Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

391–400 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#391

Post by kingstnap »

fsh wrote: post #199
kijin wrote: post #196

Earlier quoted context omitted.

Find me a consumer IPv4 router sold in the last ~10 years that does that by default. Security comparisons should be between proposed new tech vs. existing tech, not vs. hypothetical straw-man tech.

Find me a consumer IPv6 router sold in the last ~10 years without a restrictive firewall enabled by default. I have never seen one.

Mine lol. My ISP sent a Nokia Beacon 3.1. When I first logged into its web GUI, it had a "Security" tab with these dropdowns.

Security level

High: Traffic denied inbound and minimally permit common service outbound.

Low: All outbound traffic and pinhole-defined inbound traffic is allowed.

Off: All inbound and outbound traffic is allowed.

It was actually set to "Off" interestingly enough.

Re: IPv6 is not insecure because it lacks a NAT

#392

Post by tsimionescu »

bandrami wrote: post #272
ErroneousBosh wrote: post #225

Earlier quoted context omitted.

How do they manage that?

If your public IP from your ISP is 12.13.14.15, and your internal block is 192.168.0.0/24, then your ISP can send a packet to 12.13.14.15 destined for 192.168.0.7, and without a firewall your router will happily forward it. An attacker who can convince intervening routers to send traffic destined for 192.168.0.7 to 12.13.14.15 (and these attacks do exist, particularly over UDP) can also do that.

You're using somewhat sloppy terminology that will confuse things. An IP packet can't be addressed both to 12.13.14.15 AND to 192.168.0.7.

The realistic attack here is that your ISP sends a packet with destination address 192.168.0.7 to the MAC of your router (the MAC that corresponds to 12.13.14.15). This is a realistic attack scenario if the device that your router connects directly to gets compromised (either by an attacker or by the ISP itself).

Getting a public route that would take packets destined for 192.168.0.7 to reach your router over the Internet is far more unlikely.

Re: IPv6 is not insecure because it lacks a NAT

#393

Post by nashashmi »

fdr wrote: post #160

For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. This is all to underscore the author's point: NAT may necessitate s…

What about hotspotting? Do the client pc's get the same IPv6 address as the mobile phone?

Re: IPv6 is not insecure because it lacks a NAT

#394

Post by zamadatix »

tptacek wrote: post #110
simoncion wrote: post #109

Earlier quoted context omitted.

Ah, I see what you're driving at. It's a security feature in the same way that a power-cut switch is a security feature. A power-cut switch's purpose is cut power to a machine so that it can -say- be safely worked on or relocated (or simply to not draw power when the machine's not in use), the machine also happens to be inaccessible while its power is cut. Sure. It's not technically a lie to call a power-cut switch a…

I can't emphasize enough how much of a retcon it is to say "it's not technically a lie" that NAT is a security feature. It was deployed in hundreds of networks specifically as a security feature, and it is part of the security posture of hundreds of thousands of home networks today. People who say "NAT isn't a security feature" are simply wrong. There are lots of security features I personally don't like either. I do…

You've repeatedly re-emphasized your personal claim "this is how it was" while continually refusing to provide any external evidence, yet have the gumption to continue repeating it must be others letting their personal feelings get in the way of looking at what NAT was that leads to the disagreement about the history.

NAT does not care about anyone's personal feelings, one way or the other. Bringing up what you think other's personal feelings are does not help you redefine the original purpose and usage of NAT to be about security.

If you were solely arguing pure NAT could possibly be used today as (or that a few had eventually made poor attempts to use pure NAT as) a way to have better-than-nothing security then I'd agree. Instead you're insisting to rewrite history to make it sound like that's the way NAT was always intended to be used or what it was widely deployed for based on your personal recollection alone, other evidence be damned. If, e.g., the RFC had given more to say about being for security instead of address exhaustion, I highly doubt you would have completely ignored any reference to it in these ~dozen messages.

Re: IPv6 is not insecure because it lacks a NAT

#395

Post by tptacek »

bigstrat2003 wrote: post #205
tptacek wrote: post #13

This has been gospel among snooty network engineers for decades, but NAT was initially introduced to the wider market as a security feature, and it is absolutely a material factor in securing networks. The network engineers are wrong about this. (IPv6 is still good for lots of other reasons, and NAT isn't good security; just material.)

NAT isn't security at all , good or otherwise. If it was sold as such, then the people selling it were giving out inaccurate info. But just because some people wrongly said that NAT provides security back in the beginning doesn't somehow make those claims true today.

This argument boils down to "it's a bad security feature", but that's not what's being argued.

Re: IPv6 is not insecure because it lacks a NAT

#396

Post by tptacek »

deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…

I think you're on my side in this discussion, but I have to say you can't really point at an RFC and say it settles an argument; RFCs can also be wrong about stuff, and the further you get from bits laid out on the wire, the less trustworthy they are.

Re: IPv6 is not insecure because it lacks a NAT

#397

Post by [deleted] »

notepad0x90 wrote: post #347
nemothekid wrote: post #155

Earlier quoted context omitted.

The problem is, as I understand it, is this hypothetical network where there is a NAT but no firewall just does not exist. > In commercial grade routers, the same applies except even if the external IP knew to direct the router to the right internal IP, or if the route knew to direct the traffic to the right external IP for outbound connections, unless you configure a default route, or a more explicit route, it won't…

It is not, you guys are talking from a specific american ISP perspective where you have these modem+router+gateway+firewall combo devices. Not everyone gets that. Many get just a modem and buy a cheap router which may not have a firewall. MANY more get just a modem and their laptops are directly exposed to the internet (!!!), those you can't do much about, but many put a "router" that's just a cheap wifi access point…

[deleted]

Re: IPv6 is not insecure because it lacks a NAT

#398

Post by [deleted] »

tsoukase wrote: post #340
muvlon wrote: post #254

Earlier quoted context omitted.

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…

Thank you. This is the first time that someone admits here that NAT actually adds some security. IPv4 will never go away less that an important share because of it's simplicity and NAT-level security it offers to millions of professionals and amateurs that tinker with their routers.

[deleted]

Re: IPv6 is not insecure because it lacks a NAT

#399

Post by kccqzy »

ghshephard wrote: post #9

This is the first thing that as a Network Engineer I was taught - and every formal security class I've taken (typically from Cisco - they have awesome course) - repeats the same thing. I believe the common knowledge is somewhat more nuanced than people would have you believe I present to you two separate high-value targets whose IP address has leaked: IPv4 Target: 192.168.0.1 IPv6 Target: 2001:1868:209:FFFD:0013:50FF…

NAT66 is evil but it is a necessary evil. There are certainly situations where using NAT66 is the best way.

Re: IPv6 is not insecure because it lacks a NAT

#400

Post by radlad »

lelandbatey wrote: post #34
radlad wrote: post #4

Earlier quoted context omitted.

That's a great point - the packet is not dropped by the firewall as a result of NAT - but it still won't route anywhere because the IP in the packet is that of the router itself. I've updated the article as a result of your comment, thanks.

That's only because your ISP won't have routed that packet to you if someone gave it to _them_. However, if someone was able to get to the ISP-side of the connection that you have with your ISP, and send a packet down the fiber/copper line from the ISP side towards your router, and that packet has a dst of your internal network (192.168.0.1 or whatever), your router will happily route that straight on to whatever int…

Yes, physical tapping of lines / ISP attacks were outside of the threat vector I was discussing. At this point, I think any discussion of NAT starts to look a little orthogonal.
Post reply on HN