Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

341–350 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#341

Post by dorfsmay »

AnssiH wrote: post #287
fdr wrote: post #160

For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. This is all to underscore the author's point: NAT may necessitate s…

> These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. FWIW, I was interested so I tested this on my phone here in Finland (Elisa, the largest carrier here): IPv6 inbound TCP connections work just fine, unlike IPv4 which is behind CGNAT. On mobile broadband (no calls) plans they also offer optional free public IPv4 address, but not on the regular phone plans.…

When you say no ipv4 on regular phone plan, you mean no routable ipv4 on the internet, or no ipv4 at all?

Re: IPv6 is not insecure because it lacks a NAT

#342

Post by fc417fc802 »

phire wrote: post #319
zrail wrote: post #305

Earlier quoted context omitted.

Out of curiosity how did you discover this?

Went to double check what my static IP address was, and noticed the router was displaying it as 198.51.100.48/28 (not my real IP). I don't think the router used to show subnets like that, but it recently got a major firmware update... Or maybe I just never noticed, I've had that static IP allocation for over 5 years. My ISP gave it to me for free after I complained about their CGNAT being broken for like the 3th time…

More like even if they looked at the logs they aren't about to replace an expensive box on the critical path when it's working well enough for 99% of their customers.

I once had my ISP respond to a technical problem on their end by sending out a tech. The service rep wasn't capable of diagnosing and refused to escalate to a network person. The tech that came out blamed the on premise equipment (without bothering to diagnose) and started blindly swapping it out. Only after that didn't fix the issue did he finally look into the network side of things. The entire thing was fairly absurd but I guess it must work out for them on average.

Re: IPv6 is not insecure because it lacks a NAT

#343

Post by throw0101a »

jcgl wrote: post #231
digitalPhonix wrote: post #187

Earlier quoted context omitted.

It’s still conflating things. You can have a stateless NAT: device x.x.x.y will get outbound source ports rewritten to (orignal port) This is a (dumb) NAT but has no state so it cannot possibly implement a default deny or any firewall adjacent features.

And that kind of NAT effectively doesn't exist in practice, so that's quite beside the point. Such a NAT doesn't scale to more than 24 devices behind it.

>> You can have a stateless NAT: device x.x.x.y will get outbound source ports rewritten to (orignal port)

> And that kind of NAT effectively doesn't exist in practice […]

Anyone using IPv6 ULA and NPT would disagree.

* https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr...

Re: IPv6 is not insecure because it lacks a NAT

#344

Post by AnssiH »

dorfsmay wrote: post #341
AnssiH wrote: post #287

Earlier quoted context omitted.

> These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. FWIW, I was interested so I tested this on my phone here in Finland (Elisa, the largest carrier here): IPv6 inbound TCP connections work just fine, unlike IPv4 which is behind CGNAT. On mobile broadband (no calls) plans they also offer optional free public IPv4 address, but not on the regular phone plans.…

When you say no ipv4 on regular phone plan, you mean no routable ipv4 on the internet, or no ipv4 at all?

Regular phone plans on my carrier have a private IPv4 address behind CGNAT.

Re: IPv6 is not insecure because it lacks a NAT

#345

Post by throw0101a »

muvlon wrote: post #254
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…

> It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them.

It's only been drilled into people because it's true:

* https://blog.ipspace.net/2011/12/is-nat-security-feature/

Re: IPv6 is not insecure because it lacks a NAT

#346

Post by throw0101a »

sedawkgrep wrote: post #336
fsh wrote: post #179

Earlier quoted context omitted.

If your router had only NAT and someone (i.e. your ISP) sends it a package addressed to somewhere inside your internal IP range, it will happily forward it. A firewall would block it.

Who exactly is going to route/send an RFC1918 address to an Internet gateway? Are you implying your ISP itself is going to do this? Because the Internet at-large doesn't have routes for your internal address space.

> Who exactly is going to route/send an RFC1918 address to an Internet gateway?

The GP is talking about 1:1 'basic' NAT:

* https://datatracker.ietf.org/doc/html/rfc2663#section-4.1.1

Re: IPv6 is not insecure because it lacks a NAT

#347

Post by notepad0x90 »

nemothekid wrote: post #155
notepad0x90 wrote: post #137

I disagree with this strongly. The intended use case of NAT or the existence of inbound connections being blocked by routers is irrelevant. For NAT, of course it isn't meant for security, but it has a side-effect of creating a network boundary, and that has positive security implications. If your router doesn't have a firewall blocking any connections, NAT still has security implications as it is deployed typically o…

The problem is, as I understand it, is this hypothetical network where there is a NAT but no firewall just does not exist. > In commercial grade routers, the same applies except even if the external IP knew to direct the router to the right internal IP, or if the route knew to direct the traffic to the right external IP for outbound connections, unless you configure a default route, or a more explicit route, it won't…

It is not, you guys are talking from a specific american ISP perspective where you have these modem+router+gateway+firewall combo devices. Not everyone gets that.

Many get just a modem and buy a cheap router which may not have a firewall. MANY more get just a modem and their laptops are directly exposed to the internet (!!!), those you can't do much about, but many put a "router" that's just a cheap wifi access point with layer 3 routing and NAT. If you chose to "bridge" a device (like those internet exposed laptops) or port-forward, it will just work (even with ISP routers!!) there is no firewall rule change required.

I've worked in this space supporting consumer grade routers, and then worked in enterprise networking. But don't take my word for it, you all can take a trip to shodansafari, how many devices are listening port 3389 and 445 with consumer grade laptop names?

But it isn't a popular thing to say for whatever reason. I guess IPv6 is a political ideology now lol.

Re: IPv6 is not insecure because it lacks a NAT

#348

Post by BenjiWiebe »

mikkupikku wrote: post #304
simonra wrote: post #214

Earlier quoted context omitted.

I wouldn’t put the number so high. I’ve on several occasions seen not very technical people unnecessarily burn money on VPSes or dedicated hosting providers because they couldn’t expose a game server for a evening session with their friends with the spare capacity on their gaming machine, because of their ISPs NAT setup. 90% would be fairer. However we still shouldn’t be sacrificing securing agency of individual cons…

Dynamic DNS and port forwarding work fine if you really do want to run a server from your residential IPv4 connection. I've done it many times.

Until you run into CGNAT...

Re: IPv6 is not insecure because it lacks a NAT

#349

Post by [deleted] »

ghshephard wrote: post #9

This is the first thing that as a Network Engineer I was taught - and every formal security class I've taken (typically from Cisco - they have awesome course) - repeats the same thing. I believe the common knowledge is somewhat more nuanced than people would have you believe I present to you two separate high-value targets whose IP address has leaked: IPv4 Target: 192.168.0.1 IPv6 Target: 2001:1868:209:FFFD:0013:50FF…

[deleted]

Re: IPv6 is not insecure because it lacks a NAT

#350

Post by ahlCVA »

Obviously the two aren't the same (especially given the need to do routing), but I've always found it amusing that in the systems world, capability-based systems (i.e. making it impossible to address things you aren't allowed to access) are gaining traction while the philosophy in the networking world seems to be going in the opposite direction (make it possible to address everything, i.e. IPv6 vs. NATted IPv4, then add filtering).
Post reply on HN