5 ms·

Imagine our current issues with poorly secured devices connected to the internet (with default creds, for example), and then compare that with all of the embedd

Imagine our current issues with poorly secured devices connected to the internet (with default creds, for example), and then compare that with all of the embedded devices secured behind a NAT. It's an important security layer.

burnte 9y ago
I completely agree. Without the external ability to directly contact nodes on the inside, an attacker has to either compromise the network hardware, or somehow deliver a software payload inside the network. It's not a silver bullet, but it does have a strong role protection.
yorwba 9y ago
You don't need a NAT for that, it's a job for a firewall. You could have each poorly secured device with their own IP, but still not reachable from the outside.
- kikoreis 9y ago
  Except NAT is dead simple, and requires basically zero configuration of the CPE from the end-user perspective. Yeah, it complicates (though seldom completely breaks) a host of important applications, but it's hard to think you could replace it with a firewall with an off the shelf configuration and have it work any better.
  - ktRolster 9y ago
    It's not dead simple, it just seems that way because the router already comes configured for it. If you had a router already configured with a default firewall, that would seem dead simple, too.
    - hueving 9y ago
      If it comes pre-configured with the same behavior as NAT (no unsolicited ingress), what does that really solve over using NAT?
      - Avernar 9y ago
        When you get multiple devices that require the same inbound ports (game consoles are a good example) you can open the same port for each device.
  - Johnny555 9y ago
    And NAT is required for networks that are behind too few IPv4 IP's. With IPv6, users can put their devices out on the wild-west open internet without needing any kind of NAT or firewall for protection. The large number of open access points in the wild points out the danger here -- most consumers know nothing about network security and will set up their home network with dozens of IoT devices all on the public internet behind their ISP's non-firewalling router because they can, and everything works.
    - mmagin 9y ago
      It is unlikely that ISPs are going to provide CPE that doesn't firewall incoming connections by default, even if it issues devices on the LAN real public IPv6 addresses.
      - Johnny555 9y ago
        About as unlikely as ISP's providing Wifi routers that default to open with no WPA password as used to be common? They'll do whatever makes support easiest until they are forced to do otherwise by regulation or bad press.
        mmagin 9y ago
        The first (2010-vintage Apple Airport Extreme) and second (2017-vintage TP-Link something something) I'd done IPv6 with behaved this way by default if you enabled IPv6. I don't see why Comcast or AT&T would likely do worse. Sure they could, but this is not the likely scenario.
        Johnny555 9y ago
        Then I imagine you don't have much experience with Comcast or AT&T if you don't see why they'd do worse than Apple.
  - alethiophile 9y ago
    The default configuration for many firewalls (software, at least) approximates "allow all outgoing connections but no incoming". Assuming all your connections pass through the same box (which they usually will, for a home network), there's no reason why it shouldn't have such a firewall even if it's otherwise a router that doesn't do NAT. Denying the ISPs trivial inspection into the structure of home networks, OTOH, is a major benefit and maybe a concrete downside to adopting IPv6 locally.
- lend000 9y ago
  It is the firewall. How many typical consumers have a dedicated firewall?
  - slrz 9y ago
    All those consumer gateway boxen that do NAT can also do firewalling. The ones supporting IPv6 even tend to present the same (or similar) UI for "create firewall allow rule" and "create static port/host mapping".
    - lend000 9y ago
      I agree -- but they don't. Let's imagine that the Internet started with IPv6 and NAT never became the standard. How many legacy routers would there be floating around with no built-in firewall? How would that affect the security landscape? Everyone seems to misunderstand that I am not advocating for what should be/should have been, but instead providing the benefits of how things played out given the reality of the world.
mnarayan01 9y ago
This view always seems to get crucified in these discussions. While it is certainly true that a NAT is neither necessary nor sufficient for the kind of protection provided by a properly configured firewall, it's way better than the realistic alternative in 90+% of the cases: "Literally nothing". Just think how many actual businesses got nailed by e.g. Mongo's former default of listening on all interfaces.
- slrz 9y ago
  Most IPv6-capable home gateway boxen seem to do the right thing automatically here.
occultist_throw 9y ago
Then I would encourage you to try this tool (0) and then respond with your updated opinions. Abstract: pwnat, pronounced "poe-nat", is a tool that allows any number of clients behind NATs to communicate with a server behind a separate NAT with *no* port forwarding *no* DMZ setup, and *no* 3rd party involvement. The server does not need to know anything about the clients trying to connect. (0) https://samy.pl/pwnat/ https://samy.pl/pwnat/
- alethiophile 9y ago
  That is an awesome tool, but it requires a cooperating server inside your NAT; for security-breaching purposes, if you've got code execution on a machine inside the firewall, you've already won (against the firewall, anyway).
  - occultist_throw 9y ago
    Well, indeed. But Im thinking that it could be done with a webapp and Websockets. In other words, get sent to a domain that initiates the knock sequence. Other machine in waiting responds, and NAT traversal takes over, to any machines inside NAT. The only real question is how much code is actually required to start this.
    - alethiophile 9y ago
      Web code is only allowed to send TCP packets (websockets go on port 80 by default, just like HTTP). It also doesn't allow crafting special packets. pwnat's method relies on being able to send ICMP and UDP, which the browser won't.
      - occultist_throw 9y ago
        I didn't thank you for your response. I looked further in, and was mistaken - I thought that it allowed a bit more as in TCP and UDP. I was wrong. So yes, it looks like some sort of further in-depth hackery would be required, or planting some sort of SBC in the building on the network. It's quite a bit more infeasible than I had initially thought.

