Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

491–500 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#491

Post by benlivengood »

tsimionescu wrote: post #469
Dagger2 wrote: post #429

Earlier quoted context omitted.

NAT: iptables -A POSTROUTING -o wan0 -j MASQUERADE Firewall: iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -m state --state INVALID -j DROP iptables -A FORWARD -i lan0 -j ACCEPT iptables -A FORWARD -j REJECT --reject-with icmp-admin-prohibited If you omit the first line, you get firewalling without NAT. If you omit the second set of lines, you get NAT without firewalling. This…

And if you have only the first line, what will happen if someone sends a request to the NAT's external IP on some random port?

Without at least some filtering a Gateway NAT appliance is vulnerable to:

* LAN IP address spoofing from the WAN

* Potential for misconfigured "internal" daemons to accept WAN traffic (listening on 0.0.0.0 instead of the LAN or localhost)

* Reflection amplification attacks

Re: IPv6 is not insecure because it lacks a NAT

#492

Post by Dagger2 »

tsimionescu wrote: post #487
Dagger2 wrote: post #481

Earlier quoted context omitted.

So? How is any of that relevant?

Because this is exactly what the GP was claiming, and you denied: even without a firewall, packets that don't correspond to an open connection will get dropped by a NAT, even without a firewall. Sure, maybe "dropped" is wrong, as the NAT box will probably instead send a RST packet, but this is almost entirely irrelevant.

Right, we were talking about NAT. So how is any of that non-NAT-related stuff relevant?

> Sure, but the Internet will not route packets going to RFC1918 addresses

This is about RFC1918, not NAT.

> So, if you're using an RFC1918 address on the LAN side of the router like every sane admin, packets that actually arrive to the router from the Internet with an IP address other than the router's own IP address will get dropped.

This is about reverse path filtering, not NAT.

> And those that arrive at the router with the router's own IP address and a port that doesn't correspond to either an open connection or an explicit port forwarding rule will also get refused.

And this is... actually not true. If there's a server listening on the relevant port, the connection is accepted.

Re: IPv6 is not insecure because it lacks a NAT

#493

Post by Dagger2 »

tsimionescu wrote: post #485
Dagger2 wrote: post #483

Earlier quoted context omitted.

It will reach the router, obviously. If it's a TCP SYN packet and there's a server listening on that port, you'll connect to that server. If there's no listener then you get a RST.

So, assuming the router doesn't have any server running, the connection will be reset, thus protecting all of the machines behind the router from any incoming connection, almost exactly like a firewall (sure, a firewall might just drop the packet instead of responding with a RST). So, in other words, NAT alone can act like a security perimeter, even with no firewall present.

How does the router rejecting a connection to the router protect the machines behind the router? That doesn't make any sense.

Re: IPv6 is not insecure because it lacks a NAT

#494

Post by Dagger2 »

tsimionescu wrote: post #486
Dagger2 wrote: post #480

Earlier quoted context omitted.

Whichever machine has the NAT's external IP assigned to it will accept or refuse the connection, depending on whether they have a server running on that port or not.

The machine that has the NAT's external IP to it is, well, the NAT, by definition. So you admit that the NAT box will act almost exactly like a connection tracking firewall, even if only NAT is enabled.

No, I'm not going to "admit" that, because I know full well that it won't.

It's not like I'm sat here thinking "I know it does block traffic, but I'm going to lie to everyone that it won't". NAT in fact, actually, really and honestly, doesn't block traffic, and I think I've been pretty consistent in saying as much.

Re: IPv6 is not insecure because it lacks a NAT

#495

Post by lamontcg »

muvlon wrote: post #254
amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

It's sad how much of this thread of supposed hackers comes from people who are simply parroting this dogma because it has been drilled into them. People were even preaching this before IPv6 privacy extensions came into use, either downplaying the privacy issues or outright telling people they were bad for wanting privacy because IPv6 is more important. I understand the difference between NAT and firewall perfectly we…

Yeah, I think it is a bit more subtle of an issue than this flamewar always descends into.

There's people upthread arguing that every cellphone in the country is on IPv6 and nobody worries about it, but I'm certain there are thousands of people getting paid salaries to worry about that for you.

Meanwhile, the problem is about the level of trust in the consumer grade router sitting on my desk over there. With IPv4 NAT it is more likely that the router will break in such a way that I won't be able to access the internet. Having NAT break in such a way that it accidentally port forwards all incoming connection attempts to my laptop sitting behind it is not a likely bug or failure mode. If it does happen, it would likely only happen to a single machine sitting behind it.

OTOH, if my laptop and every other machine on my local subnet has a public IPv6 address on it, then I'm trusting that consumer grade router to never break in such a way that the firewall default allows all for some reason--opening up every single machine on my local subnet and every single listening port. A default deny flipping to a default allow is absolutely the kind of security bug that really happens and would keep me awake at night. And even if I don't go messing around with it and screw it up myself, there's always the possibility that a software bug in a firmware upgrade causes the problem.

