5 ms·

There was a time before NAT, where every machine had a publicly routable IP, and things were good. Any machine could talk directly to any port on any other mach

There was a time before NAT, where every machine had a publicly routable IP, and things were good. Any machine could talk directly to any port on any other machine (firewall willing). Until one day, IP exhaustion attacked. Thankfully NAT doesn't exist in IPv6, because 2^128 addresses should be enough for everybody.

cortesoft 9y ago
Everything having a publicly routable IP isn't an automatic good thing.
- throwaway2048 9y ago
  NAT does nothing meaningful securitywise that a firewall cannot achive, and causes a lot of stupid problems.
  - dfox 9y ago
    Particularly notable example of this is that the three ip6tables rules needed to get NAT-like everything out nothing out behavior are exactly the same three rules that you need in v4 iptables for the NAT to have any security effect at all.
    - pas 9y ago
      Care to share them? And how is NAT not added security by default? By default it drops everything incoming, no? (I mean, theoretically NAT doesn't, but [almost] every practical implementation situations means that there's no possible automatic internal-external address correspondence, otherwise you wouldn't need the NAT.)
      - oasisbob 9y ago
        I think the most productive way to look at it that for NAT/NAPT/cone NAT to work, a necessary prerequisite is a default-deny inbound firewall policy and stateful connection tracking. Once you have that, layering on NAT is possible. But the security implications were already addressed before you get to that point.
      - zAy0LfpBZLC8mAC 9y ago
        A NAT doesn't drop anything. A NAT translates. A firewall drops. If you only have a NAT, your ISP (or anyone who has compromised their router, or possibly simply your neighbour when ISPs occasionally fail to isolate their customers on layer 2) still can send you packets addressed directly to your "internal" addresses. The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise. NAT and "internal addresses" is as much a security mechanism as not telling anyone that there is a room called "living room" in your house. If you want to prevent strangers from getting into your living room, you don't use internal names for your rooms, you install a lock on the door.
        pas 9y ago
        By default a NAT is unconfigured, so it doesn't know what to translate into what. The usual practical deployment consists of a dynamic outgoing NAT setup and UPnP. So outgoing TCP/UDP/etc protocols are snooped and the incoming packets are translated accordingly. (Hence the UDP NAT hole punching technique.) This setup works well for SoHo sites. In this case without knowing my egress traffic, any incoming packet will be dropped by the NAT middlebox/facility/software/device/module/thing. So NATs do drop. And nice ones emit ICMP or TCP RST too. > The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise. Yes, indeed. That's a different threat model though. And I agree that hosts should have a default deny ingress policy. Yet NATs do work wonderfully for SoHo networks. And of course a stateful firewall is just as easy to fool (circumvent) with a back-connecting connection as a NAT. And a NAT as described above or a stateful firewall that enables local network functions such as CIFS/SMB were just as vulnerable to the usual Blaster-type worms/malware. Again, of course, usually things go hand in hand. Firewalls usually have SNAT/DNAT capabilities, and SoHo shitboxes come with too much of every kind of NAT/firewall thingies already. And, I know the misery of interconnecting two internal networks both using the same 192.168.0.0/24 or whatever prefix, so I can't wait to get rid of this and move to proper v6. But the fact of life is that the typical NAT setup was very convenient for ticking the local network ingress security checkbox for ISPs for years (decades).
