Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

531–540 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#531

Post by aboardRat4 »

Dagger2 wrote: post #479
aboardRat4 wrote: post #374

Earlier quoted context omitted.

>This is a terrible argument. First, NAT doesn't provide the security behavior users want. Try breaking into my machine. Login:pass are administrator:pa$$w0rd, external ip 58.19.1.129, internal ip is 192.168.1.124, the system is Windows xp, and firewall is turned off on both the computer and the box the ISP gave me.

Sure, okay. You're using RFC1918 on the internal network, so I'll need to connect to your router's WAN interface to do it, but after that it's just a matter of doing `ip route add 192.168.1.0/24 via 58.19.1.129` and then connecting to whatever I want. How do you want to get me onto your WAN interface? Unless you happen to live near me it'd probably be easiest if you give me a tunnel. Alternately, if you change the in…

>How do you want to get me onto your WAN interface?

I've already given you _all_ information you could have realistically squeezed from me. The only thing left for you is to prove that NAT is not a security measure and break into my machine, given that you already have both login and pass.

If you had exactly those parameters with ipv6, you would have already broken in.

Re: IPv6 is not insecure because it lacks a NAT

#532

Post by tsimionescu »

nobody9999 wrote: post #497
tsimionescu wrote: post #477

Earlier quoted context omitted.

> No. It isn't. And if you enable NAT without firewall rules, it will happily expose your internal network to external actors. In fact, that's the whole point of NAT. How exactly would a regular NAT implementation, such as s consumer router's NAT, remove security compared to a direct connection? Assuming there is no port forwarding configured, the NAT will drop (or NACK) any packets addressed to the router's IP on an…

>How exactly would a regular NAT implementation, such as s consumer router's NAT, remove security compared to a direct connection? Assuming there is no port forwarding configured, the NAT will drop (or NACK) any packets addressed to the router's IP on any port that doesn't correspond to a currently open connection. No one (at least not me) said anything about a "direct connection" (which I assume means using globally…

I've explained before, in many threads, that pure consumer NAT, without a firewall, has exactly the same behavior as a consumer stateful firewall, except for two cases :

1. The ISP is malicious/compromised, and sends packets with RFC1918 addresses on the router's WAN port.

2. The router itself has admin services that are listening on public IPs (eg HTTP server listening on 0.0.0.0 instead of 192.168.0.1), so it itself could be compromised from outside the ISP network.

Except for these two points, there is no difference between the security characteristics of a consumer NAT and a consumer firewall:

1. LAN machines can't be reached over the internet other than through the NAT, since a packet addressed to 192.168.0.7 from Google will not be routed by any ISP.

2. When a packet arrives to the NAT with a destination IP set to the NAT public IP, the packet will not be delivered to any box on the LAN unless (a) its ports match an active connection from a LAN box, or (b) its destination port matches an explicit port forward rule an admin added.

Case (a) above is exactly what a stateful firewall with a default deny rule does. Case (b) is also exactly the same, as if you explicitly open a port in this type of consumer firewall, it will allow any packet matching that port.

Now, I wouldn't disable my firewall, because I don't trust that my consumer router is itself well enough secured, and I don't necessarily trust my ISP's network either. But this doesn't mean that my laptop is exactly as secure if it were to sit behind this router with no firewall as it would be if I disabled both firewall and NAT entirely and gave my laptop a publicly routable IPv4.

Re: IPv6 is not insecure because it lacks a NAT

#533

Post by tsimionescu »

Dagger2 wrote: post #492
tsimionescu wrote: post #487

Earlier quoted context omitted.

Because this is exactly what the GP was claiming, and you denied: even without a firewall, packets that don't correspond to an open connection will get dropped by a NAT, even without a firewall. Sure, maybe "dropped" is wrong, as the NAT box will probably instead send a RST packet, but this is almost entirely irrelevant.

Right, we were talking about NAT. So how is any of that non-NAT-related stuff relevant? > Sure, but the Internet will not route packets going to RFC1918 addresses This is about RFC1918, not NAT. > So, if you're using an RFC1918 address on the LAN side of the router like every sane admin, packets that actually arrive to the router from the Internet with an IP address other than the router's own IP address will get dro…

> And this is... actually not true. If there's a server listening on the relevant port, the connection is accepted.

