Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

431–440 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#431

Post by sedawkgrep »

dspillett wrote: post #406
sedawkgrep wrote: post #331

Earlier quoted context omitted.

> Do you have any examples of NAT that isn't implemented in a more general firewall subsystem? When I was a network engineer, we did NAT on edge routers for B2B connections all the time. Like literally hundreds of thousands of them. I am 100% serious on this.

My understanding is that almost all edge routers provide at least basic firewalling, not just pure routing. How were you “doing NAT” on the edge routers you were using otherwise? (Baring in mind that what most people are referring to as NAT here and elsewhere is “IP masquerading with connection tracking” rather than simple static SNAT & DNAT)

In an enterprise network, it's very, very unlikely that an edge router is doing any firewalling. They can do it, but it's not only cumbersome to do it there, but also a massive resource drain.

Often they do basic stateless packet filtering, but definitely nothing akin to stateful, connection-oriented firewalling. It's important to make the distinction, because filtering in this case is completely uni-directional and if you want bi-directional equivalence you have to write an inverse rule for it. Filtering polices are applied per interface, so generally you apply them on the outside only.

Think of it as sort of a reverse of an inbound Internet policy - you write all the drop stuff first (e.g. drop any any eq snmp) and the last rule is a permit ip any any. Next hop is your firewall which does the rest.

For site-tos-site b2b connections, we performed NAT (of the untrusted network space) on the border/edge b2b router, and then the traffic was immediately routed to the firewall. So in this instance, NAT was happening on the router for the customer IP range, and on the firewall for our enterprise IP range.

As a convenience to our customers/partners we always presented ourselves as one of our public IP blocks that wasn't Internet-routed. This prevented them from having any overlapping IP space.

Otherwise, NAT is simply a question of configuring it. And at least in the cisco IOS world (I'm a dinosaur) the two features (NAT vs. firewall) are utterly independent.

https://community.cisco.com/legacyfs/online/legacy/0/8/0/600... https://www.cisco.com/c/en/us/support/docs/ip/network-addres...

Re: IPv6 is not insecure because it lacks a NAT

#432

Post by theamk »

NewJazz wrote: post #207
mbreese wrote: post #93

Earlier quoted context omitted.

Especially as if someone is able to capture ifconfig data, they can probably send a curl request to a malicious web server and expose the NAT IP as well.

Or if you happened to curl ipinfo Or if you had a script that did that and put the public v4 address in your taskbar.

> Or if you had a script that did that and put the public v4 address in your taskbar.

do people still do that? Dynamic DNS is offered by so many providers now...

Re: IPv6 is not insecure because it lacks a NAT

#433

Post by cyberax »

bandrami wrote: post #281
cyberax wrote: post #222

Earlier quoted context omitted.

What is the definition of a "firewall"? And it doesn't really matter. You can call it "alksjfaliskdfgh" if you wish. The fact is, NAT adds a security barrier that is incredibly effective in practice.

But it really doesn't. If you turned off NAT your computers would have the exact same security as they do with NAT.

Wrong. If I turn off the NAT on my router, my computers will not be able to get online. If I turn off the IPv6 firewall on my router, I won't see anything unusual.

And yes, this has happened to me when I forgot to compile the IPv6 conntrack module.

Re: IPv6 is not insecure because it lacks a NAT

#434

Post by Dagger2 »

mannyv wrote: post #163
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

You are wrong because you are being overly pedantic. NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate). Your definition of security is too narrow. And saying that NAT is broken a…

> NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side.

No... it doesn't do that.

NAT edits your packets so that your outbound connections appear to come from your router's IP. If you set up a port forward rule, then it edits matching inbound connections so they appear to be coming to a different destination IP.

Notice how no part of that description involves blocking or preventing inbound connections. That's because that's just not something NAT does.

Re: IPv6 is not insecure because it lacks a NAT

#435

Post by Dagger2 »

wink wrote: post #258
fc417fc802 wrote: post #237

Earlier quoted context omitted.

Busses aren't for safety. Seatbelts and airbags and etc are. Busses are just for moving large numbers of people around efficiently. And yet statistically I'm safer on a bus. Therefore it's reasonable to ride the bus "for safety".

I would phrase it as: NAT accidentally "breaks" or "makes harder/impossible" something which yields increased security, under some circumstances.

It doesn't though. NAT edits your outbound connections to appear to come from the router's IP; it doesn't do anything to make inbound connections harder.

