Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

401–410 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#401

Post by p_ing »

tsoukase wrote: post #340
muvlon wrote: post #254

Earlier quoted context omitted.

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…

Thank you. This is the first time that someone admits here that NAT actually adds some security. IPv4 will never go away less that an important share because of it's simplicity and NAT-level security it offers to millions of professionals and amateurs that tinker with their routers.

NAT introduces complexity, not simplicity.

Besides, NAT isn't a security feature.

Re: IPv6 is not insecure because it lacks a NAT

#402

Post by account42 »

deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…

> Of course, ipv6 is not less secure because it doesn't have NAT, as the same filtering behavior can be replicated with a firewall. That may even have advantages over NAT.

I don't think this follows - defaults matter after all. More precise would be to say that IPv6 setups can be as secure as IPv4 setups.

Re: IPv6 is not insecure because it lacks a NAT

#403

Post by kstrauser »

lazystar wrote: post #217
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

It's scary how much of this thread comes from people who can't imagine a use for keeping internal traffic internal. in ipv4, if my laptop tries to use a printer with a public ipv4 address, that raises alarms. in ipv6, if my laptop tries to use a printer with an ipv6 address... its not about the firewall. there's just a lot of extra attack vectors without a nat.

> in ipv4, if my laptop tries to use a printer with a public ipv4 address, that raises alarms.

The only way that’s possible is that you have a firewall rule blocking outbound connections to common printer ports like 631. NAT couldn’t care less what outbound port you’re connecting to, so it has to be a firewall doing that work.

> in ipv6, if my laptop tries to use a printer with an ipv6 address...

…so enable that same rule you manually configured on IPv4 on the IPv6 firewall, too.

What you’re describing is not default or inherent behavior. If you went out of your way to enable it, you have the skills to do it twice. That’s assuming your firewall is more complicated that “block outbound port to ”, which covers both protocols on most firewalls I’ve used.

Re: IPv6 is not insecure because it lacks a NAT

#404

Post by snuxoll »

fc417fc802 wrote: post #379
snuxoll wrote: post #356

Earlier quoted context omitted.

> With IPv6 it's possible to fail to configure those nftables rules. The firewall could be turned off. So what? It's not like you get SNAT without a couple netfilter rules either. This argument doesn't pass muster, sorry. Consumer and SOHO gear should come with a safe configuration out of the box, it's not rocket science.

Did you even read the second paragraph of the (rather short) comment you're replying to? In most residential scenarios you literally can't turn off NAT and still have things work. Either you are running NAT or you are not connected. Meanwhile the same ISP is (typically) happy to hand out unlimited globally routable IPv6 addresses to you. I agree though, being able to depend on a safe default deny configuration would…

> But that's getting rather off topic. The dispute was about whether or not NAT of IPv4 is of reasonable benefit to end user security in practice, not about whether or not typical IPv6 equipment provides a suitable alternative.

And, my argument, is that the only substantial difference is the action of a netfilter rule being MASQUERADE instead of ALLOW.

This is what literally everyone here, including yourself, continues to miss. Dynamic source NAT is literally a set of stateful firewall rules that have an action to modify src_ip and src_port in a packet header, and add the mapping to a connecting tracking table so that return packets can be identified and then mapped on the way back.

There's no need to do address and port translation with IPv6, so the only difference to secure an IPv6 network is your masquerade rule turns into "accept established, related". That's it, that's the magic! There's no magical extra security from "NAT" - in fact, there are ways to implement SNAT that do not properly validate that traffic is coming from an established connection; which, ironically, we routinely rely on to make things like STUN/TURN work!

Re: IPv6 is not insecure because it lacks a NAT

#405

Post by kstrauser »

bandrami wrote: post #386
ErroneousBosh wrote: post #317

Earlier quoted context omitted.

Yes, I trust everyone who works at it, mostly because I know where they live.

Do you trust the state actors who have compromised it?

Or more likely, network engineers who’ve been subpoenaed to collect the information?

