Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RFC 791: Internet Protocol (1981)

datatracker.ietf.org

Post reply on HN
Print view View original

41–45 of 45 posts

Re: RFC 791: Internet Protocol (1981)

#41

Post by tenebrisalietum »

saurik wrote: post #38
tenebrisalietum wrote: post #22

Earlier quoted context omitted.

NAT is essentially required in IPv4 due to IPv4 address exhaustion. NAT, when done on the carrier level (CGNAT), more or less prevents external systems from initating connections with anything on your network (without ISP involvement). You can still initiate outgoing connections fine. Sounds great for security, but this enforces the existence of centralized services (middlemen) that you have to use/pay for if you wan…

Does the CGNAT setup you contend with not support NAT-PMP/PCP? (To me that is the reasonable solution to the problem you cite, not IPv6, and I have been thinking it is already widely deployed... just not adopted by developers for some reason.)

I don't contend with CGNAT, thankfully, but no one ever moves from IPv4 then everyone's going to eventually be behind a CGNAT at some point.

I don't know too much about NAT-PMP/PCP - so I'm looking into it.

Re: RFC 791: Internet Protocol (1981)

#42

Post by znpy »

throw0101a wrote: post #17
znpy wrote: post #4

Earlier quoted context omitted.

Not sure about operating system readiness besides the presence of an ipv6 stack though. Can you imagine most consumer pc, barely updated, being publicly exposed? Can you imagine the average senile pc user having to deal with a firewall? firewall exceptions? NGL I have ipv6 at home but made sure it's disabled at my parents' home. It's just a recipe for disasters. I'm well aware that ipv4+nat is not "security"... yet i…

> I'm well aware that ipv4+nat is not "security"... yet it removes a whole class of problem (eg: windows print spooler is listening on [::] by default or something like that) IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is re…

> IPv4+NAT does not remove any more classes of problems than IPv6+firewall

NAT is automatic and works out of the box while most users, even tech-savvy ones don't bother configuring the firewall on their own laptop, let alone on the router/gateway.

And by the way, I'd like to see you explain that firewall thing to the average senile pc user (grandma/grampa).

Re: RFC 791: Internet Protocol (1981)

#43

Post by rfoo »

throw0101a wrote: post #17
znpy wrote: post #4

Earlier quoted context omitted.

Not sure about operating system readiness besides the presence of an ipv6 stack though. Can you imagine most consumer pc, barely updated, being publicly exposed? Can you imagine the average senile pc user having to deal with a firewall? firewall exceptions? NGL I have ipv6 at home but made sure it's disabled at my parents' home. It's just a recipe for disasters. I'm well aware that ipv4+nat is not "security"... yet i…

> I'm well aware that ipv4+nat is not "security"... yet it removes a whole class of problem (eg: windows print spooler is listening on [::] by default or something like that) IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is re…

> There's no magical security behind NAT

That's exactly the point. Yes, I know the "security" NAPTv4 provides is just a side effect. But it is what was widely deployed in the field. If you want to push IPv6, you MUST make sure in field appliances match this "side effect" (as a properly implemented firewall).

And this is not happening.

NAPTv4 with a "block incoming connection" side effect is widely deployed, running on countless CPEs. Proper IPv6 firewall is not. Thus IPv6 is not ready for these users.

Re: RFC 791: Internet Protocol (1981)

#44

Post by throw0101a »

rfoo wrote: post #43
throw0101a wrote: post #17

Earlier quoted context omitted.

> I'm well aware that ipv4+nat is not "security"... yet it removes a whole class of problem (eg: windows print spooler is listening on [::] by default or something like that) IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is re…

> There's no magical security behind NAT That's exactly the point. Yes, I know the "security" NAPTv4 provides is just a side effect. But it is what was widely deployed in the field. If you want to push IPv6, you MUST make sure in field appliances match this "side effect" (as a properly implemented firewall). And this is not happening. NAPTv4 with a "block incoming connection" side effect is widely deployed, running o…

> NAPTv4 with a "block incoming connection" side effect is widely deployed, running on countless CPEs. Proper IPv6 firewall is not.

I've been running IPv6 through my Asus for years now and it's been no different than IPv4. Going to Advanced Settings > Firewall, under "IPv6 Firewall" it says:

> All outbound traffic coming from IPv6 hosts on your LAN is allowed, as well as related inbound traffic. Any other inbound traffic must be specifically allowed here.

It then has a table where you specify traffic to be allowed in to specific internal hosts on particular port (ranges), but since this is IPv6, you don't have to deal with reverse-NATing now.

* https://www.asus.com/us/support/FAQ/1013638/

Re: RFC 791: Internet Protocol (1981)

#45

Post by throw0101a »

znpy wrote: post #42
throw0101a wrote: post #17

Earlier quoted context omitted.

> I'm well aware that ipv4+nat is not "security"... yet it removes a whole class of problem (eg: windows print spooler is listening on [::] by default or something like that) IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is re…

> IPv4+NAT does not remove any more classes of problems than IPv6+firewall NAT is automatic and works out of the box while most users, even tech-savvy ones don't bother configuring the firewall on their own laptop, let alone on the router/gateway. And by the way, I'd like to see you explain that firewall thing to the average senile pc user (grandma/grampa).

There is nothing to figure out: you take your Linksys/Asus/whatever device, plug in the WAN side to your modem, and your computer(s) to the LAN ports. Perhaps enter your credentials if you're using PPPoE, and you're done.

I'm not sure why you think IPv6 is more complicated than IPv4 for home users when it comes to CPEs.

What exactly do you think needs to be done on an Asus/Linksys for IPv6 protection that is different than IPv4?

Post reply on HN