Re: IPv6 is not insecure because it lacks a NAT

#436

Post by cyberax »

vlan0 wrote: post #359
deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…

And if I think back to my 30 years of IT, environments with NAT end up with lazy engineering from systems and application folks. It doesn't provide an environment that forces folks to understand their problems holistically. Thus, relying on perimeter firewalling and NAT as a large catch all. It's a bad security practice imo

Do you prefer to install firewalls on smart light switches and kettles?

Re: IPv6 is not insecure because it lacks a NAT

#437

Post by Dagger2 »

tbrownaw wrote: post #339
mannyv wrote: post #163

Earlier quoted context omitted.

You are wrong because you are being overly pedantic. NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate). Your definition of security is too narrow. And saying that NAT is broken a…

> And indeed, if a firewall is off NAT can still function (if NAT is separate). Well technically you can translate your /16 to look like a different /16 from the outside. IE each internal address gets turned into its own separate external address. But that's not how NAT gets used in practice. How it actually gets used is to but many hidden addresses behind one or a few public addresses. And that multiplexing necessar…

No, it doesn't imply that.

Let's say your LAN is using 192.0.2.0/24, and your router has 203.0.113.42 on its WAN interface. With NAT, outbound connections from 192.0.2.x will appear to be coming from 203.0.113.42 -- in your words, the 192.0.2.x addresses on the LAN are hidden behind 203.0.113.42.

Now imagine an inbound connection to 192.0.2.10. Does this connection need to be told where to go? It already clearly states where it needs to go in the packet itself: to 192.0.2.10, and the fact that your outbound connections all appear to be coming from 203.0.113.42 didn't prevent that at all.

So no, NAT doesn't necessarily imply that incoming connections need to be told where to go. The packets themselves can specify that.

Re: IPv6 is not insecure because it lacks a NAT

#438

Post by cyberax »

p_ing wrote: post #401
tsoukase wrote: post #340

Earlier quoted context omitted.

Thank you. This is the first time that someone admits here that NAT actually adds some security. IPv4 will never go away less that an important share because of it's simplicity and NAT-level security it offers to millions of professionals and amateurs that tinker with their routers.

NAT introduces complexity, not simplicity. Besides, NAT isn't a security feature.

Secure and reliable IPv6 deployment has _more_ complexity than IPv4.

Re: IPv6 is not insecure because it lacks a NAT

#439

Post by etyhhgfff »

tucnak wrote: post #123
Sohcahtoa82 wrote: post #5

This is going to depend on the router and on IP distribution. My ISP does not give me an IPv6 address, only a single IPv6 which all my network devices have to NAT through. NAT is not intended to be a security feature, for sure, but it creates security as a side effect . If I start up a web server on one of my devices, I know that it is unreachable from the Internet unless I go out of my way to set a port forward on m…

> my ISP still gives me only a single IPv6 address This is criminal, and also incredibly uncommon. You should talk to your ISP, it's most definitely a misconfiguration of some kind, if not deliberate torture. Normally you get a /56 at least because there are so many and they cost nothing.

What does IPv6 /56 cost if I would like to buy one for a server?

Re: IPv6 is not insecure because it lacks a NAT

#440

Post by Dagger2 »

Sohcahtoa82 wrote: post #113
Dagger2 wrote: post #85

Earlier quoted context omitted.

No, NAT only affects which IP your connections appear to be coming from. It doesn't change which IPs your devices actually have. The person I replied to said that they only get a single v6 address. If that's true, it doesn't matter whether they have NAT or not; their network isn't going to have publicly-routable addresses either way. If your network is air-gapped then no connections will be happening at all, in or ou…

> No, NAT only affects which IP your connections appear to be coming from. It doesn't change which IPs your devices actually have. Well no shit. The NAT is a requirement for devices without a publicly routable IP because if my router just sends packets out with a source address being my 192.168.1.101 local IP, my ISP is most likely just going to drop the packets. You know this, I'm sure, so I'm really unsure what poi…

The point was that turning NAT on or off doesn't affect whether your LAN is reachable or not. NAT just edits the source address of your outbound connections. It's irrelevant to how your inbound connections behave.

> Correction: It will have ONE publicly-routable IP, and if I assign it to my router, but don't use NAT, then none of my devices on the network will be able to talk to the Internet, either in or out.

Right, and then if you add NAT you'll be able to make outbound connections, but inbound connections will be unaffected and will still not work. So what is NAT doing here to prevent inbound connections, given that the exact same connections already didn't work before you were NATing?

Post reply on HN