Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

571–580 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#571

Post by Dagger2 »

smw wrote: post #508
Dagger2 wrote: post #445

Earlier quoted context omitted.

It's not isomorphic to a firewall, because it doesn't have default-deny semantics for incoming connections. Think about it for a second. These NAT implementations change the apparent source IP of your outbound connections. How does that block inbound connections? Changing the IP isn't blocking, and outbound connections are the wrong ones. If a connection comes into your router with a dest IP set to one of your LAN ma…

You literally can't access the internal devices with the NAT implementation on most consumer level router/access points except for packets addressed to the port mapped to an already open connection originating from the inside. This is almost guaranteed to be a random high port. There's no way to access any other port on an internal ip address. That's equivalent to default-deny. I think either you're just trying to "w…

I'm not. You literally can do this, provided there's no firewall. All you need to do is send the router a packet that's already addressed to a LAN machine, and in it goes. "NAT won't translate the packet" doesn't matter if the address is already set to an IP from the LAN.

Most consumer-level routers do have a firewall to prevent it from happening, and if they don't then people describe that router as being "grossly misconfigured" or as having a security vulnerability and similar things, so in practice it'll be blocked. But that's my point: they need the firewall to do the job precisely because NAT doesn't do it.

Re: IPv6 is not insecure because it lacks a NAT

#572

Post by Dagger2 »

tsimionescu wrote: post #528
Dagger2 wrote: post #493

Earlier quoted context omitted.

How does the router rejecting a connection to the router protect the machines behind the router? That doesn't make any sense.

Because no one on the Internet can reach my 192.168.0.7 machine if the NAT router doesn't translate the packet. And the NAT router won't send a packet that arrives with its public IP as dstIP to any machine behind it, unless the port its ports correspond to an open connection, or to an explicitly forwarded port.

You could turn NAT off completely and still no-one on the Internet could reach your 192.168.0.7. There's no security perimeter coming from NAT here.

> And the NAT router won't send a packet that arrives with its public IP as dstIP to any machine behind it

Yes, of course. The problem is when a packet arrives with the IP of a LAN machine.

Re: IPv6 is not insecure because it lacks a NAT

#573

Post by Dagger2 »

deknos wrote: post #197

Of course it's not insecure because of NAT. NAT (in all its forms) is just a very convenient technology for many people and niche situations. And adoption of IPv6 will be hindered as long as NAT is not a first class citizen. And of course, mostly NAT should not be used as "firewall replacement". But what many firewall proponents forget here: NON-IT People at home cannot run and manage a firewall (and proxies). For th…

We haven't forgotten that, but we're also aware that non-IT people can't run NAT either. They can plug in a box that already has NAT configured though, and if they can manage that then they can also plug in a box that already has a firewall configured.

VMs work fine without NAT too -- DHCPv6-PD lets the VM software automatically request a routed prefix.

Re: IPv6 is not insecure because it lacks a NAT

#574

Post by Dagger2 »

xl-brain wrote: post #561
dissent wrote: post #139

Earlier quoted context omitted.

Not in the context of claiming NAT offers protection. An ipv6 lan with default ingress deny is more secure than ipv4+nat

I think you missing my point. My point is not that IPv6 cannot be secured, it is that the author's take is controversial because people are skeptical about whether networks ARE being secured when NAT is not present. This skepticism is backed up by the research paper that I quoted and real world experience. IPv6 is deployed in many places incorrectly and without the good defaults. IPv4 NAPT in residential networks act…

The point is that NAT offers no security, so it doesn't make sense to be skeptical about the security of a network just because it doesn't have NAT.

The only way to be confident is to have a firewall, and you can do that on v6 just as well as you already do on v4.

Re: IPv6 is not insecure because it lacks a NAT

#575

Post by Dagger2 »

icedchai wrote: post #516
Dagger2 wrote: post #481

Earlier quoted context omitted.

So? How is any of that relevant?

Because that is the most common NAT configuration for 99.99% of residential users. Anything else is academic discussion.

And in this common configuration, NAT does nothing to prevent inbound connections.

Re: IPv6 is not insecure because it lacks a NAT

#576

Post by user3939382 »

mrsssnake wrote: post #540
user3939382 wrote: post #334

I’m not using any networking implementation that’s less tested and ipv6 is less tested. Network routing means there are dozens of TCPIP implementations touching traffic. The benefit of ipv6 for my case isn’t worth the risk. If you’ve never run into an ipv6 specific bug good for you.

