Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

361–370 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#361

Post by api »

deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…

One more important thing to note:

If you really feel you must have NAT, there is IPv6 NAT. Unlike IPv4 NAT, V6 affords enough address space that IPv6 NAT can do 1:1 IP:IP mapping between internal and external. This eliminates entire classes of issues around port exhaustion and port remapping and allows P2P applications to work fine. P2P NAT traversal with simple 1:1 NAT has a nearly 100% success rate on the first attempt.

Re: IPv6 is not insecure because it lacks a NAT

#362

Post by ilaksh »

fdr wrote: post #160

For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. This is all to underscore the author's point: NAT may necessitate s…

Being allowed to serve data from your own device should be seen as a natural human right.

If the networks don't have capacity or something then we need networks that can support that.

The idea that all of that has to go in the Fediverse on a server or something is just gatekeeping.

Wait a few years as IPV6 becomes truly ubiquitous. This will become very obvious to everyone and standard. People must be allowed to communicate directly, even if they have a lot of clients.

The opinions are slightly similar to remote work. Telecommuting was an obvious next step for a long time, it just took a certain number of decades for society to realize it.

Re: IPv6 is not insecure because it lacks a NAT

#363

Post by nobody9999 »

mannyv wrote: post #163
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

You are wrong because you are being overly pedantic. NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate). Your definition of security is too narrow. And saying that NAT is broken a…

>NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side.

No. NAT enables internal, non-routable (cf. rfc1918[0]) actors on the inside to access external resources on the Internet. Generally, that's done via NAT masquerade[1] (one-to-many NAT), but can also be done with one-to-one NAT.

>A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate).

No. It isn't. And if you enable NAT without firewall rules, it will happily expose your internal network to external actors. In fact, that's the whole point of NAT.

In fact, not using IPv4 NAT is enormously more secure than using IPv4 NAT, assuming you're using RFC1918 addresses internally. Primarily because non-NATted RFC1918 addresses won't be forwarded by routers on the Internet (CGNAT notwithstanding).

>Here's the end point: NAT effectively reduces the attack surface for a home network to the router. That is security, practically speaking.

Again, no. Enabling NAT increases the attack surface for all networks, regardless of type. Without NAT, external actors need to compromise your router first, then get it to accept spoofed packets.

Yes, there's detail that I've ignored, as it's irrelevant to the statements made. Most of that is related to "I want to access Internet resources, but my ISP won't give me anything but a single, ephemeral, routable IPv4 address, so I need to use NAT to share that one address."

That's not an argument for the "security" of NAT, it's an argument for being mad at your ISP, especially if they won't give you a /56 block of IPv6 addresses.

[0] https://www.rfc-editor.org/rfc/rfc1918

[1] https://en.wikipedia.org/wiki/Network_address_translation#On...

Re: IPv6 is not insecure because it lacks a NAT

#364

Post by Latty »

skywhopper wrote: post #273
Latty wrote: post #262

Earlier quoted context omitted.

Except in the real world everyone is also running UPnP, so NAT is also one misconfiguration away from exposing something publicly. In the real world your ISP might enable IPv6 one day and suddenly you do have a public address. Relying on NAT is a bad idea because it's less explicit, a firewall is saying you only want to allow these things through, of course nothing is perfect, you can mess up, but NAT is just less cl…

No, not everyone is running UPnP. Maybe on most home networks, but that’s not the audience that even knows or cares about NAT.

I think this is where the disconnect is: the home users are precisely the ones being talked about, because they are the ones most likely to be treating NAT like it is a security system for their devices in the real world.

I've literally seen someone's ISP turn on IPv6, and then have their long-running VNC service compromised because they were just relying on NAT to hide their services.

Re: IPv6 is not insecure because it lacks a NAT

#365

Post by bandrami »

sedawkgrep wrote: post #337
bandrami wrote: post #282

Earlier quoted context omitted.

The ISP is the primary threat vector here (do you trust yours? Along with their contractors and anyone who might have compromised them?). But like I said route-poisoning attacks do exist.

yeah but the likelihood of this is incredibly remote. It would shock me if ISPs didn't have alarms going off if RFC1918 space was suddenly routable within their BGP table. Not to mention the return packet would be NAT'd so the attacker would have to deal with that complication.

