4 ms·

Of course it is the NAT. It always was the NAT. NAT is the easy thing, nearly effortless, that dramatically improves network security — there is a "bastion host

Of course it is the NAT. It always was the NAT. NAT is the easy thing, nearly effortless, that dramatically improves network security — there is a "bastion host" (router) and private network computers, almost impossible to be accessed from the outside without breaking the bastion host first. This is good security, and with NAT, everybody was getting it for free. With IPv6, it doesn't work this way, everybody needs to know how to set up proper packet filtering, ACLs, and whatsnot. It is really easy to misconfigure the network, especially in the unfamiliar environment which is IPv6. Huge loss for security. Of course IPv6 adoption suffers.

okket 8y ago
Actually, I don't know one CPE IPv6 router that ships _without_ blocking the home network from the outside by default.
- atemerev 8y ago
  It is easy enough with home routers (packet filtering is hidden from the user, and no need to configure it). It is much harder for corporate networks where you need to configure everything yourself and maintain ACLs. No more easy default option.
  - kazen44 8y ago
    what? this makes no sense? For a corporate network, their requirements usually result in them having to manage their own ACL's anyways. It does not matter if that is IPV4 or IPV6. There is no "easy default" for corporate networks because they don't have easy requirements. On a enterprise grade firewall/router, the end rule of an ACL is a DEFAULT DENY ANY ANY, on both ipv4 and ipv6. (this assumes you actually enable ACL's. But that depends on your platform).
    - atemerev 8y ago
      You a talking about large corporations. I am talking about small and medium business where networks are abused and misconfigured in every way, and the only thing holding them relatively undamaged is the NAT. There are millions of them.
  - deleted 8y ago
    [deleted]
  - aequitas 8y ago
    Don't forget people running some kind of container environment on their VPS and wanting internet for their containers. With IPv4 you at least need masquerading with IPv6 you're exposing all your microservers at once unless you think about fiewalling.
skrause 8y ago
It's actually just as easy with IPv6. All you need is a stateful firewall which allows all outgoing connections and only allows incoming packets for already established connections. This was the default setting on my home router and behaves exactly like a NAT.
- atemerev 8y ago
  It is easy enough, but it is fragile. If NAT is misconfigured, your network stops working. If firewall is misconfigured (or e.g. your network topology has changed and you forgot to update the firewall configuration), the network works, but it is exposed to the elements and security goes away. We have enough security problems with IoT even in mostly IPv4 world; with massive IPv6 deployment, it wilk be a total nightmare.
kazen44 8y ago
NAT is not a firewall. You are confusing the firewall function of your home router with NAT. NAT does nothing to prevent packets from flowing into your network, as NAT hole punching is fairly doable to accomplish. Also, all consumer routers simply block any incoming IPV6 packets, this has been the default for more then 10 years now. (the only thing not blocked is ICMP for MTU path-discovery, which is actually a good thing).
- atemerev 8y ago
  NAT hole punching requires cooperation from inside the network.
- raesene9 8y ago
  This, whilst technically correct, isn't necessarily end-users experience of things. Yes NAT doesn't block packets, however without explicit configuration traffic from the Internet will be very unlikely to flow into an RFC1918 addressed network from the Internet. So effectively it does prevent traffic inbound in the same way a firewall does. Yes you can punch holes in NAT, but that's an explicit action (well side-stepping the insanity that is UPnP) for for non-technical users sitting behind a NAT router will effectively mean that they're unlikely to receive direct inbound network attacks from the Internet.
  - throwaway2048 8y ago
    You can achive precisely 100% exactly the same functionality with a firewall without NAT, indeed you need that sorta functionality to implement NAT to begin with. All you need is a default deny inbound traffic rule, this isnt some kind of arcane thing that is so much harder than NAT for end users.
    - raesene9 8y ago
      Of course you can, the point I was making was that NAT provides effectively the same outcome, not that it wasn't possible with a firewall.
  - 8y ago
JdeBP 8y ago
I recommend reading the likes of https://security.stackexchange.com/questions/8772/ https://security.stackexchange.com/questions/8772/ , https://superuser.com/questions/237790/ https://superuser.com/questions/237790/ , https://security.stackexchange.com/questions/155159/ https://security.stackexchange.com/questions/155159/ , https://f5.com/resources/white-papers/the-myth-of-network-address-translation-as-security https://f5.com/resources/white-papers/the-myth-of-network-ad... , and a lot of other writings in this vein.

