4 ms·

Your post is the kind of thing that seems intuitively to be the case, but is actually not in any practical setups. Unless you hardcode your IPv6 addresses, the

Your post is the kind of thing that seems intuitively to be the case, but is actually not in any practical setups. Unless you hardcode your IPv6 addresses, they will be generated automatically and change quite frequently. So the addresses become pretty meaningless and all you have to identify your devices really is the prefix of your network - pretty much the same amount of information as a network behind a NAT'ed IPv4 address. In fact, as far as I remember you can actually statically assign your machines easy to remember addresses if you want but still have the machines generate temporary addresses that they use for outgoing connections, which is cool. As for NAT - it basically gives you no extra security over a basic firewall, and just makes it really difficult to do a lot of things, such as serve content from two machines on your network on the same port. It's not the worst thing in the world, but it is a fairly sub-optimal hack and something I would really love to do away with on my networks.

Nursie 11y ago
I quite like the idea that some of my machines, which are running experimental code or aren't fully secure (or devices like my tv) are not even addressable from the outside but can retrieve stuff if they need to. It seems to make sense there. I guess as/when the transition gets more widespread we'll see if NAT really was giving us any sort of security for free.
- zAy0LfpBZLC8mAC 11y ago
  If NAT was giving us any security at all (probably not, if you keep the stateful packet filter), it most certainly didn't do so for free. Working around the effects of NAT is a major headache that causes a lot of otherwise unnecessary work.
- pdkl95 11y ago
  > are not even addressable from the outside If your router is only doing NAT, they are addressable. A packet sent to a NAT-only router destined for 10.1.2.3 will simply be routed. It may have further address re-writing applied depending on the type of NAT, but that doesn't really matter - the packet will still go through. This could be accomplished with source routing, or an attack could simply originate one hop upstream. The return packets are probably[1] unroutable, but that doesn't stop someone from simply guessing[2] you internal addresses and forging packets. If you want to drop some class of packet - like any incoming packet destined for a local-only address - then you want a firewall, not a NAT. One drops packets, the other merely rewrites addresses. This distinction is often missed because a pure NAT-only device is rare. > aren't fully secure Given how easy it is to generate packets on a supposedly-"internal" network, if a device isn't secure you probably shouldn't even connect it to the network. Border-only security may be not be the worst[3] idea in network security, but it's still a bad idea that should never be relied upon. > for free NAT is easily the most damaging and costly problem in the entire history of the internet. It has turned a network of equal peers into a centrally controlled, cable-TV-like feudalism. What is the cost of the losing the ability to publish without the approval of a 3rd party? What kind of price tag do you put on the entire industry of network software that was never developed because it wouldn't work behind NAT? [1] your ISP hopefully drops any packets from any address other than the IP they assigned you [2] sending to 10.0.[0-1].[1-5] or 192.168.[0-2].[1-5] probably works often enough [3] http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d...
simoncion 11y ago
> Unless you hardcode your IPv6 addresses, they will be generated automatically and change quite frequently. If you're talking about "Privacy Addresses" [0], then your statement isn't always true. If you're not using "Privacy Addresses", [1] your SLAAC or DHCPv6-assigned address remains quite stable, unless your upstream provider changes the prefix that they've assigned to your network. > In fact, as far as I remember you can actually statically assign your machines easy to remember addresses... You don't even have to assign addresses. SLAAC automatically creates stable addresses. "Privacy Addressing" creates random, temporary addresses. You can use both at the same time. [0] https://tools.ietf.org/html/rfc4941 https://tools.ietf.org/html/rfc4941 [1] And I strongly recommend that you don't. For folks who are concerned about being able to be tracked because they have a stable last 64 on every network they attach to, there are alternative methods for generating the ID used to create the SLAAC address that mix in the network prefix. [2][3] This means that -for a particular network-, you get the same last 64 every time you connect, but your last 64 is never the same on any two networks. [2] https://tools.ietf.org/html/rfc7217 https://tools.ietf.org/html/rfc7217 [3] On linux, dhcpcd has the "slaac private" option which enables RFC7217 address generation. "slaac hwaddr" uses the traditional, MAC address based address generation. "slaac private" (or its equivalent in other daemons) is the default setting of every Linux distro I've used in the past 6->12 months. :)

Nursie 11y ago

I quite like the idea that some of my machines, which are running experimental code or aren't fully secure (or devices like my tv) are not even addressable from the outside but can retrieve stuff if they need to. It seems to make sense there. I guess as/when the transition gets more widespread we'll see if NAT really was giving us any sort of security for free.

zAy0LfpBZLC8mAC 11y ago
If NAT was giving us any security at all (probably not, if you keep the stateful packet filter), it most certainly didn't do so for free. Working around the effects of NAT is a major headache that causes a lot of otherwise unnecessary work.
pdkl95 11y ago
> are not even addressable from the outside If your router is only doing NAT, they are addressable. A packet sent to a NAT-only router destined for 10.1.2.3 will simply be routed. It may have further address re-writing applied depending on the type of NAT, but that doesn't really matter - the packet will still go through. This could be accomplished with source routing, or an attack could simply originate one hop upstream. The return packets are probably[1] unroutable, but that doesn't stop someone from simply guessing[2] you internal addresses and forging packets. If you want to drop some class of packet - like any incoming packet destined for a local-only address - then you want a firewall, not a NAT. One drops packets, the other merely rewrites addresses. This distinction is often missed because a pure NAT-only device is rare. > aren't fully secure Given how easy it is to generate packets on a supposedly-"internal" network, if a device isn't secure you probably shouldn't even connect it to the network. Border-only security may be not be the worst[3] idea in network security, but it's still a bad idea that should never be relied upon. > for free NAT is easily the most damaging and costly problem in the entire history of the internet. It has turned a network of equal peers into a centrally controlled, cable-TV-like feudalism. What is the cost of the losing the ability to publish without the approval of a 3rd party? What kind of price tag do you put on the entire industry of network software that was never developed because it wouldn't work behind NAT? [1] your ISP hopefully drops any packets from any address other than the IP they assigned you [2] sending to 10.0.[0-1].[1-5] or 192.168.[0-2].[1-5] probably works often enough [3] http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d...

simoncion 11y ago

> Unless you hardcode your IPv6 addresses, they will be generated automatically and change quite frequently. If you're talking about "Privacy Addresses" [0], then your statement isn't always true. If you're not using "Privacy Addresses", [1] your SLAAC or DHCPv6-assigned address remains quite stable, unless your upstream provider changes the prefix that they've assigned to your network. > In fact, as far as I remember you can actually statically assign your machines easy to remember addresses... You don't even have to assign addresses. SLAAC automatically creates stable addresses. "Privacy Addressing" creates random, temporary addresses. You can use both at the same time. [0] https://tools.ietf.org/html/rfc4941 https://tools.ietf.org/html/rfc4941 [1] And I strongly recommend that you don't. For folks who are concerned about being able to be tracked because they have a stable last 64 on every network they attach to, there are alternative methods for generating the ID used to create the SLAAC address that mix in the network prefix. [2][3] This means that -for a particular network-, you get the same last 64 every time you connect, but your last 64 is never the same on any two networks. [2] https://tools.ietf.org/html/rfc7217 https://tools.ietf.org/html/rfc7217 [3] On linux, dhcpcd has the "slaac private" option which enables RFC7217 address generation. "slaac hwaddr" uses the traditional, MAC address based address generation. "slaac private" (or its equivalent in other daemons) is the default setting of every Linux distro I've used in the past 6->12 months. :)