5 ms·

Hey I have a related question: so with IPFS we all host bits of the internet, and with IPv6 our machines are all directly world-accessible, right? So how do we

by girzel 10y ago

Hey I have a related question: so with IPFS we all host bits of the internet, and with IPv6 our machines are all directly world-accessible, right? So how do we prevent this from turning into a huge pwn-fest? If routers aren't doing NAT and a bit of firewalling along with that, would each machine be completely responsible for its own security?

viraptor 10y ago
> our machines are all directly world-accessible, right No. Nothing much will change probably. Home routers still usually block incoming ipv6 traffic unless configured otherwise.
fulafel 10y ago
Home routers are doing IPv6 firewalling by default, no need for NAT. NAT is strictly inferior to firewalling. (Of course you shouldn't put things on your internet-connected network that need the firewall, just look at it as a porous defense-in-depth element, just like with IPv4)
- tmzt 10y ago
  Does that mean they are assigning random IPv6 addresses to computers on the network for each peer or connection and maintaining a mapping in memory?
  - viraptor 10y ago
    Normal static address is assigned. Whether it comes from the external range or from the link-local range doesn't really matter. You could potentially randomise the source at the exit to prevent identification of your hosts, but you don't have to. For most practical cases just imagine you're getting a big ipv4 range. Whatever you can do with it - you can do the same with ipv6. NAT, no NAT, filtering, static or dynamic assignment.
    - tmzt 10y ago
      That's what I'm asking. IPv6 feels like a regressiin over NATv4 because it can leak which internal device made a request. Is there a standard way to randomize addresses that works with ofd-the-shelf router firmware. Also, are link-local IPv6 leaking MAC addresses?
      - fulafel 10y ago
        Yes, there is a standard since about 10 years ago. It's not dependent on your router firmware, in accordance with IP's end-to-end design philosophy (keep the network dumb, and hosts smart). Here's some links to get you started: https://slaptijack.com/networking/osx-disable-ipv6-address-privacy.html https://slaptijack.com/networking/osx-disable-ipv6-address-p... http://andatche.com/blog/2012/02/disabling-rfc4941-ipv6-privacy-extensions-in-windows/ http://andatche.com/blog/2012/02/disabling-rfc4941-ipv6-priv... As for link-local IPv6 addresses, those aren't even accepted by the socket API[1] in place of normal routable addresses. They're only used for low level things like neighbour discovery (IPv6 equivalent of ARP) and apps that go out of their way to use them. They aren't routable outside your L2 segment. [1] as in: $ telnet fe80::something:something:42 Trying fe80::something:something:42... telnet: Unable to connect to remote host: Invalid argument
pdkl95 10y ago
> with IPv6 our machines are all directly world-accessible world-addressable != world-accessible IPv6 just gives each device a unique address, which is orthogonal to deciding which packets you allow into your local network. In most situations, a stateful firewall (probably on a home router) will still block inbound packets by default, even if they are addressed properly to a valid local IPv6 address. > would each machine be completely responsible for its own security? Every single device is already and will continue to be responsible for its own security. A firewall doesn't remove the need for any security protections on each individual host. Border security adds defense in depth, which is great, but you have to assume an attack can bypass the firewall or originate from another host on the local network. Assuming the firewall will offer sufficient protection and skipping the hard work of properly securing a device is how we get easily compromised trash like the cameras that recently DDoSed Dyn/etc.

by girzel 10y ago

viraptor 10y ago

> our machines are all directly world-accessible, right No. Nothing much will change probably. Home routers still usually block incoming ipv6 traffic unless configured otherwise.

fulafel 10y ago

Home routers are doing IPv6 firewalling by default, no need for NAT. NAT is strictly inferior to firewalling. (Of course you shouldn't put things on your internet-connected network that need the firewall, just look at it as a porous defense-in-depth element, just like with IPv4)

tmzt 10y ago
Does that mean they are assigning random IPv6 addresses to computers on the network for each peer or connection and maintaining a mapping in memory?
- viraptor 10y ago
  Normal static address is assigned. Whether it comes from the external range or from the link-local range doesn't really matter. You could potentially randomise the source at the exit to prevent identification of your hosts, but you don't have to. For most practical cases just imagine you're getting a big ipv4 range. Whatever you can do with it - you can do the same with ipv6. NAT, no NAT, filtering, static or dynamic assignment.
  - tmzt 10y ago
    That's what I'm asking. IPv6 feels like a regressiin over NATv4 because it can leak which internal device made a request. Is there a standard way to randomize addresses that works with ofd-the-shelf router firmware. Also, are link-local IPv6 leaking MAC addresses?
    - fulafel 10y ago
      Yes, there is a standard since about 10 years ago. It's not dependent on your router firmware, in accordance with IP's end-to-end design philosophy (keep the network dumb, and hosts smart). Here's some links to get you started: https://slaptijack.com/networking/osx-disable-ipv6-address-privacy.html https://slaptijack.com/networking/osx-disable-ipv6-address-p... http://andatche.com/blog/2012/02/disabling-rfc4941-ipv6-privacy-extensions-in-windows/ http://andatche.com/blog/2012/02/disabling-rfc4941-ipv6-priv... As for link-local IPv6 addresses, those aren't even accepted by the socket API[1] in place of normal routable addresses. They're only used for low level things like neighbour discovery (IPv6 equivalent of ARP) and apps that go out of their way to use them. They aren't routable outside your L2 segment. [1] as in: $ telnet fe80::something:something:42 Trying fe80::something:something:42... telnet: Unable to connect to remote host: Invalid argument

pdkl95 10y ago

> with IPv6 our machines are all directly world-accessible world-addressable != world-accessible IPv6 just gives each device a unique address, which is orthogonal to deciding which packets you allow into your local network. In most situations, a stateful firewall (probably on a home router) will still block inbound packets by default, even if they are addressed properly to a valid local IPv6 address. > would each machine be completely responsible for its own security? Every single device is already and will continue to be responsible for its own security. A firewall doesn't remove the need for any security protections on each individual host. Border security adds defense in depth, which is great, but you have to assume an attack can bypass the firewall or originate from another host on the local network. Assuming the firewall will offer sufficient protection and skipping the hard work of properly securing a device is how we get easily compromised trash like the cameras that recently DDoSed Dyn/etc.