5 ms·

> no more automatic NAT firewalling NAT != firewall IPv6 doesn't take away your stateful firewall, and NAT isn't providing ANY security. Your private IP addre

by pdkl95 11y ago

> no more automatic NAT firewalling NAT != firewall IPv6 doesn't take away your stateful firewall, and NAT isn't providing ANY security. Your private IP addresses are betrayed all the time by your browser (and TCP option headers). NAT has done an incredible amount of damage to the internet; it prevented the development of true peer-to-peer software and forced everything to centralize. The solution - even for IoT in the few places IoT isn't a surveillance scam - is to remove NAT by using IPv6.

jerf 11y ago
I don't think anyone was claiming what you seem to be arguing against; the point was merely that even the accidental and minimal security brought on by being unable to externally address internal networks is going away with IPv6. It was never "real" security, but it did make it materially harder to breach into someone's network. Of course it's also going away with all the IoT things actively reaching out, since every external connection made without care is also an avenue for attack. ("Oh, you want your firmware update little camera? Have I got an unsigned blob for you! You're gonna love this update.")
arca_vorago 11y ago
I am a sysadmin who has been slowly preparing for IPv6 as an eventuality, and have read quite a bit on it, though I admit there is much more to learn. That being said, and knowing that the industry says otherwise, I disagree on the seemingly accepted state that we should get rid of nat for ipv6, for a few key reasons. 1. Yes, browsers and other things will leak your private ip space sometimes, but nat does indeed provide a level of security simply due to complications in routing issues for attackers. Its certainly only a base layer, but it does help. 2. In many situations, we dont want devices on the internet at all, and on private only networks. This is doable with site private, but that brings me to 3. There is a lack of clearly communicated best practices for the industry. To the pont that adoption is almost nill. I recently had a private network setup via ATT, and they said I was the first customer on that network type to request ipv6... 4. Knowing how heavily the NSA was involved in ipv6 (in particular ipv6 ipsec), I have my concerns about the protocol itself, albiet as of yet unverified doubts. The corruption of NIST committees is a very serious thing to me. 5. As the admin, I want to be able to see non encrypted traffic and metdata traversing my exit points. I am having a harder and harder time diagnosing IPv6 because of how often it wants to tunnel to some ipv4 address that I dont trust (read: microsoft). I know that all these points are fairly weak and suspect to criticism, but what gets me is that I dont hear this discussion. Instead I just hear either how ipv6 is god and you should embrace its loving arms, or I see people just sticking their head in the sand who say, I dont like it so Im going to ignore it and hold on to my ipv4 blocks until they make me. Im open to conversations on the topic, and my list is larger but Im on mobile and late for fixing some ipv4 networking issues .
- simoncion 11y ago
  > 2. In many situations, we dont want devices on the internet at all, and on private only networks. ... Unique Local Addressing (RFC 4193) solves this problem and requires no coordination with outside parties. The network admin gets to choose the scope of the ULA prefix, so you can trivially make your ULA traverse multiple LANs if you wish. (This addresses your first point, too.) > 3. There is a lack of clearly communicated best practices for the industry. Eh? This is the first hit for "IPv6 BCP": https://www.apnic.net/community/ipv6-program/ipv6-bcp https://www.apnic.net/community/ipv6-program/ipv6-bcp > 4. Knowing how heavily the NSA was involved in ipv6 (in particular ipv6 ipsec)... Then -uh- don't use IPSec and block IPSec connection establishment attempts at your border firewalls. Or, because implementation of IPSec is -sadly- not a requirement for IPv6 implementers, use an IPv6 implementation that doesn't implement it. Edit: You are aware that OpenVPN uses TLS for session authentication and IPSec for transport of tunnelled data? :) > 5. As the admin, I want to be able to see non encrypted traffic and metdata traversing my exit points. I am having a harder and harder time diagnosing IPv6 because of how often it wants to tunnel to some ipv4 address that I dont trust (read: microsoft). Are you talking about IPv6 over Teredo tunnels? If you are, then get a packet dump and fire up Wireshark... Teredo doesn't encrypt the traffic that it tunnels. If you aren't, and you're talking about something that's wrapping traffic in TLS, then -well- that doesn't have anything to do with IPv6.
- tremon 11y ago
  4. Knowing how heavily the NSA was involved in [..] ipv6 ipsec, I have my concerns about the protocol itself That's not an issue against IPv6. The entire ipsec standards were backported to IPv4, by people from the same organizations. There is no reason to assume IPSECv4 is any less tainted.
- arca_vorago 11y ago
  I knew I was going to get flak for this, butnit has inspired me to dig into it further and I plan to come back with stronger points... Or perhaps Ill realize I was wrong and change my mind. Thanks for all the responses though, I have some reading and thinking to do.
nly 11y ago
> IPv6 doesn't take away your stateful firewall, and NAT isn't providing ANY security. That's not really true. By its nature, stateful/dynamic NAT, which is what the majority of the consumer world is using, means internal services aren't exposed to the Internet. Short of layer 7 stateful packet inspection, or some other IDSy type thing, a consumer-focused 'firewall' isn't going to do any better... they have to be generic and fuss-free. Just go back to the early 00s or mid-90s to see the ramifications that exposing ports from Windows machines to the Internet had, then tell me NAT hasn't had a positive security impact.
- voltagex_ 11y ago
  What I haven't seen in a home router is proper egress filtering. The use of NAT you're talking about just seems like a really blunt version of that. I think a router with a smartphone based controller could work well - push notifications when your TV wants to connect to the net for the first time or a friend has dropped by and wants to log on to your guest wifi
- voltagex_ 11y ago
  Except that on a consumer grade router, UPNP is probably turned on with no authentication. Anything that wants to get out, will.
  - nly 11y ago
    What's the alternative? Consumers want something they plug in, turn on, and forget about.
    - mindslight 11y ago
      The alternative is an easy-to-use router summary page that list every network device and controls what it can contact (eg local-only, manufacturer, wide Internet). Consumers want things that "just work" because they haven't been shown that they can have control. It's really a matter of selling the value proposition of such administration, and making these devices' communications patterns legible to the average consumer.
jameshart 11y ago
"NAT isn't providing ANY security" - except for the fact that there's no way for a host outside your NAT to initiate contact with any host inside your NAT. That sounds quite a lot like security. As for "your private addresses are betrayed all the time by your browser", I'm not sure what an internet host is going to do after discovering my IP address is 192.168.something that they couldn't already do.
- lmm 11y ago
  > except for the fact that there's no way for a host outside your NAT to initiate contact with any host inside your NAT Not true. Someone on the Internet can mark your router's external IP as the gateway for your internal network range and send packets to your internal devices fine. (In practice most NAT devices also do firewalling to prevent this, but the two functions are independent)
  - jameshart 11y ago
    That's a characterization of a network gateway, not a NAT - there's no reason for a NAT router to accept and gateway packets addressed to its internal network since there's no reason for external hosts to be using those addresses in the first place. I would be astonished to find a NAT which also enabled routing to its private address space for external-origin packets.
    - c22 11y ago
      You might be astonished to find such a NAT gateway without the functionality you describe, but what you're describing is a firewall.
      - Dylan16807 11y ago
        I would not describe having two different routing domains as a firewall. It's not a fence set up by a firewall that only lets correct packets through. It's a gaping chasm that only the NAT process crosses; packets are transformed as they cross and only some packets are possible to transform.
deleted 11y ago
[deleted]

