4 ms·

IPv6 (now you really need a real, properly configured firewall instead of NATting and praying)

by dom0 9y ago

oh_sigh 9y ago
Of course you can NAT with ipv6. There is a private address space in ipv6(fc00::/7) like there is in ipv4(192.168.0.0/16,...)
- mjevans 9y ago
  There is additionally the link-local set of IPv6 addresses fe80::/64
- croon 9y ago
  I don't think the issue was if you can, but if anyone would when they don't have to for lack of address space.
- sp332 9y ago
  The IETF never really liked NAT, and the IPv6 spec doesn't really support it. http://www.ipv6.com/articles/nat/NAT-Pros-and-Cons.htm http://www.ipv6.com/articles/nat/NAT-Pros-and-Cons.htm
easytiger 9y ago
I'm convinced there will be a lot of relearning everythign we already know with IPv6
laumars 9y ago
While your point is true in the broader sense, it is worth noting that these were IPv4 addresses.
deleted 9y ago
[deleted]
lima 9y ago
Much harder to do network scans with IPv6 though.
lmm 9y ago
NAT and pray still leaves you screwed under IPv4 these days - attackers know how to bypass NAT-without-filtering. (I don't think firewalls are a good solution in general, but I would agree that they might be the least-bad way to handle crappy embedded/IOT-type devices).
- ajross 9y ago
  The reflector attack in question cannot bypass a NAT setup in any meaningful way. Yes, there are tricks that make some protocols NAT-inspectable. It's not perfect. But as a default behavior it's proven surprisingly strong. Typical IPv6 deployments are significantly less secure, sadly.
  - lmm 9y ago
    On the other hand the main reason we have UPnP at all is to deal with the need to work around NAT - maybe these vulnerable devices simply wouldn't be running a UPnP stack at all under IPv6.
api 9y ago
Even better: fix your damn security. The security standard we use for everything in our network is: if it would be insecure if hooked directly up to the Internet, it is broken. Firewalls encourage poor security by creating a false sense of security and leading to developer and system administrator complacency. IMHO it would be better to get rid of them and let the insecure junk burn. To prevent DDOS exploitation the best would be to have grey hats take the latest exploits and mass-brick exploitable devices. We'd learn our lesson and then we'd have secure devices.

IPv6 (now you really need a real, properly configured firewall instead of NATting and praying)

by dom0 9y ago

IPv6 (now you really need a real, properly configured firewall instead of NATting and praying)

Of course you can NAT with ipv6. There is a private address space in ipv6(fc00::/7) like there is in ipv4(192.168.0.0/16,...)

mjevans 9y ago
There is additionally the link-local set of IPv6 addresses fe80::/64
croon 9y ago
I don't think the issue was if you can, but if anyone would when they don't have to for lack of address space.
sp332 9y ago
The IETF never really liked NAT, and the IPv6 spec doesn't really support it. http://www.ipv6.com/articles/nat/NAT-Pros-and-Cons.htm http://www.ipv6.com/articles/nat/NAT-Pros-and-Cons.htm

easytiger 9y ago

I'm convinced there will be a lot of relearning everythign we already know with IPv6

laumars 9y ago

While your point is true in the broader sense, it is worth noting that these were IPv4 addresses.

deleted 9y ago

[deleted]

lima 9y ago

Much harder to do network scans with IPv6 though.

lmm 9y ago

NAT and pray still leaves you screwed under IPv4 these days - attackers know how to bypass NAT-without-filtering. (I don't think firewalls are a good solution in general, but I would agree that they might be the least-bad way to handle crappy embedded/IOT-type devices).

ajross 9y ago
The reflector attack in question cannot bypass a NAT setup in any meaningful way. Yes, there are tricks that make some protocols NAT-inspectable. It's not perfect. But as a default behavior it's proven surprisingly strong. Typical IPv6 deployments are significantly less secure, sadly.
- lmm 9y ago
  On the other hand the main reason we have UPnP at all is to deal with the need to work around NAT - maybe these vulnerable devices simply wouldn't be running a UPnP stack at all under IPv6.

api 9y ago

Even better: fix your damn security. The security standard we use for everything in our network is: if it would be insecure if hooked directly up to the Internet, it is broken. Firewalls encourage poor security by creating a false sense of security and leading to developer and system administrator complacency. IMHO it would be better to get rid of them and let the insecure junk burn. To prevent DDOS exploitation the best would be to have grey hats take the latest exploits and mass-brick exploitable devices. We'd learn our lesson and then we'd have secure devices.