6 ms·
If NAT is an implicit firewall, then so is an unplugged network cable. I guess it's technically true, but isn't a particularly meaningful assertion - you might
by growse 8y ago
If NAT is an implicit firewall, then so is an unplugged network cable. I guess it's technically true, but isn't a particularly meaningful assertion - you might as well say that NAT is also 'not a donkey'. Again, technically true, but doesn't really help.
Firewalls are packet filters. Confusing routing and packet filtering doesn't help anybody solve any problems.
We're talking (I think) about how to mitigate threats from the public internet by dropping unwanted traffic with IPv6. The answer is a firewall (as it is with IPv4).
- nikanj 8y agoI can hook grandma up with a $30 chinese NAT box, disable UPNP and she's mostly safe from all sorts of port knocking attempts - while still having internet that seems to work great for her. What would be the ipv6 equivalent? You can call it a donkey all you want.
- growse 8y agoThe equivalent is buying her a $30 Chinese router that supports IPv6 and comes with a firewall enabled by default (or is configurable).
- KMag 8y agoExactly. Rip out all of that logic that maintains the address translation table and performs address mangling and you have a simple stateful firewall that's obviously less complex. It's difficult to see how ripping out the address translation could be more exploitable or costly to maintain. Ideally, we'd start with things written from the beginning to be stateful firewalls, but if I worked for a home/small office router ventor, my first course of action would be to just ripp out that potentially buggy address translation part of our existing NAT implementation.
- tjoff 8y agoGreat! Which one is that? Do I need to buy it and perform some extensive testing first to figure that out? Looking forward to it!
- jmanderley 8y agoPretty much all of them?
- tjoff 8y agoMy expectation is far far lower. And those that are might not still be decent after an upgrade (and you won't know if the hardware or software you buy will be of another revision). Hardware that happens to be popular are often updated to a cheaper variant where the manufacturer rides on the fame and good reviews of the original version. So you can't even do the research once and expect it to hold for future purchases/replacements.
- takeda 8y agoWell, instead having "expectations", how about just checking it yourself before spreading FUD?
- tjoff 8y agoNo amount of FUD comes close to the reality when it comes to home routers. usrusr explained it nicely. It will likely take years before anyone will realize that the firewall doesn't work at all. Whereas a similarly broken NAT router will be declared DOA.
- usrusr 8y agoThe problem is that you can perfectly fail at implementing a firewall without breaking access to google.com, whereas broken NAT will mean no google for you. A bridge is not NAT with some features switched off, it's an entirely different topology. A v6 router without the firewall will still be a router. When setting up, people just want "the internet" to appear in their browser, that's their definition of done and NAT made it extremely unlikely to get there with universally open ports.
- zrm 8y ago> The problem is that you can perfectly fail at implementing a firewall without breaking access to google.com, whereas broken NAT will mean no google for you. Broken NAT: iptables -t nat -A POSTROUTING -o outside0 -j MASQUERADE iptables -P FORWARD ACCEPT Google works fine, but when somebody sends the external interface of my router a packet with destination address 192.168.1.42 (as can often be done from any compromised router on the same cable segment), it gets forwarded to 192.168.1.42 on the internal network. NAT is not a firewall.
- packet_nerd 8y agoHook grandma up with a $30 chinese firewall box, and disable UPNP? Plug modem into WAN, computer into LAN, turn it on, done. True, it will be called a "router" in consumer speak, but all consumer IPv6 routers should actually be firewalls.
- Dylan16807 8y agoA connection-based NAT does filter! Any source not in the database gets the packet discarded.
- kiallmacinnes 8y agoAnd this is the confusion most people have! NAT isn't doing that filtering, the stateful firewall is.. Every NAT device sold in a very long time has both features.. Some early DSL modems for example had only NAT, and they were horribly insecure. NAT is not a firewall, and provides near zero security. And, in combination with a stateful firewall, it provides exactly zero additional security.
- iforgotpassword 8y agoBut how so? If my public address gets a random packet and there are 5 devices on the lan side, which local address did those devices send unsolicited inbound traffic to? Where's the insecure part?
- justincormack 8y agoYes, because there is no firewall state. There is both firewall and NAT state for every established connection.
- kiallmacinnes 8y agoExactly. Remove the firewall state, and you're wide open for all the NAT'd ports. And if someone thinks they don't have any NAT ports, they would be wrong. You likely have 10's or 100's ports NATd for every device activity being used on your network.
- pilif 8y agoTo the various remote management ports listening on the DSL modem itself. Between RCE vulnerabilities, accidentally unauthenticated management features or even just upnp listening on the WAN port, there are infinite means for owning the network behind the device.