7 ms·

What would be grandma-proof equivalent of the implicit firewall provided by ipv4 NAT? The Right Way would be to make informed decisions per-port and per-protoc

by nikanj 8y ago

What would be grandma-proof equivalent of the implicit firewall provided by ipv4 NAT? The Right Way would be to make informed decisions per-port and per-protocol, but that's a nightmare to set up, and to maintain.

stephen_g 8y ago
You need basically the exact same stateful firewall you already need with IPv4 even with NAT, except that with IPv6 you need to allow ICMP as well otherwise path MTU can break. On the in chain - allow ICMP, allow established/related, block otherwise. Open up any additional ports as needed, just the same as you used to do with port forwarding before. All routers, even crappy consumer ones should have a basic stateful firewall on by default. Hopefully with sane default settings.
growse 8y ago
NAT is not an 'implicit firewall'. Firewalls do packet filtering, NAT mangles routing. These are different things. If you're trying to solve the problems of "How do we stop anyone on the internet sending packets to grandma's open ports?", then the answer is a packet filter. Thankfully, must sane consumer routers come with these.
- kortilla 8y ago
  NAT overloading private IPs onto a single IP (what 99% of consumer routers are doing) is an implicit firewall. Without additional protocols like UPNP or manual configuration of port forwarding, nothing behind this style NAT can receive unsolicited traffic. “Mangling routing” to a single source IP requires state tracking of outbound sessions to know where to send inbound traffic. No outbound traffic, no session, no inbound traffic.
  - growse 8y ago
    If NAT is an implicit firewall, then so is an unplugged network cable. I guess it's technically true, but isn't a particularly meaningful assertion - you might as well say that NAT is also 'not a donkey'. Again, technically true, but doesn't really help. Firewalls are packet filters. Confusing routing and packet filtering doesn't help anybody solve any problems. We're talking (I think) about how to mitigate threats from the public internet by dropping unwanted traffic with IPv6. The answer is a firewall (as it is with IPv4).
    - nikanj 8y ago
      I can hook grandma up with a $30 chinese NAT box, disable UPNP and she's mostly safe from all sorts of port knocking attempts - while still having internet that seems to work great for her. What would be the ipv6 equivalent? You can call it a donkey all you want.
      - growse 8y ago
        The equivalent is buying her a $30 Chinese router that supports IPv6 and comes with a firewall enabled by default (or is configurable).
        KMag 8y ago
        Exactly. Rip out all of that logic that maintains the address translation table and performs address mangling and you have a simple stateful firewall that's obviously less complex. It's difficult to see how ripping out the address translation could be more exploitable or costly to maintain. Ideally, we'd start with things written from the beginning to be stateful firewalls, but if I worked for a home/small office router ventor, my first course of action would be to just ripp out that potentially buggy address translation part of our existing NAT implementation.
        tjoff 8y ago
        Great! Which one is that? Do I need to buy it and perform some extensive testing first to figure that out? Looking forward to it!
        jmanderley 8y ago
        Pretty much all of them?
        tjoff 8y ago
        My expectation is far far lower. And those that are might not still be decent after an upgrade (and you won't know if the hardware or software you buy will be of another revision). Hardware that happens to be popular are often updated to a cheaper variant where the manufacturer rides on the fame and good reviews of the original version. So you can't even do the research once and expect it to hold for future purchases/replacements.
  - KMag 8y ago
    Nobody is advocating replacing cheap NAT home routers with unprotected routers. They're all advocating replacing cheap NAT home routers with cheap stateful firewall home routers. What the GP is trying to tell you is that you're conflating sateful filtering with NAT. If you rip the address translation part out of a NAT implementation, you get a stateful firewall. You're probably better off with a purpose-designed stateful firewall, but ripping the NAT out of NAT works and is an obvious reduction in complexity. Insisting that you lose packet filtering if you get rid of NAT is a straw man argument. Nobody is arguing for that. They just want to remove the address mangling portion of the cheap router while keeping the packet filtering.