You're missing the part where the ISP is the one doing it

Re: IPv6 is not insecure because it lacks a NAT

#366

Post by egberts1 »

NAT's only functions are:

- share a precious IP address at the NAT gateway border

- hide your internal LAN from external network mapper

Last point becomes moot when internal mapping software kicks in, legitimately or not, JavaScript or disingenuous application/daemon/app.

Welcome to Cybersecurity SecOP.

Now this is where Carrier-Grade NAT really shines: added functionality of handling mobile devices' changing IP addresses as it hops from one subnet to another (switching between G5/CSM/WiFi/personal-hotspot)

Re: IPv6 is not insecure because it lacks a NAT

#367

Post by lq9AJ8yrfs »

paulddraper wrote: post #97
lq9AJ8yrfs wrote: post #88

NAT causes security issues too. Reflection attacks are much harder to stop if the endpoint and its network address are decoupled. You can provoke loops and tangles of many sorts, some at the same protocol level and others going up and down. My memory is fading but I vaguely recall a time when all of AOL shared something like a dozen egress addresses for certain traffic -- might have been proxies as opposed to NAT/"PA…

The RFC introducing NAT -- RFC 1631 -- says: > Unfortunately, NAT reduces the number of options for providing security [1] Somehow, everyone forgot that, and it morphed into a cargo-culting security practice, even going so far as to propagate 1990s network limitations into the cloud(!) [1] https://www.rfc-editor.org/rfc/rfc1631.html

Real world CSRF attacks into hxxp://192.168.0.1 home routers and polluting DNS and DHCP settings you could argue is caused or at least facilitated by NAT, or NAT misconceptions especially.

Though IPv6 has a similar situation with well defined unicast and multicast addresses.

True story, popular browsers won't let you load a webpage via various IPv6 local address literals for this reason. Hxxp://[ff02::] addresses won't work.

/ You can have your cake by "tying a knot" with yourself and port forwarding from 127.0.0.1 to the IPv6 literal. An ssh port forward will do this with aplomb. Then load hxxp://localhost:port and it works again.

// Browser logic

Re: IPv6 is not insecure because it lacks a NAT

#368

Post by Latty »

willis936 wrote: post #284
Latty wrote: post #262

Earlier quoted context omitted.

Except in the real world everyone is also running UPnP, so NAT is also one misconfiguration away from exposing something publicly. In the real world your ISP might enable IPv6 one day and suddenly you do have a public address. Relying on NAT is a bad idea because it's less explicit, a firewall is saying you only want to allow these things through, of course nothing is perfect, you can mess up, but NAT is just less cl…

It's not "relying on NAT" to have it as a layer in the swiss cheese. Relying on any one thing is a bad strategy.

Sure, and that's fine, but relying on it isn't, and it isn't a reason not to use IPv6 (if you want namespacing, there are tools for that outside hiding behind a single IPv4). Hence the advice is not to rely on NAT.

This is people talking past each other, and to be fair, saying "everyone" in my post made it unclear, I was being glib in response to "because that's not what people run IRL", when evidently people do, I've seen it happen.

Re: IPv6 is not insecure because it lacks a NAT

#369

Post by aboardRat4 »

dannyobrien wrote: post #230
fdr wrote: post #160

For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. This is all to underscore the author's point: NAT may necessitate s…

What would be the obvious reasons? (I'm not being flippant here -- I'm genuinely interested in what arguments people have to not allow servers on that network)

In China you need a license to run a server.

Re: IPv6 is not insecure because it lacks a NAT

#370

Post by zamadatix »

Spivak wrote: post #112
ghshephard wrote: post #57

Earlier quoted context omitted.

NAT66 doesn't add much in the way of security here, because the external address is fully routable and maps 1:1 to the internal address. You are once again fully dependent on a correctly configured firewall. The IPv6 address that I shared was, in fact, a static (and real) IPv6 address, belonging to a real device - with the possible exception of the last 3 bytes, was likely one I worked on frequently. Put another way…

Hardest to attack: fcab:cdef:1234:5678:9abc:def0:1234:5678 The whole point is that your devices on the inside of your network can't be routed to at all.

It's the same difficulty to attack in all 3 cases: hack the internet firewall, which the only point providing connectivity between both internal and external addresses regardless of what the address itself is.

You don't need to change the prefix to prevent an address from being routed to from the internet, but you do need a firewall if you want an address to be securely reachable from the internet. If you don't want an address to be reachable, what the address is whatsoever doesn't matter so long as you've implemented any possible way of making it unreachable.

Post reply on HN