Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

421–430 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#421

Post by direwolf20 »

lq9AJ8yrfs wrote: post #367
paulddraper wrote: post #97

Earlier quoted context omitted.

The RFC introducing NAT -- RFC 1631 -- says: > Unfortunately, NAT reduces the number of options for providing security [1] Somehow, everyone forgot that, and it morphed into a cargo-culting security practice, even going so far as to propagate 1990s network limitations into the cloud(!) [1] https://www.rfc-editor.org/rfc/rfc1631.html

Real world CSRF attacks into hxxp://192.168.0.1 home routers and polluting DNS and DHCP settings you could argue is caused or at least facilitated by NAT, or NAT misconceptions especially. Though IPv6 has a similar situation with well defined unicast and multicast addresses. True story, popular browsers won't let you load a webpage via various IPv6 local address literals for this reason. Hxxp://[ff02::] addresses won…

[dead]

Re: IPv6 is not insecure because it lacks a NAT

#422

Post by amarant »

dehrmann wrote: post #142
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

This goes against Hyrum's law. NAT provides the behavior 99.9% of users want, usually by default, out of the box. True firewalls can do the same thing, but not necessarily by default, the firewall might not even by on by default, and there's more room for misconfiguration. IPv6 is a security regression for most people, regardless of its architectural merits or semantics of what's a firewall.

You can still have firewalls on IPv6.....

Re: IPv6 is not insecure because it lacks a NAT

#424

Post by fc417fc802 »

account42 wrote: post #408
phire wrote: post #266

Earlier quoted context omitted.

> In theory you could turn off IPv4 NAT as well but in practice most ISPs will only give you a single address So, I randomly discovered the other day that my ISP has given me a full /28. But I have no idea how to actually configure my router to forward those extra IP addresses inside my network. In practice, modern routers just aren't expecting to handle this, there is no easy "turn of NAT" button. It's possible (at…

> So, I randomly discovered the other day that my ISP has given me a full /28. Where is this? Here new ISP customers don't even get a single IPv4 unless you beg for it.

Not even CGNAT?

In the US many large companies (not just ISPs) still have fairly large historic IPv4 allocations. Thus most residential ISPs will hand you a single publicly routable IPv4 regardless of if you're using IPv6 or not.

We'll probably still be writing paper checks, using magnetic stripe credit cards, and routing IPv4 well past 2050 if things go how they usually do.

Re: IPv6 is not insecure because it lacks a NAT

#425

Post by theamk »

NewJazz wrote: post #89
theamk wrote: post #81

Earlier quoted context omitted.

No, that's the whole point. Imagine I've shared output of "ifconfig" on my machine, or "netstat" output, or logs for some network service which listed local addresses. For IPv4, this will is totally fine and leaks minimal information. For IPv6, it'll be a global, routable address.

That's a pretty weird threat model. Like, yeah commands you run on your machine can expose information about that machine.

Only in IPv6 world... in IPv4, it's all safe

Re: IPv6 is not insecure because it lacks a NAT

#426

Post by theamk »

mbreese wrote: post #93
NewJazz wrote: post #89

Earlier quoted context omitted.

That's a pretty weird threat model. Like, yeah commands you run on your machine can expose information about that machine.

Especially as if someone is able to capture ifconfig data, they can probably send a curl request to a malicious web server and expose the NAT IP as well.

People post their ifconfig data all the time, example: https://forums.linuxmint.com/viewtopic.php?t=402315

Re: IPv6 is not insecure because it lacks a NAT

#427

Post by Dagger2 »

deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…

That whole section is talking about outbound connections:

    When an internal endpoint opens an outgoing session through a NAT,
    the NAT assigns a filtering rule for the mapping between an internal
    IP:port (X:x) and external IP:port (Y:y) tuple.
When you connect outwards, the NAT creates a state table entry which matches inbound packets corresponding to that outbound connection, and this section is discussing which packets will match those entries.

Don't get distracted by its use of the word "filtering". It's not talking about unsolicited inbound connections, which is what we're talking about in this thread.

Re: IPv6 is not insecure because it lacks a NAT

#428

Post by cyberax »

iso1631 wrote: post #204
cyberax wrote: post #134

I wrote that comment, and you can write to yourself how many times you want that NAT is not a firewall. The truth of the matter is that NAT absolutely _is_ a firewall in _practice_. Not in theory "because it doesn't drop packets" or "because it was not meant to be a security feature". But in the actual real-world practice. It effectively protects most networks from most attackers without ANY additional configuration,…

If you don't have RPF enabled on your router in theory your upstream peer can send traffic to 192.168.80.26 and it would pass through. Reply traffic may or may not be natted depending on how it's entered in the connection tracking table. There may be situations where your router can be tricked too, I can't think of one off the top of my head which wouldn't also apply to a stateful firewall sitting on a routed network…

Yes, the upstream can hack my private wallet. But it's a CGNAT device somewhere in the TMobile network, and hacking it is not at all trivial.

And it's true for most NAT users. Even with the cheapest possible devices.

Of course, in practice most NAT devices _are_ firewalls because they do block incoming packets that are not a part of an established connection. After all, it adds only an insignificant overhead because a NAT device has to track connections anyway.

With IPv6 this is not the case. A router with misconfigured connection tracking will still work. And I actually have seen this in practice on a device that had a missing IPv6 conntrack kernel module.

Re: IPv6 is not insecure because it lacks a NAT

#429

Post by Dagger2 »

deng wrote: post #333
zajio1am wrote: post #326

Earlier quoted context omitted.

RFC 4787 does not really describe how real world implementations behave. As almost all SOHO routers are Linux-based, i prefer to discuss Linux netfilter-based NAT behavior than some hypothetical RFC 4787 NAT. There are clear differences. For example, RFC 4787 says: > REQ-1: A NAT MUST have an "Endpoint-Independent Mapping" behavior While Linux netfilter behavior is "Address and Port-Dependent Mapping". As Linux netfi…

The problem is: what is an implementation detail, and what is NAT as a concept? This line is very blurry. The RFC does not really distinguish this and also doesn't want to. As it says, it tries to document behavior and explicitly uses the term "NAT filtering". When we say "This box here does NAT", then we implicitly assume this behavior. You might argue that implicit is not good, and I would agree (this is the advant…

NAT:

    iptables -A POSTROUTING -o wan0 -j MASQUERADE
Firewall:

    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    iptables -A FORWARD -m state --state INVALID -j DROP
    iptables -A FORWARD -i lan0 -j ACCEPT
    iptables -A FORWARD -j REJECT --reject-with icmp-admin-prohibited
If you omit the first line, you get firewalling without NAT. If you omit the second set of lines, you get NAT without firewalling. This should make it pretty clear that they're orthogonal features.

If NAT functioned as an inbound firewall, the second set of lines wouldn't be necessary and removing them wouldn't let you make inbound connections. But you can just test it yourself, and you'll see that NATing your outbound connections doesn't block new inbound ones.

Re: IPv6 is not insecure because it lacks a NAT

#430

Post by grumbel »

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

The whole discussion is confused from the start. When people talk about the "security of NAT" they are not talking about NAT at all, but about what happens when NAT is misconfigured or switched off. In the case of IPv4 it means nothing works and your computer isn't reachable. The system is fail safe.

Meanwhile with IPv6 it's the other way around, everything is wide open unless you have a working and properly configured firewall.

Post reply on HN