7 ms·

Between IoT and the deployment of IPv6 (meaning no more automatic NAT firewalling), I feel like we need to take a fresh look at how home routers are designed.

by tjohns 11y ago

Between IoT and the deployment of IPv6 (meaning no more automatic NAT firewalling), I feel like we need to take a fresh look at how home routers are designed. I'd love to see products that provide a user-friendly way to help me audit what my network is doing, and create firewall rules for different classes of devices. For example, if you're running a DVR server, the camera mentioned in this article probably shouldn't have been granted Internet access. While some routers have basic firewall support, it's really rudimentary and nowhere near sufficient when you have several dozen (or more) relatively unknown devices on your network. And definitely not user-friendly enough for most home users.

ihsw 11y ago
Even if we get a user-friendly way to authorize outbound network access, users will still just click "Allow" and "Accept" to make the notifications go away. I am wholeheartedly open to maintaining a whitelist for all of what's trying to reach out of my home network, but the sheer magnitude of domains being queried makes it unfeasible.
computator 11y ago
> help me audit what my network is doing, and create firewall rules We need be a better solution than this! I already dread having to configure and tweak firewalls every time I add a new device or install a new application. Even with the most user-friendly firewall in the world, we'll still end up in a world where 99% of users don't do anything and have no security/privacy. And the 1% of technical users will end up breaking basic functionality because they blocked something that the manufacturer of the device or app deemed to be an essential connection. Thinking out of the box for a moment: If you install a camera, suppose your router automatically encrypted everything coming out of the camera such that it could only be decrypted on your smartphone, or whatever you're using to view the feed from your camera. The encryption, decryption, and keys are completely independent of and outside of the control of camera manufacturer. The encryption is unavoidable; even if they get a secret feed of the video, they cannot decrypt it. Instead of the router, perhaps it's the device driver that does the encryption. The point is that this is something automatically done whenever you plug in a camera and which the camera manufacturer cannot subvert. (This idea is for cameras and such. For other kinds of IoT devices, this particular idea may or may not help.)
pdkl95 11y ago
> no more automatic NAT firewalling NAT != firewall IPv6 doesn't take away your stateful firewall, and NAT isn't providing ANY security. Your private IP addresses are betrayed all the time by your browser (and TCP option headers). NAT has done an incredible amount of damage to the internet; it prevented the development of true peer-to-peer software and forced everything to centralize. The solution - even for IoT in the few places IoT isn't a surveillance scam - is to remove NAT by using IPv6.
- jerf 11y ago
  I don't think anyone was claiming what you seem to be arguing against; the point was merely that even the accidental and minimal security brought on by being unable to externally address internal networks is going away with IPv6. It was never "real" security, but it did make it materially harder to breach into someone's network. Of course it's also going away with all the IoT things actively reaching out, since every external connection made without care is also an avenue for attack. ("Oh, you want your firmware update little camera? Have I got an unsigned blob for you! You're gonna love this update.")
- arca_vorago 11y ago
  I am a sysadmin who has been slowly preparing for IPv6 as an eventuality, and have read quite a bit on it, though I admit there is much more to learn. That being said, and knowing that the industry says otherwise, I disagree on the seemingly accepted state that we should get rid of nat for ipv6, for a few key reasons. 1. Yes, browsers and other things will leak your private ip space sometimes, but nat does indeed provide a level of security simply due to complications in routing issues for attackers. Its certainly only a base layer, but it does help. 2. In many situations, we dont want devices on the internet at all, and on private only networks. This is doable with site private, but that brings me to 3. There is a lack of clearly communicated best practices for the industry. To the pont that adoption is almost nill. I recently had a private network setup via ATT, and they said I was the first customer on that network type to request ipv6... 4. Knowing how heavily the NSA was involved in ipv6 (in particular ipv6 ipsec), I have my concerns about the protocol itself, albiet as of yet unverified doubts. The corruption of NIST committees is a very serious thing to me. 5. As the admin, I want to be able to see non encrypted traffic and metdata traversing my exit points. I am having a harder and harder time diagnosing IPv6 because of how often it wants to tunnel to some ipv4 address that I dont trust (read: microsoft). I know that all these points are fairly weak and suspect to criticism, but what gets me is that I dont hear this discussion. Instead I just hear either how ipv6 is god and you should embrace its loving arms, or I see people just sticking their head in the sand who say, I dont like it so Im going to ignore it and hold on to my ipv4 blocks until they make me. Im open to conversations on the topic, and my list is larger but Im on mobile and late for fixing some ipv4 networking issues .
drvdevd 11y ago
This line stood out to me (especially after reading the protocol explanation points from a manufacturer just above): "I’m baffled as to why such a well-known brand as Foscam would enable P2P communications on a product that is primarily used to monitor and secure homes and offices." Well the first answer that came to mind for me was NAT. There's a reason you'll see both botnets and (commodity, cheap) security cameras generating P2P traffic: NAT. NAT+IPV4 is a problem that adds complexity and less usability at the cost of security. It's a clear bolt-on design that consumers have tolerated probably for longer than we should have. I think ISPs have mostly created this problem in being slow to adopt something else. I would also agree that we have a basic usability problem in home routers and pretty much the entire concept of firewalls when it comes to normal users. How do you explain egress traffic filtering to someone who just wants to control their thermostat from their phone and stuff?
Integer 11y ago
The Turris Omnia router project has the Majordomo component, which sounds somewhat similar to what you have in mind.

