Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is not insecure because it lacks a NAT

johnmaguire.me

Post reply on HN
Print view View original

591–600 of 606 posts

Re: IPv6 is not insecure because it lacks a NAT

#591

Post by kortilla »

Dagger2 wrote: post #567
kortilla wrote: post #527

Earlier quoted context omitted.

“if it protects 99.999% of attackers from reaching you but not this one specific attacker in this one case of misconfiguration, it’s not providing security”… Dude, that’s a really shitty take and this is why people that do care about security end up ignoring advice from anyone who thinks this way. You’re in the camp of “don’t use condoms because they can break”.

NAT doesn't protect you from 99.999% of attackers though. It doesn't do anything to incoming connections, so it actually protects you from 0% of attackers.

Nobody on the Internet can send a packet to an internal IP on your network except for immediate L2 neighbors (I.e. your ISP).

Symmetric NAT 100% stops inbound unsolicited connections to the public IP. And using the public IP is the only way 99.999% can address you.

I implore you to write down (even if just for yourself) what the packet headers would be for you to get a packet from Starbucks WiFi to the device at your home at 192.168.0.5 that has made no egress connections.

You’ll quickly find what you’re suggesting is nonsense. port address translation requires an entry to function. It’s not some optional security feature. It’s required information to get the packet header rewritten to reach private devices.

Re: IPv6 is not insecure because it lacks a NAT

#592

Post by kortilla »

Dagger2 wrote: post #583
ErroneousBosh wrote: post #581

Earlier quoted context omitted.

Okay, but unless you've poked a hole through NAT (and if you have, presumably you know what you're doing), what are those incoming connections going to connect to? If there's nothing to connect to, is there really an incoming connection?

They connect to whatever IP is specified in the packet's "destination IP" header field. It's exactly the same behavior as if there was no NAT going on.

The destination IP header from the internet belongs to the router. There is nothing internal to connect to without NAT.

Re: IPv6 is not insecure because it lacks a NAT

#593

Post by kortilla »

bandrami wrote: post #579
tsimionescu wrote: post #392

Earlier quoted context omitted.

You're using somewhat sloppy terminology that will confuse things. An IP packet can't be addressed both to 12.13.14.15 AND to 192.168.0.7. The realistic attack here is that your ISP sends a packet with destination address 192.168.0.7 to the MAC of your router (the MAC that corresponds to 12.13.14.15). This is a realistic attack scenario if the device that your router connects directly to gets compromised (either by a…

True, the frame is addressed to the router's hw interface but I'm talking to people who think NAT drops traffic so I figured keep it simple But, yes, the ISP (or whoever has compromised/suborned/social engineered the ISP) is absolutely the main worry here and I don't understand how people are dismissing that so easily

> I don't understand how people are dismissing that so easily

Because that’s not where 99.9999% of attacks come from

Fire up a web server on a public ipv4 address and you’ll get hundreds of requests per day from bots probing endpoints for vulnerabilities. Same thing goes for weak passwords on an SSH endpoint.

Re: IPv6 is not insecure because it lacks a NAT

#594

Post by Dagger2 »

kortilla wrote: post #586
Dagger2 wrote: post #566

Earlier quoted context omitted.

I'm reasonably sure I do. I've done that exact test literally half a dozen times now due to people telling me that I'm wrong, and each time I test it turns out that I'm right. What other conclusion am I supposed to come to? I think it's someone else's turn to do the test now. > The inbound packets from the internet are to a public IP that belongs to the device performing NAT. If the inbound packets are addressed to t…

you missed the part about an ACL. You’re whole shtick depends on a bad implementation of routing rules. What you’re describing would happen if NAT were completely disabled. You’re just describing an open router

There's no inherent ACL in NAT, and adding one would just demonstrate that ACLs can block packets, which we already knew.

> What you’re describing would happen if NAT were completely disabled. You’re just describing an open router

Yep. It also happens when NAT is enabled. A router doing NAT is exactly the same thing as an open router -- it just has the additional property of editing outbound connections to appear to come from the IP of the router itself.

If NAT on its own blocked inbound connections, I would have seen that in my tests.

Re: IPv6 is not insecure because it lacks a NAT

#595

Post by Dylan16807 »

kortilla wrote: post #590
Dylan16807 wrote: post #559

Earlier quoted context omitted.

> Im not sure why you’re digging in this way. The marketing material is clearly making security arguments. Oh, I see where you're misunderstanding the claim I'm making, continued from what simoncion was saying. Yes, the marketing is making security arguments. The PIX is a security device as one of its main functions. The feature that was put in specifically for security is its firewall . The NAT isn't adding anything…

I don’t know what to tell you dude. Back in 06 as an admin for campuses where more than half of the machines were XP pre service-pack 2, NAT was 100% used as a security feature. For public WiFi networks and labs where we couldn’t control software on end devices, we put them behind NAT pools purely for security (we still had enough public v4 IPs to give them to printers). You can hand wave however you want, but back t…

"I have personal experience using it that way" is a much better argument than anything you said in previous posts. Thank you for saying that, no sarcasm.