okket 8y ago

Actually, I don't know one CPE IPv6 router that ships _without_ blocking the home network from the outside by default.

atemerev 8y ago
It is easy enough with home routers (packet filtering is hidden from the user, and no need to configure it). It is much harder for corporate networks where you need to configure everything yourself and maintain ACLs. No more easy default option.
- kazen44 8y ago
  what? this makes no sense? For a corporate network, their requirements usually result in them having to manage their own ACL's anyways. It does not matter if that is IPV4 or IPV6. There is no "easy default" for corporate networks because they don't have easy requirements. On a enterprise grade firewall/router, the end rule of an ACL is a DEFAULT DENY ANY ANY, on both ipv4 and ipv6. (this assumes you actually enable ACL's. But that depends on your platform).
  - atemerev 8y ago
    You a talking about large corporations. I am talking about small and medium business where networks are abused and misconfigured in every way, and the only thing holding them relatively undamaged is the NAT. There are millions of them.
- deleted 8y ago
  [deleted]
- aequitas 8y ago
  Don't forget people running some kind of container environment on their VPS and wanting internet for their containers. With IPv4 you at least need masquerading with IPv6 you're exposing all your microservers at once unless you think about fiewalling.

skrause 8y ago

It's actually just as easy with IPv6. All you need is a stateful firewall which allows all outgoing connections and only allows incoming packets for already established connections. This was the default setting on my home router and behaves exactly like a NAT.

atemerev 8y ago
It is easy enough, but it is fragile. If NAT is misconfigured, your network stops working. If firewall is misconfigured (or e.g. your network topology has changed and you forgot to update the firewall configuration), the network works, but it is exposed to the elements and security goes away. We have enough security problems with IoT even in mostly IPv4 world; with massive IPv6 deployment, it wilk be a total nightmare.

kazen44 8y ago

NAT is not a firewall. You are confusing the firewall function of your home router with NAT. NAT does nothing to prevent packets from flowing into your network, as NAT hole punching is fairly doable to accomplish. Also, all consumer routers simply block any incoming IPV6 packets, this has been the default for more then 10 years now. (the only thing not blocked is ICMP for MTU path-discovery, which is actually a good thing).

atemerev 8y ago
NAT hole punching requires cooperation from inside the network.
raesene9 8y ago
This, whilst technically correct, isn't necessarily end-users experience of things. Yes NAT doesn't block packets, however without explicit configuration traffic from the Internet will be very unlikely to flow into an RFC1918 addressed network from the Internet. So effectively it does prevent traffic inbound in the same way a firewall does. Yes you can punch holes in NAT, but that's an explicit action (well side-stepping the insanity that is UPnP) for for non-technical users sitting behind a NAT router will effectively mean that they're unlikely to receive direct inbound network attacks from the Internet.
- throwaway2048 8y ago
  You can achive precisely 100% exactly the same functionality with a firewall without NAT, indeed you need that sorta functionality to implement NAT to begin with. All you need is a default deny inbound traffic rule, this isnt some kind of arcane thing that is so much harder than NAT for end users.
  - raesene9 8y ago
    Of course you can, the point I was making was that NAT provides effectively the same outcome, not that it wasn't possible with a firewall.
- 8y ago

JdeBP 8y ago

I recommend reading the likes of https://security.stackexchange.com/questions/8772/ https://security.stackexchange.com/questions/8772/ , https://superuser.com/questions/237790/ https://superuser.com/questions/237790/ , https://security.stackexchange.com/questions/155159/ https://security.stackexchange.com/questions/155159/ , https://f5.com/resources/white-papers/the-myth-of-network-address-translation-as-security https://f5.com/resources/white-papers/the-myth-of-network-ad... , and a lot of other writings in this vein.