Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

551–560 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#551

Post by kstrauser »

ErroneousBosh wrote: post #536
kstrauser wrote: post #405

Earlier quoted context omitted.

Or more likely, network engineers who’ve been subpoenaed to collect the information? Your scenario is plausible for high value targets. Like, what country wouldn’t want to have a friendly tech working at the ISP most politicians use in DC? That doesn’t seem improbable. For the regular Joe Schmoe, I’d be more concerned with court-ordered monitoring.

Ah, that sounds like an American problem. If you're in the US, you're living in a hostile surveillance state that makes North Korea look like a hippy commune.

Oh yes, subpoenas are a uniquely American problem. eyeroll.png

Re: IPv6 is not insecure because it lacks a NAT

#552

Post by sedawkgrep »

dspillett wrote: post #506
sedawkgrep wrote: post #431

Earlier quoted context omitted.

In an enterprise network, it's very, very unlikely that an edge router is doing any firewalling. They can do it, but it's not only cumbersome to do it there, but also a massive resource drain. Often they do basic stateless packet filtering, but definitely nothing akin to stateful, connection-oriented firewalling. It's important to make the distinction, because filtering in this case is completely uni-directional and…

> but definitely nothing akin to stateful, connection-oriented firewalling This is where my confusion comes in, I think. Surely the variety of NAT that significantly improves the IPv4 address starvation problem (IP Masq by its various names) requires a connection oriented approach to be effective? Maybe not as far as more advanced conntrack rules (trying to get connect-back based protocols to work) but even just a ba…

> Surely the variety of NAT that significantly improves the IPv4 address starvation problem (IP Masq by its various names) requires a connection oriented approach to be effective?

Actually it doesn't. Well, not really.

With NAT you're generally talking about either 1:1 or 1:many (Masquerading).

In all cases the device doing the NAT maintains a table which is referenced for every matching packet that arrives or leaves.

In 1:1 NAT, the IP in the packet header (Layer-3) is simply rewritten from one address to the other whenever a packet matching both addresses in the NAT table leaves or arrives.

In 1:many NAT, the source port is randomized because you can run into collisions when multiple clients are connecting to the same server:port. So in that case the NAT table contains IP addresses as well as ports. When a return packet arrives, it checks the NAT table and rewrites both the L3 and L4 (port) info before passing it along.

Often times firewalls will randomize the source port when doing 1:1 NAT as a security measure, but after all these years I don't really remember why that's helpful. :-\

But that's really the extent of tracking connections with NAT.

Now when you're talking about firewalling, there's a lot more to track, such as connection start/stop/timeouts/lifetimes, total throughput, TCP state (handshakes, sequence numbers, etc.), closing open sessions when seeing things like TCP RSTs or FINs or ICMP unreachables. The amount of data and CPU is dramatically higher, and tailored to the software doing the firewalling. I believe in many cases simple L3/L4 rewrites can happen in hardware.

I haven't talked about any of this in several years so I hope I'm making sense.

Re: IPv6 is not insecure because it lacks a NAT

#553

Post by fulafel »

account42 wrote: post #402
deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…

> Of course, ipv6 is not less secure because it doesn't have NAT, as the same filtering behavior can be replicated with a firewall. That may even have advantages over NAT. I don't think this follows - defaults matter after all. More precise would be to say that IPv6 setups can be as secure as IPv4 setups.

CPE like wifi router+nat boxes do by default have IPv6 firewall on, so s/can/is/

Re: IPv6 is not insecure because it lacks a NAT

#554

Post by cyberax »

p_ing wrote: post #545
cyberax wrote: post #438

Earlier quoted context omitted.

Secure and reliable IPv6 deployment has _more_ complexity than IPv4.

SLAAC is more complex than IPv4 w/ NAT w/ DHCPv4? Serious? Assign a /56, firewall in place already dropping anything not explicitly allowed, done.

> SLAAC is more complex than IPv4 w/ NAT w/ DHCPv4? Serious?

Yes? Has this ever been in question?

Stateful DHCP provides a _reliable_ way to configure clients, while SLAAC is anything but. It's also insufficient in itself if you want to configure things like NTP servers.

But that's not the main issue. The main issue is that with SLAAC you are supposed to hand out real routable addresses. That are _not_ controlled by you, so the end devices need to be able to handle prefix withdrawals and deprecations. This can lead to your printer not working if your ISP connection goes down and it has no more active IPv6 prefixes.

So you also need a stable ULA. But even that is not a guarantee because source IP selection rules are, shall we say, not the best.

But wait, there's more! You can trivially load-balance/failover NAT-ed IPv4 network over two WAN connections. Now try to do that with IPv6. Go on. I'll wait.

Re: IPv6 is not insecure because it lacks a NAT

#555

Post by zajio1am »

tsimionescu wrote: post #530
benlivengood wrote: post #491

Earlier quoted context omitted.

Without at least some filtering a Gateway NAT appliance is vulnerable to: * LAN IP address spoofing from the WAN * Potential for misconfigured "internal" daemons to accept WAN traffic (listening on 0.0.0.0 instead of the LAN or localhost) * Reflection amplification attacks

LAN IP address spoofing is indeed a valid attack vector, if the ISP is compromised. Internal daemons on machines other than the router itself in the LAN network listening on 0.0.0.0 are not insecure (unless you have the problem from point 1, malicious/compromised ISP). The router won't route packets with IPs that are not in its LAN to them. Of course, the router itself could be compromised if it accidentally listens…

You do not need compromised ISP for spoofed LAN IP traffic, the attack could came from other clients on the same WAN segment.