by pdkl95 11y ago

jerf 11y ago

I don't think anyone was claiming what you seem to be arguing against; the point was merely that even the accidental and minimal security brought on by being unable to externally address internal networks is going away with IPv6. It was never "real" security, but it did make it materially harder to breach into someone's network. Of course it's also going away with all the IoT things actively reaching out, since every external connection made without care is also an avenue for attack. ("Oh, you want your firmware update little camera? Have I got an unsigned blob for you! You're gonna love this update.")

arca_vorago 11y ago

I am a sysadmin who has been slowly preparing for IPv6 as an eventuality, and have read quite a bit on it, though I admit there is much more to learn. That being said, and knowing that the industry says otherwise, I disagree on the seemingly accepted state that we should get rid of nat for ipv6, for a few key reasons. 1. Yes, browsers and other things will leak your private ip space sometimes, but nat does indeed provide a level of security simply due to complications in routing issues for attackers. Its certainly only a base layer, but it does help. 2. In many situations, we dont want devices on the internet at all, and on private only networks. This is doable with site private, but that brings me to 3. There is a lack of clearly communicated best practices for the industry. To the pont that adoption is almost nill. I recently had a private network setup via ATT, and they said I was the first customer on that network type to request ipv6... 4. Knowing how heavily the NSA was involved in ipv6 (in particular ipv6 ipsec), I have my concerns about the protocol itself, albiet as of yet unverified doubts. The corruption of NIST committees is a very serious thing to me. 5. As the admin, I want to be able to see non encrypted traffic and metdata traversing my exit points. I am having a harder and harder time diagnosing IPv6 because of how often it wants to tunnel to some ipv4 address that I dont trust (read: microsoft). I know that all these points are fairly weak and suspect to criticism, but what gets me is that I dont hear this discussion. Instead I just hear either how ipv6 is god and you should embrace its loving arms, or I see people just sticking their head in the sand who say, I dont like it so Im going to ignore it and hold on to my ipv4 blocks until they make me. Im open to conversations on the topic, and my list is larger but Im on mobile and late for fixing some ipv4 networking issues .

