Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

441–450 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#441

Post by quotemstr »

1dom wrote: post #385
quotemstr wrote: post #306

Earlier quoted context omitted.

> There's more security to be had in an intrinsic architectural feature No, there is not. Even ignoring the question of whether the concept of an ordinal ranking in amount of security even makes sense, this claim doesn't make sense. If the invariant is that incoming connections are blocked by default, an IPv4 NAT and an IPv6 default deny rule are equivalent in security: both uphold the invariant. If the claim is that…

> an IPv4 NAT and an IPv6 default deny rule are equivalent in security: both uphold the invariant Yes, you're correct, on some level, they are equivalent: in both cases, packets don't reach the target machine. That is one of the few levels on which they are equivalent. > There's no basis for claiming the two schemes differ in the level of security provided. Yes there is, this is basic secure architecture and secure b…

> Yes there is, this is basic secure architecture and secure by design principals

The only principles at work here are the ones of superstition and magical thinking. The existence of a "disable security" button doesn't weaken the theoretical security properties of a system when that button isn't pressed, and NAT systems and pure firewalls alike have this button.

If anything, NAT systems are sometimes worse due to things like uPNP automating the button-pushing.

Look: I just don't accept the premise that making a system more flexible makes it less secure. If your threat model includes user error, then you have to be against user freedom to achieve security guarantees.

The amount of "effort" it takes to disable security measures has no bearing on the security of the system when properly configured, and how easy you make it to disable safeguards is a matter of UX design and the tolerance your users have for your paternalism, not something that we should put in a threat model.

Re: IPv6 is not insecure because it lacks a NAT

#442

Post by quotemstr »

anonymars wrote: post #351
quotemstr wrote: post #306

Earlier quoted context omitted.

> There's more security to be had in an intrinsic architectural feature No, there is not. Even ignoring the question of whether the concept of an ordinal ranking in amount of security even makes sense, this claim doesn't make sense. If the invariant is that incoming connections are blocked by default, an IPv4 NAT and an IPv6 default deny rule are equivalent in security: both uphold the invariant. If the claim is that…

> Even ignoring the question of whether the concept of an ordinal ranking in amount of security even makes sense I must be misinterpreting this statement, are you arguing that you aren't sure whether "x is more secure than y" is inherently a valid thing to compare?

"X is more secure than Y" is usually an ill-formed statement. Secure against what threats? Does X provide every security guarantee Y does? Every single one? Then there's no proper superset relationship, and the best we can do is say that X and Y provide different security guarantees.

If we model security as a lattice, lots of systems end up being incommensurable. You have to talk about the specific threats.

Okay, suppose you want to flatten the lattice into a scalar score so we can apply the usual relational operators and statements like "more secure" make sense. How do we do that? Do we apply some kind of weighted average over security feature presence? With what coefficients? Are these coefficients invariant over time and between people? What if my use-case is different from yours and I have to model the "amount" of security differently?

If my router is written in 100% memory safe code but has a default password of "hunter2", is it more or less secure than your router, which might be a normal OpenWRT installation?

When people argue over whether something is "more" or "less" secure without specifying a use-case, they're haphazardly mixing feature matrix comparisons and (usually tacit) disagreements on prior probabilities of various attacks. The result is seldom a conversation that enlightens.

Re: IPv6 is not insecure because it lacks a NAT

#443

Post by jcalvinowens »

etyhhgfff wrote: post #439
tucnak wrote: post #123

Earlier quoted context omitted.

> my ISP still gives me only a single IPv6 address This is criminal, and also incredibly uncommon. You should talk to your ISP, it's most definitely a misconfiguration of some kind, if not deliberate torture. Normally you get a /56 at least because there are so many and they cost nothing.

What does IPv6 /56 cost if I would like to buy one for a server?

AWS will give you a "permanent" /56 for free in each region (in their address space, obviously)

Re: IPv6 is not insecure because it lacks a NAT

#444

Post by jcalvinowens »

tptacek wrote: post #13

This has been gospel among snooty network engineers for decades, but NAT was initially introduced to the wider market as a security feature, and it is absolutely a material factor in securing networks. The network engineers are wrong about this. (IPv6 is still good for lots of other reasons, and NAT isn't good security; just material.)

In my experience, consumer grade routers will often happily route packets with rfc1918 destination addresses from the WAN to the LAN interface all day. The "firewall" is only that nobody can get packets with those destination addresses to the home router's WAN interface through the internet. Your ISP can, and in some cases other ISP subscribers on the same L2 segment as your router can.

Re: IPv6 is not insecure because it lacks a NAT

#445

Post by Dagger2 »

aidenn0 wrote: post #162
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

When we say "NAT" we are specifically talking about stateful one-to-many NAT implementations as found in consumer IPv4 hardware. Such a NAT is largely isomorphic to a firewall with default-deny semantics for incoming connections and default-allow semantics for outgoing connections. There are other possible NAT implementations that are much less like a firewall, but saying that a NAT does not provide security is a mis…

It's not isomorphic to a firewall, because it doesn't have default-deny semantics for incoming connections.

