Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

581–590 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#581

Post by ErroneousBosh »

Dagger2 wrote: post #567
kortilla wrote: post #527

Earlier quoted context omitted.

“if it protects 99.999% of attackers from reaching you but not this one specific attacker in this one case of misconfiguration, it’s not providing security”… Dude, that’s a really shitty take and this is why people that do care about security end up ignoring advice from anyone who thinks this way. You’re in the camp of “don’t use condoms because they can break”.

NAT doesn't protect you from 99.999% of attackers though. It doesn't do anything to incoming connections, so it actually protects you from 0% of attackers.

Okay, but unless you've poked a hole through NAT (and if you have, presumably you know what you're doing), what are those incoming connections going to connect to?

If there's nothing to connect to, is there really an incoming connection?

Re: IPv6 is not insecure because it lacks a NAT

#582

Post by rnhmjoj »

Dagger2 wrote: post #569
rnhmjoj wrote: post #472

Earlier quoted context omitted.

Well, delegated IPv6 prefixes are supposed[1] to be static or somewhat persistent, but some ISPs do this, yes. This is most likely a practice carried over from IPv4 where there is a small pool of addresses. Fortunately in my experience it's not too common: most ISPs that deployed IPv6 did it the right way. Anyway, to get persistent addresses you can set up a ULA prefix (the equivalent of RFC 1918 addresses) and a sim…

You don't need prefix translation to use a ULA prefix. You just configure both the ULA and the ISP-delegated GUA prefixes simultaneously.

Right, the ULA prefix theoretically has lower preference, so it should only be selected to reach hosts in the LAN and the GUA for everything else, but I don't know how well softwares handle this in practice.

Re: IPv6 is not insecure because it lacks a NAT

#583

Post by Dagger2 »

ErroneousBosh wrote: post #581
Dagger2 wrote: post #567

Earlier quoted context omitted.

NAT doesn't protect you from 99.999% of attackers though. It doesn't do anything to incoming connections, so it actually protects you from 0% of attackers.

Okay, but unless you've poked a hole through NAT (and if you have, presumably you know what you're doing), what are those incoming connections going to connect to? If there's nothing to connect to, is there really an incoming connection?

They connect to whatever IP is specified in the packet's "destination IP" header field. It's exactly the same behavior as if there was no NAT going on.

Re: IPv6 is not insecure because it lacks a NAT

#584

Post by MPSimmons »

tsimionescu wrote: post #387
MPSimmons wrote: post #251

Earlier quoted context omitted.

>This difference in theory versus practice is precisely why we see people objecting that IPv4 is more secure as far as default configurations go when it comes to home use. I mean, I agree with them. I think people who say 'NAT is not security' are only correct in the absolute most pendantic way and that the way NAT is commonly configured is literally the only reason the internet doesn't consist mostly of botnets. But…

The whole premise of IPv6 is that every device should have a globally routable IP. This thread went into DHCP for some reason, but that is uncommon and not recommended for IPv6, where you're supposed to use SLAAC. With SLAAC, I'm not even sure you could realistically disable the ability to get a public IP. And if you did, I'm not sure you could allow a device to access the Internet over IPv6 with a consumer router wi…

>The whole premise of IPv6 is that every device should have a globally routable IP

I would agree with the small adjustment of, 'every device should be able to have a globally routable IP'.

There are a lot of devices, like the ones we're talking about, that should not be accessible to the internet at large. You're not preventing them from getting a public IP because you don't have enough, you're preventing them from having a public IP as part of the belt-and-suspenders approach because there's no need to have one.

Re: IPv6 is not insecure because it lacks a NAT

#585

Post by 1dom »

quotemstr wrote: post #502
illiac786 wrote: post #499

Earlier quoted context omitted.

I think most of the comments on this thread crystallise two different conception of security: the intended one and the effective one. The second one is messy to measure, it requires making statistics on how often NAT saved the day by accident, which is hard if not impossible. I personally think that statistics always win, even if they are unexplainable. My bet (zero proof) is, IPv4 is statistically (maybe by accident…

I see the split too. I'll add that each camp is frustrated and feels the other is missing the point and would make information security worse if its worldview won. You can do some empirical analysis. Someone downthread linked to a paper claiming to being able to reach a few million vulnerable devices over IPv6 and not IPv4. This kind of analysis isn't dispositive, though, because there are all sorts of second-order e…

I understand your view, I just disagree with the value you're putting on it, and I feel you're straying into accidentally insulting people to justify yourself:

You called yourself a philosopher and then proclaimed philosophers are the only ones who read security as an integral part of system architecture, whilst veterans are essentially vibe coding and surviving on the lucky mess they create.

I find your position that misconfiguration is a red herring in security as completely unjustifiable and untenable.

It's probably that I'm just a puny brained veteran seeing your big complex philosopher smarts as incoherent though.

Anyway, I digress from the key point I've been trying to make in this entire thread:

I'm not arguing that IPv6 is not secure because it lacks NAT. My point was that this entire discussion is silly engagement bait: there's no clear right answer, but it's an easy topic for dogma and engagement. A holywars topic like NAT, IPv6 and security is prime for that. The author and submitter muddies the waters further by - probably not intentionally - choosing a strawman submission title.