Was there a reason you didn't firewall those devices? I mean, a basic firewall has to do less work to attain the same security, and needs less configuration.

Re: IPv6 is not insecure because it lacks a NAT

#596

Post by icedchai »

Dagger2 wrote: post #587
icedchai wrote: post #580

Earlier quoted context omitted.

Do you admit using RFC-1918 + NAT provides some security even with no firewall for the majority of residential users?

Neither of them prevent inbound connections, on their own or together. I don't really think that "inbound connections work fine and you're basically just praying that the people that can do them simply won't" counts as being secure, but I'll admit that using RFC1918 does limit the set of people that can do them. If you made that your argument, you'd have more of a point than an argument based around NAT.

Okay! I didn't say it was absolutely secure. A firewall is obviously preferred. I'm just saying it's shades of gray... non-routeable addresses provides a level of security.

Re: IPv6 is not insecure because it lacks a NAT

#597

Post by BenjiWiebe »

mikkupikku wrote: post #420
BenjiWiebe wrote: post #348

Earlier quoted context omitted.

Until you run into CGNAT...

Sure, but American residential ISPs don't run with that, probably for this reason.

I brought up CGNAT because my American ISP does use CGNAT. We are now paying an extra monthly fee for a static IP, which I believe is the only option they have for getting a public IP (i.e. no intermediate fee amount for a public non-static IP).

Re: IPv6 is not insecure because it lacks a NAT

#598

Post by Dagger2 »

kortilla wrote: post #592
Dagger2 wrote: post #583

Earlier quoted context omitted.

They connect to whatever IP is specified in the packet's "destination IP" header field. It's exactly the same behavior as if there was no NAT going on.

The destination IP header from the internet belongs to the router. There is nothing internal to connect to without NAT.

No, it might belong to the router. If it does then the connection goes to the router, but if it's set to a LAN machine's IP then the packet gets routed to the LAN machine.

You aren't in control of the contents of inbound packets, and NAT won't filter them to enforce anything about the destination IPs in them either.

Re: IPv6 is not insecure because it lacks a NAT

#599

Post by Dagger2 »

kortilla wrote: post #591
Dagger2 wrote: post #567

Earlier quoted context omitted.

NAT doesn't protect you from 99.999% of attackers though. It doesn't do anything to incoming connections, so it actually protects you from 0% of attackers.

Nobody on the Internet can send a packet to an internal IP on your network except for immediate L2 neighbors (I.e. your ISP). Symmetric NAT 100% stops inbound unsolicited connections to the public IP. And using the public IP is the only way 99.999% can address you. I implore you to write down (even if just for yourself) what the packet headers would be for you to get a packet from Starbucks WiFi to the device at your…

You can't get a packet from a random store wifi network to your home network when your home network is using 192.168.* (barring something like routing headers, which most routers wouldn't process). You said that yourself in the first part of your post, and I don't think I ever argued otherwise.

> Symmetric NAT 100% stops inbound unsolicited connections to the public IP

No, it doesn't. If it did it wouldn't be possible for routers to accidentally make their web admin or UPnP interfaces available to the Internet.

It doesn't stop connections to your router, and it doesn't stop connections through your router either. It just plain doesn't stop connections, which is why it protects you from 0% of attackers.

Re: IPv6 is not insecure because it lacks a NAT

#600

Post by egberts1 »

mrsssnake wrote: post #541
egberts1 wrote: post #366

NAT's only functions are: - share a precious IP address at the NAT gateway border - hide your internal LAN from external network mapper Last point becomes moot when internal mapping software kicks in, legitimately or not, JavaScript or disingenuous application/daemon/app. Welcome to Cybersecurity SecOP. Now this is where Carrier-Grade NAT really shines: added functionality of handling mobile devices' changing IP addr…

> handling mobile devices' changing IP addresses as it hops from one subnet to another We could create TCP/UDP alternative that would handle mobile IP addresses or even make traffic take multiple of those paths at once (look up MPTCP). But we cannot apply it in real scenarios mostly because of middleboxes (like CGNAT) messing up and limiting the messages that should be taken care of on the endpoint.

Right now, there is another battle between AT&T's CGNAT (entire customer base) and Yahoo's NEW login authentication mechanism.

Web browser visiting Yahoo Mail is poorly comparing your external IPv6 with your home's IPv4 and rejecting your login.

This problem gets worse for Linux users as more and more websites (DirecTV) start to use the NEWEST Yahoo login authentication until AT&T somehow starts disbursing IPv6 inside your LAN, ... or something.

So "NAT" security is technically being compromised by Yahoo's JavaScript.

Post reply on HN