Your scenario is plausible for high value targets. Like, what country wouldn’t want to have a friendly tech working at the ISP most politicians use in DC? That doesn’t seem improbable.

For the regular Joe Schmoe, I’d be more concerned with court-ordered monitoring.

Re: IPv6 is not insecure because it lacks a NAT

#406

Post by dspillett »

sedawkgrep wrote: post #331
dspillett wrote: post #295

Earlier quoted context omitted.

> NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. Any good firewall does the same, by having a default “no” rule for incoming connections. > A firewall is not required for NAT to work Do you have any examples of NAT that isn't implemented in a more general firewall subsystem? > NAT effectively reduces the attack surface for a home network…

> Do you have any examples of NAT that isn't implemented in a more general firewall subsystem? When I was a network engineer, we did NAT on edge routers for B2B connections all the time. Like literally hundreds of thousands of them. I am 100% serious on this.

My understanding is that almost all edge routers provide at least basic firewalling, not just pure routing. How were you “doing NAT” on the edge routers you were using otherwise?

(Baring in mind that what most people are referring to as NAT here and elsewhere is “IP masquerading with connection tracking” rather than simple static SNAT & DNAT)

Re: IPv6 is not insecure because it lacks a NAT

#407

Post by account42 »

snuxoll wrote: post #216
phire wrote: post #202

Earlier quoted context omitted.

The firewall on your typical IPv4 router does basically nothing. It just drops all packets that aren’t a response to an active NAT session. If the firewall somehow didn’t exist (not really possible, because NAT and the firewall are implemented by the same code) incoming packets wouldn’t be dropped, but they wouldn’t make it through to any of the NATed machines. From the prospective any machine behind the router, noth…

NAT gateways that utilize connection tracking are effectively stateful firewalls. Whether a separate set of ‘firewall’ rules does much good because most SNAT implementations by necessity duplicate this functionality is a bit ignorant, IMO. Meanwhile, an IPv6 network behind your average Linux-based home router is 2-3 nftables rules to lock down in a similar fashion.

The difference is that with IPv4 you know that you have that security because there is no other way for the system to work while with the IPv6 router you need to be a network expert to make that conclusion.

Re: IPv6 is not insecure because it lacks a NAT

#408

Post by account42 »

phire wrote: post #266
fc417fc802 wrote: post #241

Earlier quoted context omitted.

It's also trivial to roll your own version of dropbox. With IPv6 it's possible to fail to configure those nftables rules. The firewall could be turned off. In theory you could turn off IPv4 NAT as well but in practice most ISPs will only give you a single address. That makes it functionally impossible to misconfigure. I inadvertently plugged the WAN cable directly into my LAN one time and my ISP's DHCP server promptl…

> In theory you could turn off IPv4 NAT as well but in practice most ISPs will only give you a single address So, I randomly discovered the other day that my ISP has given me a full /28. But I have no idea how to actually configure my router to forward those extra IP addresses inside my network. In practice, modern routers just aren't expecting to handle this, there is no easy "turn of NAT" button. It's possible (at…

> So, I randomly discovered the other day that my ISP has given me a full /28.

Where is this? Here new ISP customers don't even get a single IPv4 unless you beg for it.

Re: IPv6 is not insecure because it lacks a NAT

#409

Post by drnick1 »

muvlon wrote: post #254
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…

This is 100% correct, something the (dim) author of the article can't seem to understand.

Re: IPv6 is not insecure because it lacks a NAT

#410

Post by drnick1 »

CrossVR wrote: post #382
muvlon wrote: post #254

Earlier quoted context omitted.

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…

> If an attacker can't even name a resource they're not allowed to access, that's quite a strong security property. This is entirely incorrect. An attacker can still name a resource, it only has to guess the right port number that is mapped to that resource. That's how NAT fundamentally works after all, it allows you to use the additional 16-bits of the port number to extend the IP address space. Any blocking of inco…

That's absolutely not true, because forwarding rules don't exist by default. You can try all ports and will get no answer.
Post reply on HN