Re: IPv6 is not insecure because it lacks a NAT

#586

Post by kortilla »

Dagger2 wrote: post #566
kortilla wrote: post #522

Earlier quoted context omitted.

I’m not sure you understand how NAT implementations work. I recommend you setup a basic iptables NAT set of rules on linux to reflect what a home router does (masquerade) with ip forwarding enabled. The inbound packets from the internet are to a public IP that belongs to the device performing NAT . If there is no entry in the conntrack table from a connection to translate that public IP to a private IP, there is nowh…

I'm reasonably sure I do. I've done that exact test literally half a dozen times now due to people telling me that I'm wrong, and each time I test it turns out that I'm right. What other conclusion am I supposed to come to? I think it's someone else's turn to do the test now. > The inbound packets from the internet are to a public IP that belongs to the device performing NAT. If the inbound packets are addressed to t…

you missed the part about an ACL. You’re whole shtick depends on a bad implementation of routing rules.

What you’re describing would happen if NAT were completely disabled. You’re just describing an open router

Re: IPv6 is not insecure because it lacks a NAT

#587

Post by Dagger2 »

icedchai wrote: post #580
Dagger2 wrote: post #575

Earlier quoted context omitted.

And in this common configuration, NAT does nothing to prevent inbound connections.

Do you admit using RFC-1918 + NAT provides some security even with no firewall for the majority of residential users?

Neither of them prevent inbound connections, on their own or together.

I don't really think that "inbound connections work fine and you're basically just praying that the people that can do them simply won't" counts as being secure, but I'll admit that using RFC1918 does limit the set of people that can do them. If you made that your argument, you'd have more of a point than an argument based around NAT.

Re: IPv6 is not insecure because it lacks a NAT

#588

Post by Dagger2 »

smw wrote: post #507
Dagger2 wrote: post #479

Earlier quoted context omitted.

Sure, okay. You're using RFC1918 on the internal network, so I'll need to connect to your router's WAN interface to do it, but after that it's just a matter of doing `ip route add 192.168.1.0/24 via 58.19.1.129` and then connecting to whatever I want. How do you want to get me onto your WAN interface? Unless you happen to live near me it'd probably be easiest if you give me a tunnel. Alternately, if you change the in…

Right, and in a similar situation, if the internal device was given a routable ipv6 address by the ISP's cable modem, you could directly access that device. This isn't a hypothetical. There are ISPs who do this out of the box. I plugged a linux box into my ISP's cable modem/router in Amsterdam and immediately noticed my ssh port was getting hammered by port scanners. This isn't what most customers, especially those w…

I could do it if it was using a routable v4 address too, and I can do it with either RFC1918 or ULA as well (which are both routable, just not over the Internet) if I can get close enough to send the relevant packets. NAT provides no protection against any of these.

You don't normally see many SSH brute force attempts on v6, let alone getting hammered by them. I do see some, but it's mostly to obvious addresses like ::2, ::3 etc which I don't use, or to IPs you can scrape from TLS cert logs. If you set an ssh server up on an IP that you don't publicize, finding it is hard.

Re: IPv6 is not insecure because it lacks a NAT

#589

Post by Dagger2 »

rnhmjoj wrote: post #582
Dagger2 wrote: post #569

Earlier quoted context omitted.

You don't need prefix translation to use a ULA prefix. You just configure both the ULA and the ISP-delegated GUA prefixes simultaneously.

Right, the ULA prefix theoretically has lower preference, so it should only be selected to reach hosts in the LAN and the GUA for everything else, but I don't know how well softwares handle this in practice.

Source address selection is usually left to the kernel, so that part should be okay. It'll pick a GUA source for a GUA destination unless you've changed the labels with `ip addrlabel`.

Re: IPv6 is not insecure because it lacks a NAT

#590

Post by kortilla »

Dylan16807 wrote: post #559
kortilla wrote: post #550

Earlier quoted context omitted.

Im not sure why you’re digging in this way. The marketing material is clearly making security arguments. Whether or not you agree with them is entirely irrelevant because the statement was that NAT was marketed as a security feature.

> Im not sure why you’re digging in this way. The marketing material is clearly making security arguments. Oh, I see where you're misunderstanding the claim I'm making, continued from what simoncion was saying. Yes, the marketing is making security arguments. The PIX is a security device as one of its main functions. The feature that was put in specifically for security is its firewall . The NAT isn't adding anything…

I don’t know what to tell you dude. Back in 06 as an admin for campuses where more than half of the machines were XP pre service-pack 2, NAT was 100% used as a security feature.

For public WiFi networks and labs where we couldn’t control software on end devices, we put them behind NAT pools purely for security (we still had enough public v4 IPs to give them to printers).

You can hand wave however you want, but back then NAT was used for an easy first level of security.

“There existed a better thing in a pure stateful firewall” is not an argument against people using NAT instead.

Post reply on HN