Fine. Packets that arrive at the router with the router's own IP address and a port that doesn't correspond to either an open connection, an explicit port forwarding rule, OR the port of a service on the router itself listening on the WAN IP will also get refused.

The point is that any LAN box sitting behind the NAT will not get that packet, same as if the router had a stateful firewall running.

And sure, this is not purely a property of the NAT itself, it's a combination of the Internet not routing private IP addresses, reverse path filtering, and NAT. That still doesn't need any firewall to achieve this.

Re: IPv6 is not insecure because it lacks a NAT

#534

Post by Dylan16807 »

kortilla wrote: post #524
Dylan16807 wrote: post #201

Earlier quoted context omitted.

That came up earlier and I know it's a gray area but I agree with the idea that a line tossed into the marketing and not backed up by the manual weakens the importance. The firewall in the PIX is the security workhorse. Also that sentence implies you can get a connection to a device, you just know less about which one it is. Is that really a meaningful security feature? To the extent that connections are actually blo…

No, you cannot get a connection to the device. It’s an un-routable block of RFC 1918 addresses.

> No, you cannot get a connection to the device.

...okay? I didn't say you can. I said that line in the marketing implies you can, as part of how it's wrong.

If that wrong line in the marketing is the strongest evidence for NAT being initially understood as a security feature, that's very weak evidence for the pile.

(If the way I worded things needs more clarification, let me try to elaborate. There is a way in which NAT would prevent the connection, but that aspect of NAT is not what the marketing sentence talked about. It incorrectly talked about a different aspect of NAT. While there could theoretically be a device that uses NAT for protection, this device uses the firewall for protection. Just like basically every other device that can do NAT.)

Re: IPv6 is not insecure because it lacks a NAT

#536

Post by ErroneousBosh »

kstrauser wrote: post #405
bandrami wrote: post #386

Earlier quoted context omitted.

Do you trust the state actors who have compromised it?

Or more likely, network engineers who’ve been subpoenaed to collect the information? Your scenario is plausible for high value targets. Like, what country wouldn’t want to have a friendly tech working at the ISP most politicians use in DC? That doesn’t seem improbable. For the regular Joe Schmoe, I’d be more concerned with court-ordered monitoring.

Ah, that sounds like an American problem. If you're in the US, you're living in a hostile surveillance state that makes North Korea look like a hippy commune.

Re: IPv6 is not insecure because it lacks a NAT

#537

Post by ErroneousBosh »

bandrami wrote: post #386
ErroneousBosh wrote: post #317

Earlier quoted context omitted.

Yes, I trust everyone who works at it, mostly because I know where they live.

Do you trust the state actors who have compromised it?

I know all the people that work at it.

Re: IPv6 is not insecure because it lacks a NAT

#538

Post by mrsssnake »

almosthere wrote: post #188

So with IPv4 with NAT you definitely have this security. According to this article with IPv6 you MIGHT have that security -we don't know. That's not secure.

Also with IPv6 with NAT you definitely have this security, but with IPv4 without NAT you MIGHT have that security...

Disabling security features makes them disabled. Also security of NAT is a side effect because of that the devices behind it are not connected to the internet just tricks them into thinking they are.

Re: IPv6 is not insecure because it lacks a NAT

#539

Post by mrsssnake »

sylware wrote: post #303

IPv4 is not secure because it requires a NAT in order to be? Big centralized online services does not want IPv6 because it "unlocks" internet as intended, full p2p at scale. They won't let that happen easily. And please stop with that 'computers security', we all know here it does not exist (NAT or not), it is a fantasy. Saying otherwise is engaging in bad faith.

> And please stop with that 'computers security', we all know here it does not exist (NAT or not), it is a fantasy. Saying otherwise is engaging in bad faith.

So you are willing to message me your credentials then?

Re: IPv6 is not insecure because it lacks a NAT

#540

Post by mrsssnake »

user3939382 wrote: post #334

I’m not using any networking implementation that’s less tested and ipv6 is less tested. Network routing means there are dozens of TCPIP implementations touching traffic. The benefit of ipv6 for my case isn’t worth the risk. If you’ve never run into an ipv6 specific bug good for you.

How is nearly 50% of modern Internet infrastructure not well tested enough? Also, IPv6 is not an implementation by itself.

> Network routing means there are dozens of TCPIP implementations touching traffic.

One reason why routers should not fiddle with TCP and stay on IP layer.

Post reply on HN