How is nearly 50% of modern Internet infrastructure not well tested enough? Also, IPv6 is not an implementation by itself. > Network routing means there are dozens of TCPIP implementations touching traffic. One reason why routers should not fiddle with TCP and stay on IP layer.

> IPv6 is not an implementation by itself.

I’m not sure what you mean by this. In other words, there is code that is specifically written for ipv6 handling which in some cases isn’t tested as thoroughly as ipv4. Less of an issue as ipv6 adoption grows but it’s non zero. I don’t like the address format, I prefer NAT by default, routing by prefix, like everything ipv6 offers I don’t feel comfortable with even without that. But it’s the most technical reason I don’t like it, the rest is a personal/vibes thing.

Re: IPv6 is not insecure because it lacks a NAT

#577

Post by Dagger2 »

tsimionescu wrote: post #533
Dagger2 wrote: post #492

Earlier quoted context omitted.

Right, we were talking about NAT. So how is any of that non-NAT-related stuff relevant? > Sure, but the Internet will not route packets going to RFC1918 addresses This is about RFC1918, not NAT. > So, if you're using an RFC1918 address on the LAN side of the router like every sane admin, packets that actually arrive to the router from the Internet with an IP address other than the router's own IP address will get dro…

> And this is... actually not true. If there's a server listening on the relevant port, the connection is accepted. Fine. Packets that arrive at the router with the router's own IP address and a port that doesn't correspond to either an open connection, an explicit port forwarding rule, OR the port of a service on the router itself listening on the WAN IP will also get refused. The point is that any LAN box sitting b…

Well no, it's purely a property of the fact that the packet is addressed to the router.

If the packet is addressed to a machine on the LAN, neither RPF or NAT will protect you from it. "The Internet won't route to private IPs" only protects you if you have private IPs on the LAN, and even then it only protects you from people who can't get access to the network on your WAN interface.

Any way you dice it, NAT isn't providing any protection.

Re: IPv6 is not insecure because it lacks a NAT

#578

Post by Dagger2 »

throw0101a wrote: post #346
sedawkgrep wrote: post #336

Earlier quoted context omitted.

Who exactly is going to route/send an RFC1918 address to an Internet gateway? Are you implying your ISP itself is going to do this? Because the Internet at-large doesn't have routes for your internal address space.

> Who exactly is going to route/send an RFC1918 address to an Internet gateway? The GP is talking about 1:1 'basic' NAT: * https://datatracker.ietf.org/doc/html/rfc2663#section-4.1.1

The same problem applies to masquerading. Routers are happy to route packets they receive, and NAT (in whatever form) isn't the tool you use to drop those packets.

Re: IPv6 is not insecure because it lacks a NAT

#579

Post by bandrami »

tsimionescu wrote: post #392
bandrami wrote: post #272

Earlier quoted context omitted.

If your public IP from your ISP is 12.13.14.15, and your internal block is 192.168.0.0/24, then your ISP can send a packet to 12.13.14.15 destined for 192.168.0.7, and without a firewall your router will happily forward it. An attacker who can convince intervening routers to send traffic destined for 192.168.0.7 to 12.13.14.15 (and these attacks do exist, particularly over UDP) can also do that.

You're using somewhat sloppy terminology that will confuse things. An IP packet can't be addressed both to 12.13.14.15 AND to 192.168.0.7. The realistic attack here is that your ISP sends a packet with destination address 192.168.0.7 to the MAC of your router (the MAC that corresponds to 12.13.14.15). This is a realistic attack scenario if the device that your router connects directly to gets compromised (either by a…

True, the frame is addressed to the router's hw interface but I'm talking to people who think NAT drops traffic so I figured keep it simple

But, yes, the ISP (or whoever has compromised/suborned/social engineered the ISP) is absolutely the main worry here and I don't understand how people are dismissing that so easily

Re: IPv6 is not insecure because it lacks a NAT

#580

Post by icedchai »

Dagger2 wrote: post #575
icedchai wrote: post #516

Earlier quoted context omitted.

Because that is the most common NAT configuration for 99.99% of residential users. Anything else is academic discussion.

And in this common configuration, NAT does nothing to prevent inbound connections.

Do you admit using RFC-1918 + NAT provides some security even with no firewall for the majority of residential users?
Post reply on HN