Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

541–550 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#541

Post by mrsssnake »

egberts1 wrote: post #366

NAT's only functions are: - share a precious IP address at the NAT gateway border - hide your internal LAN from external network mapper Last point becomes moot when internal mapping software kicks in, legitimately or not, JavaScript or disingenuous application/daemon/app. Welcome to Cybersecurity SecOP. Now this is where Carrier-Grade NAT really shines: added functionality of handling mobile devices' changing IP addr…

> handling mobile devices' changing IP addresses as it hops from one subnet to another

We could create TCP/UDP alternative that would handle mobile IP addresses or even make traffic take multiple of those paths at once (look up MPTCP). But we cannot apply it in real scenarios mostly because of middleboxes (like CGNAT) messing up and limiting the messages that should be taken care of on the endpoint.

Re: IPv6 is not insecure because it lacks a NAT

#543

Post by iso1631 »

Gigachad wrote: post #252
iso1631 wrote: post #193

Earlier quoted context omitted.

Defence in depth is a valid security approach, and NAT provides another defence in depth If you have a vulnerable ipv4 machine on 192.168.0.24 port 2345 which is hidden behind a public IP of 1.2.3.4, and you set your firewall rule to allow any inbound traffic, with no nat rules then it will be exceedingly difficult for a remote attacker to reach that vulnerable port (they have to trick your router's connection table…

It’s the same layer. On router admin panels it’s literally the same UI for firewall rules and nat port forwarding. If you went in to your router admin and allowed all ports on v4 it would be exactly the same as allowing all on v6. The router will happily forward all connections to v4 devices the same.

> If you went in to your router admin and allowed all ports on v4 it would be exactly the same as allowing all on v6. The router will happily forward all connections to v4 devices the same.

Forward to where?

You have to actively say "forward port 80 to 192.168.0.2". Port 80 can't be forwarded to 192.168.0.2 and 192.168.0.3.

Where allowing all traffic means you can talk to 2100:xxx::192.168.0.2 and 2100:xxx::192.168.0.3

Re: IPv6 is not insecure because it lacks a NAT

#544

Post by sylware »

mrsssnake wrote: post #539
sylware wrote: post #303

IPv4 is not secure because it requires a NAT in order to be? Big centralized online services does not want IPv6 because it "unlocks" internet as intended, full p2p at scale. They won't let that happen easily. And please stop with that 'computers security', we all know here it does not exist (NAT or not), it is a fantasy. Saying otherwise is engaging in bad faith.

> And please stop with that 'computers security', we all know here it does not exist (NAT or not), it is a fantasy. Saying otherwise is engaging in bad faith. So you are willing to message me your credentials then?

Bad faith using a deviation on "social engineering", unrelated here.

Re: IPv6 is not insecure because it lacks a NAT

#545

Post by p_ing »

cyberax wrote: post #438
p_ing wrote: post #401

Earlier quoted context omitted.

NAT introduces complexity, not simplicity. Besides, NAT isn't a security feature.

Secure and reliable IPv6 deployment has _more_ complexity than IPv4.

SLAAC is more complex than IPv4 w/ NAT w/ DHCPv4? Serious?

Assign a /56, firewall in place already dropping anything not explicitly allowed, done.

Re: IPv6 is not insecure because it lacks a NAT

#546

Post by eqvinox »

basilikum wrote: post #512
eqvinox wrote: post #191

Earlier quoted context omitted.

> I don’t have any idea how they got the ip, You might've been using DHCPv6 assigning sequential addresses starting at 1? Remember: friends don't let friends use DHCPv6[*]. Help out, uninstall DHCPv6 today. [*] in IA_NA mode (address assignment). PD and stateless info-only are fine.

What's so bad about DHCPv6?

In IA_NA mode, you're at the mercy of the DHCPv6 server for any kind of address privacy. And good luck getting a second address if you want to run a CLAT for 464. You don't want this in a home network.

As for servers, you mostly won't want it either, considering (a) you might rather configure things statically, and (b) it's easier to just deal out whole /64s per server, especially since that gives space for VMs.

So where's the niche for DHCPv6? Maybe assigning addresses for telco or OOB equipment… idk.

And just to be clear: DHCPv6 information-only ("stateless") and DHCPv6 prefix delegation modes are perfectly fine. It's the individual address assignment (IA_NA) mode that should just never have been invented.

Re: IPv6 is not insecure because it lacks a NAT

#547

Post by mikkupikku »

zrail wrote: post #503
mikkupikku wrote: post #420

Earlier quoted context omitted.

Sure, but American residential ISPs don't run with that, probably for this reason.

It might be more fair to say that most American residential ISPs don't have to do that because they have access to giant legacy IPv4 allocations. Comcast alone has 65 million IPv4 addresses, for example (including a /8, /9, and /10 and several /11s).

I think they could make more money using CGNAT and leasing those IPs out to data centers. Also another comment in this thread mentions that their cellular plan sold as a residential internet connection doesn't use CGNAT, but their phone plan from the same company does..

Re: IPv6 is not insecure because it lacks a NAT

#548

Post by cwillu »

kingstnap wrote: post #391
fsh wrote: post #199

Earlier quoted context omitted.

Find me a consumer IPv6 router sold in the last ~10 years without a restrictive firewall enabled by default. I have never seen one.

Mine lol. My ISP sent a Nokia Beacon 3.1. When I first logged into its web GUI, it had a "Security" tab with these dropdowns. Security level High: Traffic denied inbound and minimally permit common service outbound. Low: All outbound traffic and pinhole-defined inbound traffic is allowed. Off: All inbound and outbound traffic is allowed. It was actually set to "Off" interestingly enough.

That's not the same thing: does it actually forward martian packets? Because that's what's required for this to be exploited.

Re: IPv6 is not insecure because it lacks a NAT

#549

Post by oofbey »

fsh wrote: post #179
oofbey wrote: post #140

Earlier quoted context omitted.

I understand ipv4 networks pretty well. And I would say that any device doing NAT is acting as a basic firewall. Do “true” firewalls do more? Sure. But saying NAT doesn’t provide security is flat out wrong.

If your router had only NAT and someone (i.e. your ISP) sends it a package addressed to somewhere inside your internal IP range, it will happily forward it. A firewall would block it.

If there is more than one machine behind the NAT which one would it forward it to? This hypothetical simple NAT without firewall AFAICT doesn’t exist in reality, even if it exists in specs. I don’t see how it actually could.

Re: IPv6 is not insecure because it lacks a NAT

#550

Post by kortilla »

Dylan16807 wrote: post #534
kortilla wrote: post #524

Earlier quoted context omitted.

No, you cannot get a connection to the device. It’s an un-routable block of RFC 1918 addresses.

> No, you cannot get a connection to the device. ...okay? I didn't say you can. I said that line in the marketing implies you can, as part of how it's wrong . If that wrong line in the marketing is the strongest evidence for NAT being initially understood as a security feature, that's very weak evidence for the pile. (If the way I worded things needs more clarification, let me try to elaborate. There is a way in whic…

Im not sure why you’re digging in this way. The marketing material is clearly making security arguments. Whether or not you agree with them is entirely irrelevant because the statement was that NAT was marketed as a security feature.
Post reply on HN