I'd like to know what the solution to this is, other than blind trust in the router/firewall manufacturer or setting up your own external monitoring (and testing that monitoring periodically).

Instead of just screaming about how "NAT ISN'T SECURITY" over and over, I'd like someone to just explain how to mitigate the security concerns of firewall rulesets--when so very many of us have seen firewall rulesets be misconfigured by "professionals" at our $DAYJOBs. Just telling me that every IPv6 router should have default deny rules and nobody would be that incompetent to sell a router that wouldn't be that insecure doesn't give me warm fuzzies.

I don't necessarily trust NAT more, but a random port forward rule for all ports appearing against a given target host behind it is going to be a much more unusual kind of bug than just having a default firewall rule flipped to allow.

Re: IPv6 is not insecure because it lacks a NAT

#496

Post by anonymars »

quotemstr wrote: post #442
anonymars wrote: post #351

Earlier quoted context omitted.

> Even ignoring the question of whether the concept of an ordinal ranking in amount of security even makes sense I must be misinterpreting this statement, are you arguing that you aren't sure whether "x is more secure than y" is inherently a valid thing to compare?

"X is more secure than Y" is usually an ill-formed statement. Secure against what threats? Does X provide every security guarantee Y does? Every single one? Then there's no proper superset relationship, and the best we can do is say that X and Y provide different security guarantees. If we model security as a lattice, lots of systems end up being incommensurable. You have to talk about the specific threats. Okay, sup…

I can see what you're saying, but I don't think the existence of situations that aren't comparable means we should do away with idea of comparison. You could make that argument about almost anything (not just security): almost always in engineering (and life) there are tradeoffs. Sometimes those tradeoffs are clear-cut. Sometimes they aren't.

There may be a long tail, but I don't think that should exclude sensible statements like "deny-by-default is safer"...that promotes situations where software doesn't select opinionated defaults and so you end up with publicly accessible Mongo and Redis and S3 resources as we've seen over the years.

Re: IPv6 is not insecure because it lacks a NAT

#497

Post by nobody9999 »

tsimionescu wrote: post #477
nobody9999 wrote: post #363

Earlier quoted context omitted.

>NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. No. NAT enables internal, non-routable (cf. rfc1918[0]) actors on the inside to access external resources on the Internet. Generally, that's done via NAT masquerade[1] (one-to-many NAT), but can also be done with one-to-one NAT. >A firewall is not required for NAT to work, although many fir…

> No. It isn't. And if you enable NAT without firewall rules, it will happily expose your internal network to external actors. In fact, that's the whole point of NAT. How exactly would a regular NAT implementation, such as s consumer router's NAT, remove security compared to a direct connection? Assuming there is no port forwarding configured, the NAT will drop (or NACK) any packets addressed to the router's IP on an…

>How exactly would a regular NAT implementation, such as s consumer router's NAT, remove security compared to a direct connection? Assuming there is no port forwarding configured, the NAT will drop (or NACK) any packets addressed to the router's IP on any port that doesn't correspond to a currently open connection.

No one (at least not me) said anything about a "direct connection" (which I assume means using globally routable IPv4 addresses on your internal systems).

Nor did anyone say anything about not forwarding any ports. In fact, much of the discussion has been about how "secure" NAT is when forwarding ports, with some folks claiming that doing so is all you need. Or did you miss those 80-100 comments?

>This statement makes no sense. If you are not using NAT of some kind, and your machines only have RFC1918 addresses, then your machines can't access the Internet at all.

Exactly. That was my point. And if you add NAT without stateful firewall rules to limit access, your internal systems are exposed.

I tell you what: post the IP address/range of your home network, turn off the firewall you're using and just leave NAT enabled as it is right now and we can see for ourselves just how "secure" bare NAT is. What do you say?

Unsecured NAT (i.e., without, at a minimum, firewall rules limiting connectivity -- a default deny rule at least) is not secure at all.

I've said (now twice) what I had to say. Feel free to disagree (again) and/or downmod my post, but my decades of experience professionally implementing networks, the security infrastructure which attempts to secure them, at the perimeter as well as at the LAN, server and endpoint informs my opinion.

Don't agree? That's fine with me. It's no skin off my nose. I have no axe to grind with you or anyone else around this or anything else.

Have a good day.

Edit: Clarified the "Globally routable" addresses as IPv4.

Re: IPv6 is not insecure because it lacks a NAT

#498

Post by notepad0x90 »

nemothekid wrote: post #454
notepad0x90 wrote: post #347

Earlier quoted context omitted.