        zAy0LfpBZLC8mAC 9y ago
      - dfox 9y ago
        Sure -A FORWARDING -i internal -o external -j ACCEPT -A FORWARDING -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWADING -j REJECT Last one can be done as policy on FORWARDING chain (ie. -P instead of -A), but in this way it is more explicit.
  - smsm42 9y ago
    NAT of course is not the best solution ever, but vast majority of currently used network nodes do not need publicly routed IPs in a limited global space. If anything, many of them are much better without one. Yes, I know, firewalls. But why not just avoid the issue by not having publicly accessible address for non-public systems in the first place?
    - oasisbob 9y ago
      Because NAT is an abominable hack with significant technical and administrative overhead. My home is not intended to be a public space. But, it has a unique address, just like any other bar or restaurant in the area. Being able to locate it with a unique identifier is valuable, even if I don't intend for my living room to be publicly accessible.
      - smsm42 9y ago
        > Because NAT is an abominable hack with significant technical and administrative overhead. Agreed. But you can use private networks without NAT. In fact, 99% of traffic in the private network doesn't need NAT. Only outside traffic does, and only that which can't use proxies etc. - which is pretty small amount of overall traffic, I think.
        throwaway2048 9y ago
        attempting to proxy traffic like that is an even more massive mess, you have a solution in search of a problem here.
  - Florin_Andrei 9y ago
    > NAT does nothing meaningful securitywise that a firewall cannot achive One good thing about NAT is even if you screw up the firewall config, such as configure everything in "allow all" mode, your internal network is still secure, because private IPs are not routable at the Internet level. > and causes a lot of stupid problems. That is true.
- zaarn 9y ago
  Routable != Reachable, which is obvious once you actually setup a firewall once. My IPv6 /48 is entirely routable. The reachable portions are some ports in the list of popular protocols like SSH, HTTPS and similar. The good part is that the entire /48 is reachable from within and simplifies OpenVPN routing a lot compared to IPv4, which requires a bit of outbound NAT hackery so it doesn't have to traverse the firewall three times (OpenVPN->WAN->LAN instead of OpenVPN->LAN)
d215 9y ago
I don't know if you're being ironic, but NAT64[0] is (sort of unfortunately) an actual existing technology and in use as well. [0] https://en.wikipedia.org/wiki/NAT64 https://en.wikipedia.org/wiki/NAT64
- plq 9y ago
  You need NAT whenever you can't change your peers' routing table, for whatever reason. It's used extensively in IPv4 world for LAN=>WAN connectivity because your only peer (your ISP) won't agree to send all traffic for 192.168.0.0/24 to your home. Its most popular use case disappearing doesn't make it any less useful for the narrow set of circumstances when it's basically your only option.
- zaarn 9y ago
  NAT64 is NAT in reverse, essentially. Your internal, IPv6 network can use it to contact an IPv4 host by embedding the target address. This is arguably better than current NAT44. The NAT64 only needs to track which ports and IPs are used on the IPv4 side which should become easier as more hosts don't require an IPv4 anymore. It's a last-stage transitional method IMO, when most but not all of the internet is IPv6.
tonysdg 9y ago
Technical arguments aside, props for the Avatar: The Last Airbender reference.