Think about it for a second. These NAT implementations change the apparent source IP of your outbound connections. How does that block inbound connections? Changing the IP isn't blocking, and outbound connections are the wrong ones.

If a connection comes into your router with a dest IP set to one of your LAN machines, no amount of changing the IPs on your outbound connections will block it.

Re: IPv6 is not insecure because it lacks a NAT

#446

Post by fc417fc802 »

Dagger2 wrote: post #435
wink wrote: post #258

Earlier quoted context omitted.

I would phrase it as: NAT accidentally "breaks" or "makes harder/impossible" something which yields increased security, under some circumstances.

It doesn't though. NAT edits your outbound connections to appear to come from the router's IP; it doesn't do anything to make inbound connections harder.

If you don't initiate a corresponding outbound connection first then any attempt at an inbound connection will be dropped (unless you have a DMZ configured ofc). The router literally can't forward the traffic because it doesn't know where it should go.

Re: IPv6 is not insecure because it lacks a NAT

#447

Post by Dagger2 »

wiredpancake wrote: post #87
alanfranz wrote: post #83

Earlier quoted context omitted.

…and they did really guess an ipv6 address? Full scans of the ipv6 address space looks infeasible. Or did the sbc reach out to the internet thus having its address exposed? Otherwise just the huge amount of addresses should make ipv6 “more secure” imho.

There was a report a few years back about people running NTP servers to harvest IPv6 addresses. Security via obscurity will only get you so far.

That will only give the NTP server the IP you use for outbound connections. If you use privacy extensions, they'll get a temporary address.

If you don't configure your firewall to allow inbound connections to the temporary address, knowing your temporary address doesn't help them connect back to you. (Also, it's temporary, so their logs of IPs will be useless after a small window.)

Compare this to v4, where connecting out to someone gives them enough information to exhaustively port scan your whole network and trivially find every server you're running.

Re: IPv6 is not insecure because it lacks a NAT

#448

Post by jcalvinowens »

betaby wrote: post #6
Sohcahtoa82 wrote: post #5

This is going to depend on the router and on IP distribution. My ISP does not give me an IPv6 address, only a single IPv6 which all my network devices have to NAT through. NAT is not intended to be a security feature, for sure, but it creates security as a side effect . If I start up a web server on one of my devices, I know that it is unreachable from the Internet unless I go out of my way to set a port forward on m…

> My ISP does not give me an IPv6 address, only a single IPv6 which all my network devices have to NAT through. Interesting how that works in your case. Is your router gives your devices IPv6 from fc00::/7 and then NAT them? It would be a rather rare case.

I'm really curious too. It's probably fd00::/8 though right? fc00::/8 is technically still reserved, although everyone seems to ignore that...

Re: IPv6 is not insecure because it lacks a NAT

#449

Post by deng »

Dagger2 wrote: post #427
deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…

That whole section is talking about outbound connections: When an internal endpoint opens an outgoing session through a NAT, the NAT assigns a filtering rule for the mapping between an internal IP:port (X:x) and external IP:port (Y:y) tuple. When you connect outwards, the NAT creates a state table entry which matches inbound packets corresponding to that outbound connection, and this section is discussing which packe…

> That whole section is talking about outbound connections

Erm... no? Immediately after the paragraph you cited, it continues with

   The key behavior to describe is what criteria are used by the NAT to
   filter packets originating from specific external endpoints.
and then, on "Address-Dependent Filtering", it says

    Additionally, the NAT will filter out packets
    from Y:y destined for the internal endpoint X:x if X:x has not
    sent packets to Y:any previously [...]. In other words, for receiving packets from a
    specific external endpoint, it is necessary for the internal
    endpoint to send packets first to that specific external
    endpoint's IP address.
Meaning: unsolicited inbound connections will be filtered out.

Re: IPv6 is not insecure because it lacks a NAT

#450

Post by InfamousRece »

rnhmjoj wrote: post #312
everdrive wrote: post #298

Right, IPv6 is annoying because it lacks NAT. There's a big difference between something being a huge pain to deal with (IPv6) and being insecure.

Ok, I'll bite: why do you say that IPv6 lacking NAT (which is not true by the way) would be annoying? We can finally get rid of an ugly workaround from 30 years ago that broke one core principle of the Internet (end-to-end connectivity) and a ton of protocols that required even uglier hacks (FTP and SIP ALGs, TURN/STUN, etc.) to barely work. Why would this be annoying?

At my previous place IPv6 was useable (I was getting /60 prefix rather than /64 I’m getting now) but the prefix was changing often - several times per day. This was annoying because every prefix change all addresses of my devices changed too. So in practice I always used private IPv4 addresses to connect to them. A NAT would solve this issue.
Post reply on HN