Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

561–570 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#561

Post by xl-brain »

dissent wrote: post #139
xl-brain wrote: post #130

Earlier quoted context omitted.

This is splitting hairs. The point stands that PAT is the de facto firewall for most soho users.

Not in the context of claiming NAT offers protection. An ipv6 lan with default ingress deny is more secure than ipv4+nat

I think you missing my point. My point is not that IPv6 cannot be secured, it is that the author's take is controversial because people are skeptical about whether networks ARE being secured when NAT is not present. This skepticism is backed up by the research paper that I quoted and real world experience. IPv6 is deployed in many places incorrectly and without the good defaults. IPv4 NAPT in residential networks acts as a last line of defense because most users have been incapable of turning it off.

I suppose I will distill my thought into the assertion that the author should have prefixed his title with "In capable hands,"...

Re: IPv6 is not insecure because it lacks a NAT

#562

Post by xl-brain »

mrsssnake wrote: post #200
xl-brain wrote: post #74

Earlier quoted context omitted.

https://arxiv.org/abs/2509.04792 ? "Collectively, our results show that NAT has indeed acted as the de facto firewall of the Internet, and the v4-to-v6 transition of residential networks is opening up new devices to attack."

ISP hosting a virtual machine you remote desktop into from internal network as the only way to access the external internet can also work as a "de facto firewall". But the best de facto firewall is a proper firewall.

I don't disagree with your comment that the best de facto firewall is a proper firewall. I think you are reacting against the idea that I am saying IPv6 is less secure than IPv4. I am not saying that.

The point of my original post is that the author's take is controversial because people are skeptical about whether networks ARE being secured when NAPT is not present.

They are right to be skeptical, in my opinion, because the rollout of IPv6 has been bungled over and over again. That is not a problem with IPv6, its a problem with the adoption of IPv6.

Re: IPv6 is not insecure because it lacks a NAT

#563

Post by zrail »

mikkupikku wrote: post #547
zrail wrote: post #503

Earlier quoted context omitted.

It might be more fair to say that most American residential ISPs don't have to do that because they have access to giant legacy IPv4 allocations. Comcast alone has 65 million IPv4 addresses, for example (including a /8, /9, and /10 and several /11s).

I think they could make more money using CGNAT and leasing those IPs out to data centers. Also another comment in this thread mentions that their cellular plan sold as a residential internet connection doesn't use CGNAT, but their phone plan from the same company does..

Maybe! CGNAT isn't free, of course, you need pretty beefy machines to handle ISP numbers of clients. So, is the capex for the machines, engineering time to set them up, and opex for keeping them running more or less than they'd make back from leasing their net blocks? Hard to say.

Re: IPv6 is not insecure because it lacks a NAT

#564

Post by jcalvinowens »

aboardRat4 wrote: post #383
tucnak wrote: post #123

Earlier quoted context omitted.

> my ISP still gives me only a single IPv6 address This is criminal, and also incredibly uncommon. You should talk to your ISP, it's most definitely a misconfiguration of some kind, if not deliberate torture. Normally you get a /56 at least because there are so many and they cost nothing.

Not at all. In China, where I live, this is often the case. Many Huawei routers do it by default: they serve ULAs on LAN and do nat6 to a single public v6 address. Is not "deliberate torture", it's just the easiest way to implement things

> they serve ULAs on LAN and do nat6 to a single public v6 address

I've never seen this and I'm curious: do they actually pick a random /48 out of fd00::/8 like they're supposed to?

Re: IPv6 is not insecure because it lacks a NAT

#565

Post by Dagger2 »

tsimionescu wrote: post #529
Dagger2 wrote: post #494

Earlier quoted context omitted.

No, I'm not going to "admit" that, because I know full well that it won't. It's not like I'm sat here thinking "I know it does block traffic, but I'm going to lie to everyone that it won't". NAT in fact, actually, really and honestly, doesn't block traffic, and I think I've been pretty consistent in saying as much.

You've been consistently wrong, yes. A NAT router box will NOT translate a packet coming from the Internet (so, a packet with a globally routable IPv4 address) arriving on its WAN to the RFC1918 IPv4 address of any box sitting behind it on the LAN side, unless it is arriving on a previously open connection, or on a port the user explicitly asked to be allowed and forwarded - exactly the same behavior of a regular sta…

Of course it won't do that -- when did I ever claim it would? But that's not the same behavior as a stateful firewall at all.

A stateful firewall would block packets addressed to the router, or to machines behind it. NAT not translating a packet won't do either of those things.

Re: IPv6 is not insecure because it lacks a NAT

#566

Post by Dagger2 »

kortilla wrote: post #522
Dagger2 wrote: post #464

Earlier quoted context omitted.

There's always somewhere to forward a packet to. The router looks at the dest IP field in the packet header, and that's where it goes. > If the packet was going to a private RFC 1918 address, there wouldn’t be a way to get it to the router in the first place from the internet. This is generally going to be true, but it's not relevant to how NAT behaves when it receives inbound connections.