cortesoft 9y ago

Everything having a publicly routable IP isn't an automatic good thing.

throwaway2048 9y ago
NAT does nothing meaningful securitywise that a firewall cannot achive, and causes a lot of stupid problems.
- dfox 9y ago
  Particularly notable example of this is that the three ip6tables rules needed to get NAT-like everything out nothing out behavior are exactly the same three rules that you need in v4 iptables for the NAT to have any security effect at all.
  - pas 9y ago
    Care to share them? And how is NAT not added security by default? By default it drops everything incoming, no? (I mean, theoretically NAT doesn't, but [almost] every practical implementation situations means that there's no possible automatic internal-external address correspondence, otherwise you wouldn't need the NAT.)
    - oasisbob 9y ago
      I think the most productive way to look at it that for NAT/NAPT/cone NAT to work, a necessary prerequisite is a default-deny inbound firewall policy and stateful connection tracking. Once you have that, layering on NAT is possible. But the security implications were already addressed before you get to that point.
    - zAy0LfpBZLC8mAC 9y ago
      A NAT doesn't drop anything. A NAT translates. A firewall drops. If you only have a NAT, your ISP (or anyone who has compromised their router, or possibly simply your neighbour when ISPs occasionally fail to isolate their customers on layer 2) still can send you packets addressed directly to your "internal" addresses. The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise. NAT and "internal addresses" is as much a security mechanism as not telling anyone that there is a room called "living room" in your house. If you want to prevent strangers from getting into your living room, you don't use internal names for your rooms, you install a lock on the door.
      - pas 9y ago
        By default a NAT is unconfigured, so it doesn't know what to translate into what. The usual practical deployment consists of a dynamic outgoing NAT setup and UPnP. So outgoing TCP/UDP/etc protocols are snooped and the incoming packets are translated accordingly. (Hence the UDP NAT hole punching technique.) This setup works well for SoHo sites. In this case without knowing my egress traffic, any incoming packet will be dropped by the NAT middlebox/facility/software/device/module/thing. So NATs do drop. And nice ones emit ICMP or TCP RST too. > The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise. Yes, indeed. That's a different threat model though. And I agree that hosts should have a default deny ingress policy. Yet NATs do work wonderfully for SoHo networks. And of course a stateful firewall is just as easy to fool (circumvent) with a back-connecting connection as a NAT. And a NAT as described above or a stateful firewall that enables local network functions such as CIFS/SMB were just as vulnerable to the usual Blaster-type worms/malware. Again, of course, usually things go hand in hand. Firewalls usually have SNAT/DNAT capabilities, and SoHo shitboxes come with too much of every kind of NAT/firewall thingies already. And, I know the misery of interconnecting two internal networks both using the same 192.168.0.0/24 or whatever prefix, so I can't wait to get rid of this and move to proper v6. But the fact of life is that the typical NAT setup was very convenient for ticking the local network ingress security checkbox for ISPs for years (decades).
        zAy0LfpBZLC8mAC 9y ago
    - dfox 9y ago
      Sure -A FORWARDING -i internal -o external -j ACCEPT -A FORWARDING -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWADING -j REJECT Last one can be done as policy on FORWARDING chain (ie. -P instead of -A), but in this way it is more explicit.
- smsm42 9y ago
  NAT of course is not the best solution ever, but vast majority of currently used network nodes do not need publicly routed IPs in a limited global space. If anything, many of them are much better without one. Yes, I know, firewalls. But why not just avoid the issue by not having publicly accessible address for non-public systems in the first place?
  - oasisbob 9y ago
    Because NAT is an abominable hack with significant technical and administrative overhead. My home is not intended to be a public space. But, it has a unique address, just like any other bar or restaurant in the area. Being able to locate it with a unique identifier is valuable, even if I don't intend for my living room to be publicly accessible.
    - smsm42 9y ago
      > Because NAT is an abominable hack with significant technical and administrative overhead. Agreed. But you can use private networks without NAT. In fact, 99% of traffic in the private network doesn't need NAT. Only outside traffic does, and only that which can't use proxies etc. - which is pretty small amount of overall traffic, I think.
      - throwaway2048 9y ago
        attempting to proxy traffic like that is an even more massive mess, you have a solution in search of a problem here.
- Florin_Andrei 9y ago
  > NAT does nothing meaningful securitywise that a firewall cannot achive One good thing about NAT is even if you screw up the firewall config, such as configure everything in "allow all" mode, your internal network is still secure, because private IPs are not routable at the Internet level. > and causes a lot of stupid problems. That is true.
zaarn 9y ago
Routable != Reachable, which is obvious once you actually setup a firewall once. My IPv6 /48 is entirely routable. The reachable portions are some ports in the list of popular protocols like SSH, HTTPS and similar. The good part is that the entire /48 is reachable from within and simplifies OpenVPN routing a lot compared to IPv4, which requires a bit of outbound NAT hackery so it doesn't have to traverse the firewall three times (OpenVPN->WAN->LAN instead of OpenVPN->LAN)

d215 9y ago

I don't know if you're being ironic, but NAT64[0] is (sort of unfortunately) an actual existing technology and in use as well. [0] https://en.wikipedia.org/wiki/NAT64 https://en.wikipedia.org/wiki/NAT64

plq 9y ago
You need NAT whenever you can't change your peers' routing table, for whatever reason. It's used extensively in IPv4 world for LAN=>WAN connectivity because your only peer (your ISP) won't agree to send all traffic for 192.168.0.0/24 to your home. Its most popular use case disappearing doesn't make it any less useful for the narrow set of circumstances when it's basically your only option.
zaarn 9y ago
NAT64 is NAT in reverse, essentially. Your internal, IPv6 network can use it to contact an IPv4 host by embedding the target address. This is arguably better than current NAT44. The NAT64 only needs to track which ports and IPs are used on the IPv4 side which should become easier as more hosts don't require an IPv4 anymore. It's a last-stage transitional method IMO, when most but not all of the internet is IPv6.

tonysdg 9y ago

Technical arguments aside, props for the Avatar: The Last Airbender reference.