simoncion 11y ago
> 2. In many situations, we dont want devices on the internet at all, and on private only networks. ... Unique Local Addressing (RFC 4193) solves this problem and requires no coordination with outside parties. The network admin gets to choose the scope of the ULA prefix, so you can trivially make your ULA traverse multiple LANs if you wish. (This addresses your first point, too.) > 3. There is a lack of clearly communicated best practices for the industry. Eh? This is the first hit for "IPv6 BCP": https://www.apnic.net/community/ipv6-program/ipv6-bcp https://www.apnic.net/community/ipv6-program/ipv6-bcp > 4. Knowing how heavily the NSA was involved in ipv6 (in particular ipv6 ipsec)... Then -uh- don't use IPSec and block IPSec connection establishment attempts at your border firewalls. Or, because implementation of IPSec is -sadly- not a requirement for IPv6 implementers, use an IPv6 implementation that doesn't implement it. Edit: You are aware that OpenVPN uses TLS for session authentication and IPSec for transport of tunnelled data? :) > 5. As the admin, I want to be able to see non encrypted traffic and metdata traversing my exit points. I am having a harder and harder time diagnosing IPv6 because of how often it wants to tunnel to some ipv4 address that I dont trust (read: microsoft). Are you talking about IPv6 over Teredo tunnels? If you are, then get a packet dump and fire up Wireshark... Teredo doesn't encrypt the traffic that it tunnels. If you aren't, and you're talking about something that's wrapping traffic in TLS, then -well- that doesn't have anything to do with IPv6.
tremon 11y ago
4. Knowing how heavily the NSA was involved in [..] ipv6 ipsec, I have my concerns about the protocol itself That's not an issue against IPv6. The entire ipsec standards were backported to IPv4, by people from the same organizations. There is no reason to assume IPSECv4 is any less tainted.
arca_vorago 11y ago
I knew I was going to get flak for this, butnit has inspired me to dig into it further and I plan to come back with stronger points... Or perhaps Ill realize I was wrong and change my mind. Thanks for all the responses though, I have some reading and thinking to do.

nly 11y ago

> IPv6 doesn't take away your stateful firewall, and NAT isn't providing ANY security. That's not really true. By its nature, stateful/dynamic NAT, which is what the majority of the consumer world is using, means internal services aren't exposed to the Internet. Short of layer 7 stateful packet inspection, or some other IDSy type thing, a consumer-focused 'firewall' isn't going to do any better... they have to be generic and fuss-free. Just go back to the early 00s or mid-90s to see the ramifications that exposing ports from Windows machines to the Internet had, then tell me NAT hasn't had a positive security impact.

voltagex_ 11y ago
What I haven't seen in a home router is proper egress filtering. The use of NAT you're talking about just seems like a really blunt version of that. I think a router with a smartphone based controller could work well - push notifications when your TV wants to connect to the net for the first time or a friend has dropped by and wants to log on to your guest wifi
voltagex_ 11y ago
Except that on a consumer grade router, UPNP is probably turned on with no authentication. Anything that wants to get out, will.
- nly 11y ago
  What's the alternative? Consumers want something they plug in, turn on, and forget about.
  - mindslight 11y ago
    The alternative is an easy-to-use router summary page that list every network device and controls what it can contact (eg local-only, manufacturer, wide Internet). Consumers want things that "just work" because they haven't been shown that they can have control. It's really a matter of selling the value proposition of such administration, and making these devices' communications patterns legible to the average consumer.

jameshart 11y ago

"NAT isn't providing ANY security" - except for the fact that there's no way for a host outside your NAT to initiate contact with any host inside your NAT. That sounds quite a lot like security. As for "your private addresses are betrayed all the time by your browser", I'm not sure what an internet host is going to do after discovering my IP address is 192.168.something that they couldn't already do.

lmm 11y ago
> except for the fact that there's no way for a host outside your NAT to initiate contact with any host inside your NAT Not true. Someone on the Internet can mark your router's external IP as the gateway for your internal network range and send packets to your internal devices fine. (In practice most NAT devices also do firewalling to prevent this, but the two functions are independent)
- jameshart 11y ago
  That's a characterization of a network gateway, not a NAT - there's no reason for a NAT router to accept and gateway packets addressed to its internal network since there's no reason for external hosts to be using those addresses in the first place. I would be astonished to find a NAT which also enabled routing to its private address space for external-origin packets.
  - c22 11y ago
    You might be astonished to find such a NAT gateway without the functionality you describe, but what you're describing is a firewall.
    - Dylan16807 11y ago
      I would not describe having two different routing domains as a firewall. It's not a fence set up by a firewall that only lets correct packets through. It's a gaping chasm that only the NAT process crosses; packets are transformed as they cross and only some packets are possible to transform.

deleted 11y ago

[deleted]