

krackers wrote: post #135
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

RFC 4787 is useful in distinguishing NAT mapping vs filtering. Surprisingly symmetric NAT actually seems quite rare today.

It's absolutely common in enterprise networks.

Re: IPv6 is not insecure because it lacks a NAT

#336

Post by sedawkgrep »

fsh wrote: post #179
oofbey wrote: post #140

Earlier quoted context omitted.

I understand ipv4 networks pretty well. And I would say that any device doing NAT is acting as a basic firewall. Do “true” firewalls do more? Sure. But saying NAT doesn’t provide security is flat out wrong.

If your router had only NAT and someone (i.e. your ISP) sends it a package addressed to somewhere inside your internal IP range, it will happily forward it. A firewall would block it.

Who exactly is going to route/send an RFC1918 address to an Internet gateway?

Are you implying your ISP itself is going to do this? Because the Internet at-large doesn't have routes for your internal address space.

Re: IPv6 is not insecure because it lacks a NAT

#337

Post by sedawkgrep »

bandrami wrote: post #282
ErroneousBosh wrote: post #276

Earlier quoted context omitted.

Okay, so not only do you have to create a bogus packet, you have to convince every piece of equipment in between you and the end user to collude with it, in the hopes that the final router is so woefully misconfigured as to act upon it?

The ISP is the primary threat vector here (do you trust yours? Along with their contractors and anyone who might have compromised them?). But like I said route-poisoning attacks do exist.

yeah but the likelihood of this is incredibly remote. It would shock me if ISPs didn't have alarms going off if RFC1918 space was suddenly routable within their BGP table.

Not to mention the return packet would be NAT'd so the attacker would have to deal with that complication.

Re: IPv6 is not insecure because it lacks a NAT

#338

Post by throw0101a »

mannyv wrote: post #163
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

You are wrong because you are being overly pedantic. NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate). Your definition of security is too narrow. And saying that NAT is broken a…

> NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side.

Which NAT?

A 1:1 'basic' NAT [1] could allow stateless flow between two different address schemes. Then you have NAPT where multiple IPs can be mapped via one-IP-many-port system, in which you need state and thus have a filtering mechanism.

Similarly you can have IPv6 ULA and do a stateless address translation (NPT) without any blocking policy, which would achieve the same (lack of) security as the 1:1 scenario above.

Address translation can have the same level (or not) of security in both IPv4 and IPv6.

[1] https://datatracker.ietf.org/doc/html/rfc2663#section-4.1.1

Re: IPv6 is not insecure because it lacks a NAT

#339

Post by tbrownaw »

mannyv wrote: post #163
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

You are wrong because you are being overly pedantic. NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate). Your definition of security is too narrow. And saying that NAT is broken a…

> And indeed, if a firewall is off NAT can still function (if NAT is separate).

Well technically you can translate your /16 to look like a different /16 from the outside. IE each internal address gets turned into its own separate external address.

But that's not how NAT gets used in practice. How it actually gets used is to but many hidden addresses behind one or a few public addresses. And that multiplexing necessarily implies that incoming connections must be specifically told where to go; ie that there's a firewall.

Re: IPv6 is not insecure because it lacks a NAT

#340

Post by tsoukase »

muvlon wrote: post #254
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…

Thank you. This is the first time that someone admits here that NAT actually adds some security. IPv4 will never go away less that an important share because of it's simplicity and NAT-level security it offers to millions of professionals and amateurs that tinker with their routers.
Post reply on HN