Re: IPv6 is not insecure because it lacks a NAT

#556

Post by NewJazz »

theamk wrote: post #521
NewJazz wrote: post #466

Earlier quoted context omitted.

Nope, iproute can still show your Mac address. And a curl ipinfo.io can show your public v4 address.

Mac address is absolutely safe in IPv4 world - the only info it gives is the network card manufacturer. And people don't usually share "curl ipinfo.io" output unless they plan to share their external IP (unlike "ifconfig" output, which is one of the first things you want to share for any sort of networking problems)

See the top comment in this thread:

Target #2 [IPv6] gives aways 90% of the game at attacking it (we even leak some device specific information, so you know precisely where it's weak points are)

You may not consider Mac address to he important, but the context of this conversation did bring it up. Of course they forgot the fact that most v6 addressing doesn't expose Mac addresses anymore.

Re: IPv6 is not insecure because it lacks a NAT

#557

Post by user205738 »

jeroenhd wrote: post #184
nottorp wrote: post #178

No one's complaining that IPV6 is insecure. It may as well be very secure, but no one bothers to understand it if they're not paid to do that. Of course you can have default drop in your IPV6 firewall, but it's far easier to keep in your head that internal NATed IPs aren't accessible and "real" IPs are.

I've seen plenty of discussions here on HN where people have made that claim. Even more elsewhere on the discussion side of other news websites by sysadmins that disable IPv6 because one of their industrial routers didn't come with a default deny rule that one time which made them think that's normal. The people who are supposed to know IPv6 never seemed to have learned it and many of them don't seem to be open to th…

I always disable ipv6 on all devices first because there is no point in using it.

Re: IPv6 is not insecure because it lacks a NAT

#558

Post by direwolf20 »

user205738 wrote: post #557
jeroenhd wrote: post #184

Earlier quoted context omitted.

I've seen plenty of discussions here on HN where people have made that claim. Even more elsewhere on the discussion side of other news websites by sysadmins that disable IPv6 because one of their industrial routers didn't come with a default deny rule that one time which made them think that's normal. The people who are supposed to know IPv6 never seemed to have learned it and many of them don't seem to be open to th…

I always disable ipv6 on all devices first because there is no point in using it.

it's faster on most networks

Re: IPv6 is not insecure because it lacks a NAT

#559

Post by Dylan16807 »

kortilla wrote: post #550
Dylan16807 wrote: post #534

Earlier quoted context omitted.

> No, you cannot get a connection to the device. ...okay? I didn't say you can. I said that line in the marketing implies you can, as part of how it's wrong . If that wrong line in the marketing is the strongest evidence for NAT being initially understood as a security feature, that's very weak evidence for the pile. (If the way I worded things needs more clarification, let me try to elaborate. There is a way in whic…

Im not sure why you’re digging in this way. The marketing material is clearly making security arguments. Whether or not you agree with them is entirely irrelevant because the statement was that NAT was marketed as a security feature.

> Im not sure why you’re digging in this way. The marketing material is clearly making security arguments.

Oh, I see where you're misunderstanding the claim I'm making, continued from what simoncion was saying.

Yes, the marketing is making security arguments. The PIX is a security device as one of its main functions.

The feature that was put in specifically for security is its firewall. The NAT isn't adding anything on top of that, security-wise.

> Whether or not you agree with them is entirely irrelevant because the statement was that NAT was marketed as a security feature.

The original claim is that companies generally saw NAT itself as a security feature. That goes beyond a single incoherent sentence in a piece of marketing about a device that had NAT and a firewall. Again, I accept that the sentence is some evidence for the idea but it's so weak. This is something that happened just a couple decades ago, there should be plenty of evidence of actual decisionmaking.

Also it occurs to me that the phrase "know which machine on the corporate network is using a Class C address" might be talking about NATing entire IPs, every port at once. In which case that's very much not a security feature. NAT like that puts the machine naked on the internet. It's about as secure as having your devices get publicly routable addresses out of DHCP. So if that's what they meant, that sentence is making unjustified claims. Did one easily disproven line in a pamphlet convince an industry?

Re: IPv6 is not insecure because it lacks a NAT

#560

Post by Gigachad »

iso1631 wrote: post #543
Gigachad wrote: post #252

Earlier quoted context omitted.

It’s the same layer. On router admin panels it’s literally the same UI for firewall rules and nat port forwarding. If you went in to your router admin and allowed all ports on v4 it would be exactly the same as allowing all on v6. The router will happily forward all connections to v4 devices the same.

> If you went in to your router admin and allowed all ports on v4 it would be exactly the same as allowing all on v6. The router will happily forward all connections to v4 devices the same. Forward to where? You have to actively say "forward port 80 to 192.168.0.2". Port 80 can't be forwarded to 192.168.0.2 and 192.168.0.3. Where allowing all traffic means you can talk to 2100:xxx::192.168.0.2 and 2100:xxx::192.168.0…

Yes, you can't expose multiple computers at the same time on v4, but you certainly can expose one, in exactly the same UI you exposed v6. And then that one you exposed has full access to the local network beyond the firewall to expose the rest.

The argument seems silly almost like "I deliberately shot myself in the foot, but with v4 I could only shoot one foot at a time while v6 lets me shoot both". The answer is to just not shoot yourself in the foot, since you have to make a deliberate effort to do this in the first place, just not doing that is the answer.

Post reply on HN