Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

511–520 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#511

Post by smw »

Macha wrote: post #311
pregnenolone wrote: post #289

As someone with limited networking knowledge, I’m not really getting smarter here. Some say it adds security; others disagree. Let me ask this: does IPv6 benefit me in any way if I have multiple devices at home behind a router and I'm not running any servers or similar services?

Do you play video games with P2P networking? Then your choices are to pick one of the following: - the hosting player enables upnp - use ipv6 - the hosting player manually sets up port forwarding (consumer routers often talk about a DMZ option which takes an IP address - really this is just forwarding all ports not matched by any other rule)

STUN

Re: IPv6 is not insecure because it lacks a NAT

#512

Post by basilikum »

eqvinox wrote: post #191
MobiusHorizons wrote: post #118

Earlier quoted context omitted.

I don’t have any idea how they got the ip, it could certainly have been making outbound connections, though. I think it had NTP, although I might have pointed it at a local server we had for that.

> I don’t have any idea how they got the ip, You might've been using DHCPv6 assigning sequential addresses starting at 1? Remember: friends don't let friends use DHCPv6[*]. Help out, uninstall DHCPv6 today. [*] in IA_NA mode (address assignment). PD and stateless info-only are fine.

What's so bad about DHCPv6?

Re: IPv6 is not insecure because it lacks a NAT

#513

Post by icedchai »

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

Yes, but NAT combined with RFC1918 private addresses does provide a layer of security. This is the most common NAT configuration for 99.99% of residential users. It is what most people mean by "NAT."

If your address cannot be routed across the Internet, it can't be accessed, firewall or not.

I have worked in corporate environments where we NAT'd public, route-able addresses for historical reasons. That would be insecure without a firewall and is not what most people are discussing.

Re: IPv6 is not insecure because it lacks a NAT

#514

Post by icedchai »

Dagger2 wrote: post #434
mannyv wrote: post #163

Earlier quoted context omitted.

You are wrong because you are being overly pedantic. NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. A firewall is not required for NAT to work, although many firewalls have NAT built-in. And indeed, if a firewall is off NAT can still function (if NAT is separate). Your definition of security is too narrow. And saying that NAT is broken a…

> NAT provides security because normally it disallows external actors on the outside from accessing resources on the inside side. No... it doesn't do that. NAT edits your packets so that your outbound connections appear to come from your router's IP. If you set up a port forward rule, then it edits matching inbound connections so they appear to be coming to a different destination IP. Notice how no part of that descr…

Non-routeable internal addresses are pretty effective at preventing external actors. When most people say "NAT", that is what they mean.

You are technically correct in that 1) disallowing external actors is not a property of "NAT" itself, 2) theoretically someone could establish routing to your RFC-1918 network if they had ISP control or had layer-2 adjacency.

Practically speaking, this is not a problem. NAT + RFC-1918 addressing provides a layer of security. Is a firewall better? Of course.

Re: IPv6 is not insecure because it lacks a NAT

#515

Post by icedchai »

fc417fc802 wrote: post #446
Dagger2 wrote: post #435

Earlier quoted context omitted.

It doesn't though. NAT edits your outbound connections to appear to come from the router's IP; it doesn't do anything to make inbound connections harder.

If you don't initiate a corresponding outbound connection first then any attempt at an inbound connection will be dropped (unless you have a DMZ configured ofc). The router literally can't forward the traffic because it doesn't know where it should go.

No, the router doesn't forward it because it doesn't get there in the first place. Your 192.168.1.0/24 private network is not going to be routed across the internet.

Re: IPv6 is not insecure because it lacks a NAT

#516

Post by icedchai »

Dagger2 wrote: post #481
tsimionescu wrote: post #474

Earlier quoted context omitted.

Sure, but the Internet will not route packets going to RFC1918 addresses. So, if you're using an RFC1918 address on the LAN side of the router like every sane admin, packets that actually arrive to the router from the Internet with an IP address other than the router's own IP address will get dropped. And those that arrive at the router with the router's own IP address and a port that doesn't correspond to either an…

So? How is any of that relevant?