  - lloeki 8y ago
    No it's not. Case in point, I've had a misconfigured router provided by an ISP with proper NAT but bad firewalling, and hacking on routes allowed me to jump into neighbors LANs on the same ISP. Crazy.
  - kiallmacinnes 8y ago
    This is true, and it's the very minor security benefit of NAT. However, without the stateful firewall in addition, you're wide open to attack. Have a windows PC? Did you try access a network share that exists outside your network? Well, now the SMB port is open. Anyone on the internet can reach it. Hopefully your desktop has a stateful firewall to mitigate the hole in your router.... There's going to be hundreds of other examples.
    - jankeymeulen 8y ago
      Not really, NAT will keep track of destination address as well so unless the network share outside the network is also the address of an adversary, the SMB port isn't open to the internet.
      - kiallmacinnes 8y ago
        NAT doesn't do this on its own. It would be a duplicate implementation of the stateful firewall, so NAT leaves this piece to the firewall. NAT is nothing more than a lookup table of router IP+Port and internal IP+Port pairs. (Well, PAT style NAT anyway... But that's what everyone here is talking about...)
      - packet_nerd 8y ago
        Your thinking of the firewall that's built into most consumer routers. The exact technicalities of NAT (PAT actually) are not super well defined, and many implementations will not track the destination address.
    - dotancohen 8y ago
      I don't think that remote network share access is very common among home Windows users, but Skype is. The last time that I pointed nmap at a PC with Skype on a conversation, the output of open ports was more than a screenful. Skype listens on literally tens of ports. Granted, this was a while ago.
      - kiallmacinnes 8y ago
  - packet_nerd 8y ago
    > nothing behind this style NAT can receive unsolicited traffic This isn't really 100% true though. Since IPv4 NAT was never standardized, many many variations exist in the wild and some can be exploited to send unsolicited traffic inside the network defeating the implicit "firewall" aspect of NAT. NAT translates IPs. Firewalls allow or block traffic based on a policy. In some configurations (static NAT, port forwarding, etc. etc.), there's no firewall aspect to NAT at all. In others (PAT, what this discussion is mostly about), there's often an implicit firewall, but different implementations have widely variable behavior, and it basically should not be depended on as a firewall. If you want to deny inbound unsolicited traffic, then you need a firewall.
jsjohnst 8y ago
Most consumer grade firewalls that support IPv6 have easy to configure options for this.
- canofbars 8y ago
  My router helpfully has it hardcoded on block everything :/
zamadatix 8y ago
The "implicit firewall by IPv4 NAT" is functionally the same as: Outbound allow Deny all In any stateful firewall implementation. The only difference from IPv4 is the ruleset doesn't have the NAT statement.
- KMag 8y ago
  100% agree. A simple stateful firewall is more simple than a NAT box, and all else being equal, is likely less exploitable/buggy. Some will argue about what the exact firewall rules should be, but we can have that argument after we all agree to replace NAT with sateful firewalls.
- lloeki 8y ago
  Definitely. I suppose this was meant to say "outbound allow all / (inbound) deny all". Nitpick: please make sure ICMPv6 is allowed inbound though, else you'll get PMTU issues among other things.
  - zrm 8y ago
    This is true of IPv4 ICMP as well. Same PMTU issues, but many IPv4 implementations fallback to allowing in-path packet fragmentation by the routers (which IPv6 discontinued), which is less visible breakage but still inefficient/problematic. It's also slightly more complicated than "outbound allow, inbound deny" because you want to accept reply packets to the outbound ones, using something like the iptables "-m state --state related,established" match.
deleted 8y ago
[deleted]