It is not, you guys are talking from a specific american ISP perspective where you have these modem+router+gateway+firewall combo devices. Not everyone gets that. Many get just a modem and buy a cheap router which may not have a firewall. MANY more get just a modem and their laptops are directly exposed to the internet (!!!), those you can't do much about, but many put a "router" that's just a cheap wifi access point…

> Many get just a modem and buy a cheap router which may not have a firewall What cheap router are you buying that doesn't have a firewall. I think the problem is when people hear "firewall" they think the router is running pfSense or something. Even cheap routers will have a basic, non-configurable, firewall that will block inbound connections. That is separate from NAT and has nothing to do with IPv4/IPv6.

what most people call "router" in that context are APs. Good ones are proper router/AP/Firewall combos, but my cheap ones don't.

Here is a good example with the user guide: https://www.tp-link.com/us/document/107360/

It's an AP that serves DHCP addresses on the lan port. that's it. It has some port forwarding too if you set it up, no firewalling there. For modems, most cable ISPs let you buy a DOCSIS modem, there is no router, whatever device you connect gets a DHCP lease right on the internet (and ipv6), most people buy cheap "routers" like that one to add "wifi" to it, and it works great for the money. And honestly, I have yet to see one that does have a firewall, but then again I've never tried the $500 router options or seen someone who did.

These devices are not meant to firewall, they have no need to firewall. if you do "bridge" or "portforward" they assume you want everything forwarded, they don't let you configure any firewalling by design, and they don't have any firewalling because it isn't needed. They have a dedicated WAN port, the management interface doesn't listen on that port and LAN devices are NAT'ed with IPv4 so there is no need to firewall anything even behind the scenes. Their main use is to either extend wifi coverage or add wifi capability to modems.

Most people with fiber or *DSL get an ISP provided gateway which has a firewall,that's not the same as what I'm talking about.

I hate to complain about downvotes, but you all need to realize that it is the poorest and most vulnerable around the world that get hurt over this stuff. yes, ipv6 can cause unintended internet exposure of internal devices. period. that's not a dismissal or disapproval of ipv6, it is what it is, and that needs to be considered when deploying it. It assumes you'll configure your network properly, unfortunately the people who made ipv6 didn't consider consumers or people who screw up, they wanted to force people to configure firewalls, that works for corporations (until it doesn't) but not for most regular internet users.

Re: IPv6 is not insecure because it lacks a NAT

#499

Post by illiac786 »

quotemstr wrote: post #441
1dom wrote: post #385

Earlier quoted context omitted.

> an IPv4 NAT and an IPv6 default deny rule are equivalent in security: both uphold the invariant Yes, you're correct, on some level, they are equivalent: in both cases, packets don't reach the target machine. That is one of the few levels on which they are equivalent. > There's no basis for claiming the two schemes differ in the level of security provided. Yes there is, this is basic secure architecture and secure b…

> Yes there is, this is basic secure architecture and secure by design principals The only principles at work here are the ones of superstition and magical thinking. The existence of a "disable security" button doesn't weaken the theoretical security properties of a system when that button isn't pressed, and NAT systems and pure firewalls alike have this button. If anything, NAT systems are sometimes worse due to thi…

I think most of the comments on this thread crystallise two different conception of security: the intended one and the effective one.

The second one is messy to measure, it requires making statistics on how often NAT saved the day by accident, which is hard if not impossible.

I personally think that statistics always win, even if they are unexplainable. My bet (zero proof) is, IPv4 is statistically (maybe by accident) more secure than IPv6, just because of NAT.

I have seen so many horrors in terms of multiple NATs I will always prefer IPv6, also because I think the benefits outweigh by far the difference in _effective_ security.

Summary: yes, IPv4 is more secure, but the difference is so marginal that IPv6 is still way better. Security is not the only metric in my world and theoretical discussions obsessing about a single metric are pointless.

Re: IPv6 is not insecure because it lacks a NAT

#500

Post by quotemstr »

anonymars wrote: post #496
quotemstr wrote: post #442

Earlier quoted context omitted.

"X is more secure than Y" is usually an ill-formed statement. Secure against what threats? Does X provide every security guarantee Y does? Every single one? Then there's no proper superset relationship, and the best we can do is say that X and Y provide different security guarantees. If we model security as a lattice, lots of systems end up being incommensurable. You have to talk about the specific threats. Okay, sup…

I can see what you're saying, but I don't think the existence of situations that aren't comparable means we should do away with idea of comparison. You could make that argument about almost anything (not just security): almost always in engineering (and life) there are tradeoffs. Sometimes those tradeoffs are clear-cut. Sometimes they aren't. There may be a long tail, but I don't think that should exclude sensible st…

I'm calling for linguistic precision. What does it mean for a SOHO router to be "secure"? If we taboo this word "secure" for the moment and instead ask how effectively these devices, e.g. prevent unauthorized inbound connections to bottable IoT devices, we can start to get a concrete sense of the landscape and directions in which we can move across it. By focusing on the specific thing we want to accomplish, we can avoid getting distracted by considerations relevant only to other scenarios and better approximate a "meeting of the minds" on terminology and goals
Post reply on HN