burnte 9y ago

I completely agree. Without the external ability to directly contact nodes on the inside, an attacker has to either compromise the network hardware, or somehow deliver a software payload inside the network. It's not a silver bullet, but it does have a strong role protection.

yorwba 9y ago

You don't need a NAT for that, it's a job for a firewall. You could have each poorly secured device with their own IP, but still not reachable from the outside.

kikoreis 9y ago
Except NAT is dead simple, and requires basically zero configuration of the CPE from the end-user perspective. Yeah, it complicates (though seldom completely breaks) a host of important applications, but it's hard to think you could replace it with a firewall with an off the shelf configuration and have it work any better.
- ktRolster 9y ago
  It's not dead simple, it just seems that way because the router already comes configured for it. If you had a router already configured with a default firewall, that would seem dead simple, too.
  - hueving 9y ago
    If it comes pre-configured with the same behavior as NAT (no unsolicited ingress), what does that really solve over using NAT?
    - Avernar 9y ago
      When you get multiple devices that require the same inbound ports (game consoles are a good example) you can open the same port for each device.
- Johnny555 9y ago
  And NAT is required for networks that are behind too few IPv4 IP's. With IPv6, users can put their devices out on the wild-west open internet without needing any kind of NAT or firewall for protection. The large number of open access points in the wild points out the danger here -- most consumers know nothing about network security and will set up their home network with dozens of IoT devices all on the public internet behind their ISP's non-firewalling router because they can, and everything works.
  - mmagin 9y ago
    It is unlikely that ISPs are going to provide CPE that doesn't firewall incoming connections by default, even if it issues devices on the LAN real public IPv6 addresses.
    - Johnny555 9y ago
      About as unlikely as ISP's providing Wifi routers that default to open with no WPA password as used to be common? They'll do whatever makes support easiest until they are forced to do otherwise by regulation or bad press.
      - mmagin 9y ago
        The first (2010-vintage Apple Airport Extreme) and second (2017-vintage TP-Link something something) I'd done IPv6 with behaved this way by default if you enabled IPv6. I don't see why Comcast or AT&T would likely do worse. Sure they could, but this is not the likely scenario.
        Johnny555 9y ago
        Then I imagine you don't have much experience with Comcast or AT&T if you don't see why they'd do worse than Apple.
- alethiophile 9y ago
  The default configuration for many firewalls (software, at least) approximates "allow all outgoing connections but no incoming". Assuming all your connections pass through the same box (which they usually will, for a home network), there's no reason why it shouldn't have such a firewall even if it's otherwise a router that doesn't do NAT. Denying the ISPs trivial inspection into the structure of home networks, OTOH, is a major benefit and maybe a concrete downside to adopting IPv6 locally.
lend000 9y ago
It is the firewall. How many typical consumers have a dedicated firewall?
- slrz 9y ago
  All those consumer gateway boxen that do NAT can also do firewalling. The ones supporting IPv6 even tend to present the same (or similar) UI for "create firewall allow rule" and "create static port/host mapping".
  - lend000 9y ago
    I agree -- but they don't. Let's imagine that the Internet started with IPv6 and NAT never became the standard. How many legacy routers would there be floating around with no built-in firewall? How would that affect the security landscape? Everyone seems to misunderstand that I am not advocating for what should be/should have been, but instead providing the benefits of how things played out given the reality of the world.

mnarayan01 9y ago

This view always seems to get crucified in these discussions. While it is certainly true that a NAT is neither necessary nor sufficient for the kind of protection provided by a properly configured firewall, it's way better than the realistic alternative in 90+% of the cases: "Literally nothing". Just think how many actual businesses got nailed by e.g. Mongo's former default of listening on all interfaces.

slrz 9y ago
Most IPv6-capable home gateway boxen seem to do the right thing automatically here.

occultist_throw 9y ago

Then I would encourage you to try this tool (0) and then respond with your updated opinions. Abstract: pwnat, pronounced "poe-nat", is a tool that allows any number of clients behind NATs to communicate with a server behind a separate NAT with *no* port forwarding *no* DMZ setup, and *no* 3rd party involvement. The server does not need to know anything about the clients trying to connect. (0) https://samy.pl/pwnat/ https://samy.pl/pwnat/

alethiophile 9y ago
That is an awesome tool, but it requires a cooperating server inside your NAT; for security-breaching purposes, if you've got code execution on a machine inside the firewall, you've already won (against the firewall, anyway).
- occultist_throw 9y ago
  Well, indeed. But Im thinking that it could be done with a webapp and Websockets. In other words, get sent to a domain that initiates the knock sequence. Other machine in waiting responds, and NAT traversal takes over, to any machines inside NAT. The only real question is how much code is actually required to start this.
  - alethiophile 9y ago
    Web code is only allowed to send TCP packets (websockets go on port 80 by default, just like HTTP). It also doesn't allow crafting special packets. pwnat's method relies on being able to send ICMP and UDP, which the browser won't.
    - occultist_throw 9y ago
      I didn't thank you for your response. I looked further in, and was mistaken - I thought that it allowed a bit more as in TCP and UDP. I was wrong. So yes, it looks like some sort of further in-depth hackery would be required, or planting some sort of SBC in the building on the network. It's quite a bit more infeasible than I had initially thought.