Because that is the most common NAT configuration for 99.99% of residential users. Anything else is academic discussion.

Re: IPv6 is not insecure because it lacks a NAT

#517

Post by POCKET_SANDO »

Denatonium wrote: post #473
fdr wrote: post #160

For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. This is all to underscore the author's point: NAT may necessitate s…

In the case of T-Mobile, unsolicited inbound IPv6 connections are blocked, but direct P2P is still possible. I successfully established a WireGuard tunnel over IPv6 between 2 phones. With IPv6, since the internal addresses and ports and the same end-to-end, all that is needed is a dynamic DNS service; STUN isn't necessary. I did need to set a persistent keepalive of 25 seconds on both sides of the tunnel to keep the…

This is how researchers were able to remotely hack several Chrysler models. They used a Sprint hotspot to get an IP on the cell network and were able to connect to any other Sprint device. The cellular modems on these cars were on Sprint so they just had to be on the same network. I wonder if Verizon intentionally blocks this.

https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-e...

Re: IPv6 is not insecure because it lacks a NAT

#518

Post by aidenn0 »

Dagger2 wrote: post #445
aidenn0 wrote: post #162

Earlier quoted context omitted.

When we say "NAT" we are specifically talking about stateful one-to-many NAT implementations as found in consumer IPv4 hardware. Such a NAT is largely isomorphic to a firewall with default-deny semantics for incoming connections and default-allow semantics for outgoing connections. There are other possible NAT implementations that are much less like a firewall, but saying that a NAT does not provide security is a mis…

It's not isomorphic to a firewall, because it doesn't have default-deny semantics for incoming connections. Think about it for a second. These NAT implementations change the apparent source IP of your outbound connections. How does that block inbound connections? Changing the IP isn't blocking, and outbound connections are the wrong ones. If a connection comes into your router with a dest IP set to one of your LAN ma…

I said "largely isomorphic" Note:

1. How did a packet with a RFC1918 address reach router; it would require an attacker able to generate packets (or get something to e.g. unwrap an IP-in-IP packet) on the same link, since the router isn't going to ARP any of those addresses. Limiting inbound connections to originate on the same link does provide some measure of security.

2. Will the router even do anything with a packet coming in on the inbound port that doesn't target the public IP? This is implementation dependent.

Re: IPv6 is not insecure because it lacks a NAT

#519

Post by dietr1ch »

deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…

I see this backwards. If my machine is only secure because of the magical firewall that practically blocks everything, then it isn't really secure, especially in a world were so many devices make it physically past the NAT and can be compromised by looking at old CVEs

Re: IPv6 is not insecure because it lacks a NAT

#520

Post by aidenn0 »

smw wrote: post #508
Dagger2 wrote: post #445

Earlier quoted context omitted.

It's not isomorphic to a firewall, because it doesn't have default-deny semantics for incoming connections. Think about it for a second. These NAT implementations change the apparent source IP of your outbound connections. How does that block inbound connections? Changing the IP isn't blocking, and outbound connections are the wrong ones. If a connection comes into your router with a dest IP set to one of your LAN ma…

You literally can't access the internal devices with the NAT implementation on most consumer level router/access points except for packets addressed to the port mapped to an already open connection originating from the inside. This is almost guaranteed to be a random high port. There's no way to access any other port on an internal ip address. That's equivalent to default-deny. I think either you're just trying to "w…

I think understand what GP is saying; if you manage to get a packet to the internet port of the NAT router with a destination IP of e.g. 192.168.0.123, and the NAT router is running a generic IPv4 routing stack, it will dutifully route it to the internal network.

This can be done by compromising another host on the same link. It can also be done if anything on the same link (including the router itself) is running an improperly configured tunneling setup that lets the attacker send e.g. an IP-in-IP packet that gets unwrapped. The NAT has made it much harder to get a packet establishing an inbound connection to the router, but doesn't actually prevent the establishment of a connection should such a packet get there.

Compare to a default-deny firewall with public addresses on the LAN. Any inbound connections will be dropped, by definition; the lack of NAT makes it trivial to get a packet to the firewall itself, but once it's there, it won't get through.

Post reply on HN