by tjohns 11y ago

ihsw 11y ago

Even if we get a user-friendly way to authorize outbound network access, users will still just click "Allow" and "Accept" to make the notifications go away. I am wholeheartedly open to maintaining a whitelist for all of what's trying to reach out of my home network, but the sheer magnitude of domains being queried makes it unfeasible.

computator 11y ago

> help me audit what my network is doing, and create firewall rules We need be a better solution than this! I already dread having to configure and tweak firewalls every time I add a new device or install a new application. Even with the most user-friendly firewall in the world, we'll still end up in a world where 99% of users don't do anything and have no security/privacy. And the 1% of technical users will end up breaking basic functionality because they blocked something that the manufacturer of the device or app deemed to be an essential connection. Thinking out of the box for a moment: If you install a camera, suppose your router automatically encrypted everything coming out of the camera such that it could only be decrypted on your smartphone, or whatever you're using to view the feed from your camera. The encryption, decryption, and keys are completely independent of and outside of the control of camera manufacturer. The encryption is unavoidable; even if they get a secret feed of the video, they cannot decrypt it. Instead of the router, perhaps it's the device driver that does the encryption. The point is that this is something automatically done whenever you plug in a camera and which the camera manufacturer cannot subvert. (This idea is for cameras and such. For other kinds of IoT devices, this particular idea may or may not help.)

pdkl95 11y ago

> no more automatic NAT firewalling NAT != firewall IPv6 doesn't take away your stateful firewall, and NAT isn't providing ANY security. Your private IP addresses are betrayed all the time by your browser (and TCP option headers). NAT has done an incredible amount of damage to the internet; it prevented the development of true peer-to-peer software and forced everything to centralize. The solution - even for IoT in the few places IoT isn't a surveillance scam - is to remove NAT by using IPv6.

jerf 11y ago
I don't think anyone was claiming what you seem to be arguing against; the point was merely that even the accidental and minimal security brought on by being unable to externally address internal networks is going away with IPv6. It was never "real" security, but it did make it materially harder to breach into someone's network. Of course it's also going away with all the IoT things actively reaching out, since every external connection made without care is also an avenue for attack. ("Oh, you want your firmware update little camera? Have I got an unsigned blob for you! You're gonna love this update.")
arca_vorago 11y ago
I am a sysadmin who has been slowly preparing for IPv6 as an eventuality, and have read quite a bit on it, though I admit there is much more to learn. That being said, and knowing that the industry says otherwise, I disagree on the seemingly accepted state that we should get rid of nat for ipv6, for a few key reasons. 1. Yes, browsers and other things will leak your private ip space sometimes, but nat does indeed provide a level of security simply due to complications in routing issues for attackers. Its certainly only a base layer, but it does help. 2. In many situations, we dont want devices on the internet at all, and on private only networks. This is doable with site private, but that brings me to 3. There is a lack of clearly communicated best practices for the industry. To the pont that adoption is almost nill. I recently had a private network setup via ATT, and they said I was the first customer on that network type to request ipv6... 4. Knowing how heavily the NSA was involved in ipv6 (in particular ipv6 ipsec), I have my concerns about the protocol itself, albiet as of yet unverified doubts. The corruption of NIST committees is a very serious thing to me. 5. As the admin, I want to be able to see non encrypted traffic and metdata traversing my exit points. I am having a harder and harder time diagnosing IPv6 because of how often it wants to tunnel to some ipv4 address that I dont trust (read: microsoft). I know that all these points are fairly weak and suspect to criticism, but what gets me is that I dont hear this discussion. Instead I just hear either how ipv6 is god and you should embrace its loving arms, or I see people just sticking their head in the sand who say, I dont like it so Im going to ignore it and hold on to my ipv4 blocks until they make me. Im open to conversations on the topic, and my list is larger but Im on mobile and late for fixing some ipv4 networking issues .

drvdevd 11y ago

This line stood out to me (especially after reading the protocol explanation points from a manufacturer just above): "I’m baffled as to why such a well-known brand as Foscam would enable P2P communications on a product that is primarily used to monitor and secure homes and offices." Well the first answer that came to mind for me was NAT. There's a reason you'll see both botnets and (commodity, cheap) security cameras generating P2P traffic: NAT. NAT+IPV4 is a problem that adds complexity and less usability at the cost of security. It's a clear bolt-on design that consumers have tolerated probably for longer than we should have. I think ISPs have mostly created this problem in being slow to adopt something else. I would also agree that we have a basic usability problem in home routers and pretty much the entire concept of firewalls when it comes to normal users. How do you explain egress traffic filtering to someone who just wants to control their thermostat from their phone and stuff?

Integer 11y ago

The Turris Omnia router project has the Majordomo component, which sounds somewhat similar to what you have in mind.