by nikanj 8y ago

stephen_g 8y ago

You need basically the exact same stateful firewall you already need with IPv4 even with NAT, except that with IPv6 you need to allow ICMP as well otherwise path MTU can break. On the in chain - allow ICMP, allow established/related, block otherwise. Open up any additional ports as needed, just the same as you used to do with port forwarding before. All routers, even crappy consumer ones should have a basic stateful firewall on by default. Hopefully with sane default settings.

growse 8y ago

NAT is not an 'implicit firewall'. Firewalls do packet filtering, NAT mangles routing. These are different things. If you're trying to solve the problems of "How do we stop anyone on the internet sending packets to grandma's open ports?", then the answer is a packet filter. Thankfully, must sane consumer routers come with these.

kortilla 8y ago
NAT overloading private IPs onto a single IP (what 99% of consumer routers are doing) is an implicit firewall. Without additional protocols like UPNP or manual configuration of port forwarding, nothing behind this style NAT can receive unsolicited traffic. “Mangling routing” to a single source IP requires state tracking of outbound sessions to know where to send inbound traffic. No outbound traffic, no session, no inbound traffic.
- growse 8y ago
  If NAT is an implicit firewall, then so is an unplugged network cable. I guess it's technically true, but isn't a particularly meaningful assertion - you might as well say that NAT is also 'not a donkey'. Again, technically true, but doesn't really help. Firewalls are packet filters. Confusing routing and packet filtering doesn't help anybody solve any problems. We're talking (I think) about how to mitigate threats from the public internet by dropping unwanted traffic with IPv6. The answer is a firewall (as it is with IPv4).
  - nikanj 8y ago
    I can hook grandma up with a $30 chinese NAT box, disable UPNP and she's mostly safe from all sorts of port knocking attempts - while still having internet that seems to work great for her. What would be the ipv6 equivalent? You can call it a donkey all you want.
    - growse 8y ago
      The equivalent is buying her a $30 Chinese router that supports IPv6 and comes with a firewall enabled by default (or is configurable).
      - KMag 8y ago
        Exactly. Rip out all of that logic that maintains the address translation table and performs address mangling and you have a simple stateful firewall that's obviously less complex. It's difficult to see how ripping out the address translation could be more exploitable or costly to maintain. Ideally, we'd start with things written from the beginning to be stateful firewalls, but if I worked for a home/small office router ventor, my first course of action would be to just ripp out that potentially buggy address translation part of our existing NAT implementation.
      - tjoff 8y ago
        Great! Which one is that? Do I need to buy it and perform some extensive testing first to figure that out? Looking forward to it!
        jmanderley 8y ago
        Pretty much all of them?
        tjoff 8y ago
        My expectation is far far lower. And those that are might not still be decent after an upgrade (and you won't know if the hardware or software you buy will be of another revision). Hardware that happens to be popular are often updated to a cheaper variant where the manufacturer rides on the fame and good reviews of the original version. So you can't even do the research once and expect it to hold for future purchases/replacements.
- KMag 8y ago
  Nobody is advocating replacing cheap NAT home routers with unprotected routers. They're all advocating replacing cheap NAT home routers with cheap stateful firewall home routers. What the GP is trying to tell you is that you're conflating sateful filtering with NAT. If you rip the address translation part out of a NAT implementation, you get a stateful firewall. You're probably better off with a purpose-designed stateful firewall, but ripping the NAT out of NAT works and is an obvious reduction in complexity. Insisting that you lose packet filtering if you get rid of NAT is a straw man argument. Nobody is arguing for that. They just want to remove the address mangling portion of the cheap router while keeping the packet filtering.
- lloeki 8y ago
  No it's not. Case in point, I've had a misconfigured router provided by an ISP with proper NAT but bad firewalling, and hacking on routes allowed me to jump into neighbors LANs on the same ISP. Crazy.
- kiallmacinnes 8y ago
  This is true, and it's the very minor security benefit of NAT. However, without the stateful firewall in addition, you're wide open to attack. Have a windows PC? Did you try access a network share that exists outside your network? Well, now the SMB port is open. Anyone on the internet can reach it. Hopefully your desktop has a stateful firewall to mitigate the hole in your router.... There's going to be hundreds of other examples.
  - jankeymeulen 8y ago
    Not really, NAT will keep track of destination address as well so unless the network share outside the network is also the address of an adversary, the SMB port isn't open to the internet.
    - kiallmacinnes 8y ago
      NAT doesn't do this on its own. It would be a duplicate implementation of the stateful firewall, so NAT leaves this piece to the firewall. NAT is nothing more than a lookup table of router IP+Port and internal IP+Port pairs. (Well, PAT style NAT anyway... But that's what everyone here is talking about...)
    - packet_nerd 8y ago
      Your thinking of the firewall that's built into most consumer routers. The exact technicalities of NAT (PAT actually) are not super well defined, and many implementations will not track the destination address.
  - dotancohen 8y ago
    I don't think that remote network share access is very common among home Windows users, but Skype is. The last time that I pointed nmap at a PC with Skype on a conversation, the output of open ports was more than a screenful. Skype listens on literally tens of ports. Granted, this was a while ago.
    - kiallmacinnes 8y ago
- packet_nerd 8y ago
  > nothing behind this style NAT can receive unsolicited traffic This isn't really 100% true though. Since IPv4 NAT was never standardized, many many variations exist in the wild and some can be exploited to send unsolicited traffic inside the network defeating the implicit "firewall" aspect of NAT. NAT translates IPs. Firewalls allow or block traffic based on a policy. In some configurations (static NAT, port forwarding, etc. etc.), there's no firewall aspect to NAT at all. In others (PAT, what this discussion is mostly about), there's often an implicit firewall, but different implementations have widely variable behavior, and it basically should not be depended on as a firewall. If you want to deny inbound unsolicited traffic, then you need a firewall.

jsjohnst 8y ago

Most consumer grade firewalls that support IPv6 have easy to configure options for this.

canofbars 8y ago
My router helpfully has it hardcoded on block everything :/

zamadatix 8y ago

The "implicit firewall by IPv4 NAT" is functionally the same as: Outbound allow Deny all In any stateful firewall implementation. The only difference from IPv4 is the ruleset doesn't have the NAT statement.

KMag 8y ago
100% agree. A simple stateful firewall is more simple than a NAT box, and all else being equal, is likely less exploitable/buggy. Some will argue about what the exact firewall rules should be, but we can have that argument after we all agree to replace NAT with sateful firewalls.
lloeki 8y ago
Definitely. I suppose this was meant to say "outbound allow all / (inbound) deny all". Nitpick: please make sure ICMPv6 is allowed inbound though, else you'll get PMTU issues among other things.
- zrm 8y ago
  This is true of IPv4 ICMP as well. Same PMTU issues, but many IPv4 implementations fallback to allowing in-path packet fragmentation by the routers (which IPv6 discontinued), which is less visible breakage but still inefficient/problematic. It's also slightly more complicated than "outbound allow, inbound deny" because you want to accept reply packets to the outbound ones, using something like the iptables "-m state --state related,established" match.

deleted 8y ago

[deleted]