I’m not sure you understand how NAT implementations work. I recommend you setup a basic iptables NAT set of rules on linux to reflect what a home router does (masquerade) with ip forwarding enabled. The inbound packets from the internet are to a public IP that belongs to the device performing NAT . If there is no entry in the conntrack table from a connection to translate that public IP to a private IP, there is nowh…

I'm reasonably sure I do. I've done that exact test literally half a dozen times now due to people telling me that I'm wrong, and each time I test it turns out that I'm right. What other conclusion am I supposed to come to?

I think it's someone else's turn to do the test now.

> The inbound packets from the internet are to a public IP that belongs to the device performing NAT.

If the inbound packets are addressed to the router, they get delivered to the router. But you cannot just declare that that's where they'll be addressed. You aren't in control of what packets show up to your router, you're only in control of how you process them after they show up.

Re: IPv6 is not insecure because it lacks a NAT

#567

Post by Dagger2 »

kortilla wrote: post #527
Dagger2 wrote: post #476

Earlier quoted context omitted.

The return packet wouldn't be NATed, because stateful NAT tracks connections and only applies NAT to packets that belong to outbound connections. Arguing over how likely this is is missing the point. If it can happen at all when you're running NAT, then it should be clear that NAT isn't providing security.

“if it protects 99.999% of attackers from reaching you but not this one specific attacker in this one case of misconfiguration, it’s not providing security”… Dude, that’s a really shitty take and this is why people that do care about security end up ignoring advice from anyone who thinks this way. You’re in the camp of “don’t use condoms because they can break”.

NAT doesn't protect you from 99.999% of attackers though. It doesn't do anything to incoming connections, so it actually protects you from 0% of attackers.

Re: IPv6 is not insecure because it lacks a NAT

#568

Post by Dagger2 »

aboardRat4 wrote: post #531
Dagger2 wrote: post #479

Earlier quoted context omitted.

Sure, okay. You're using RFC1918 on the internal network, so I'll need to connect to your router's WAN interface to do it, but after that it's just a matter of doing `ip route add 192.168.1.0/24 via 58.19.1.129` and then connecting to whatever I want. How do you want to get me onto your WAN interface? Unless you happen to live near me it'd probably be easiest if you give me a tunnel. Alternately, if you change the in…

>How do you want to get me onto your WAN interface? I've already given you _all_ information you could have realistically squeezed from me. The only thing left for you is to prove that NAT is not a security measure and break into my machine, given that you already have both login and pass. If you had exactly those parameters with ipv6, you would have already broken in.

And like I said, I can do that if you get me into a place where I can demonstrate it.

If you want me to demonstrate that the lock on your safe isn't doing anything, you have to let me into the room where the safe is. Otherwise you won't learn anything about the lock on the safe.

Re: IPv6 is not insecure because it lacks a NAT

#569

Post by Dagger2 »

rnhmjoj wrote: post #472
InfamousRece wrote: post #450

Earlier quoted context omitted.

At my previous place IPv6 was useable (I was getting /60 prefix rather than /64 I’m getting now) but the prefix was changing often - several times per day. This was annoying because every prefix change all addresses of my devices changed too. So in practice I always used private IPv4 addresses to connect to them. A NAT would solve this issue.

Well, delegated IPv6 prefixes are supposed[1] to be static or somewhat persistent, but some ISPs do this, yes. This is most likely a practice carried over from IPv4 where there is a small pool of addresses. Fortunately in my experience it's not too common: most ISPs that deployed IPv6 did it the right way. Anyway, to get persistent addresses you can set up a ULA prefix (the equivalent of RFC 1918 addresses) and a sim…

You don't need prefix translation to use a ULA prefix. You just configure both the ULA and the ISP-delegated GUA prefixes simultaneously.

Re: IPv6 is not insecure because it lacks a NAT

#570

Post by Dagger2 »

iso1631 wrote: post #204
cyberax wrote: post #134

I wrote that comment, and you can write to yourself how many times you want that NAT is not a firewall. The truth of the matter is that NAT absolutely _is_ a firewall in _practice_. Not in theory "because it doesn't drop packets" or "because it was not meant to be a security feature". But in the actual real-world practice. It effectively protects most networks from most attackers without ANY additional configuration,…

If you don't have RPF enabled on your router in theory your upstream peer can send traffic to 192.168.80.26 and it would pass through. Reply traffic may or may not be natted depending on how it's entered in the connection tracking table. There may be situations where your router can be tricked too, I can't think of one off the top of my head which wouldn't also apply to a stateful firewall sitting on a routed network…

RPF wouldn't help, because the reverse route for 192.168.80.26 is going to be the LAN interface, not the WAN interface. You need a firewall.
Post reply on HN