4 ms·

The equivalent is buying her a $30 Chinese router that supports IPv6 and comes with a firewall enabled by default (or is configurable).

by growse 8y ago

KMag 8y ago
Exactly. Rip out all of that logic that maintains the address translation table and performs address mangling and you have a simple stateful firewall that's obviously less complex. It's difficult to see how ripping out the address translation could be more exploitable or costly to maintain. Ideally, we'd start with things written from the beginning to be stateful firewalls, but if I worked for a home/small office router ventor, my first course of action would be to just ripp out that potentially buggy address translation part of our existing NAT implementation.
tjoff 8y ago
Great! Which one is that? Do I need to buy it and perform some extensive testing first to figure that out? Looking forward to it!
- jmanderley 8y ago
  Pretty much all of them?
  - tjoff 8y ago
    My expectation is far far lower. And those that are might not still be decent after an upgrade (and you won't know if the hardware or software you buy will be of another revision). Hardware that happens to be popular are often updated to a cheaper variant where the manufacturer rides on the fame and good reviews of the original version. So you can't even do the research once and expect it to hold for future purchases/replacements.
    - takeda 8y ago
      Well, instead having "expectations", how about just checking it yourself before spreading FUD?
      - tjoff 8y ago
        No amount of FUD comes close to the reality when it comes to home routers. usrusr explained it nicely. It will likely take years before anyone will realize that the firewall doesn't work at all. Whereas a similarly broken NAT router will be declared DOA.
usrusr 8y ago
The problem is that you can perfectly fail at implementing a firewall without breaking access to google.com, whereas broken NAT will mean no google for you. A bridge is not NAT with some features switched off, it's an entirely different topology. A v6 router without the firewall will still be a router. When setting up, people just want "the internet" to appear in their browser, that's their definition of done and NAT made it extremely unlikely to get there with universally open ports.
- zrm 8y ago
  > The problem is that you can perfectly fail at implementing a firewall without breaking access to google.com, whereas broken NAT will mean no google for you. Broken NAT: iptables -t nat -A POSTROUTING -o outside0 -j MASQUERADE iptables -P FORWARD ACCEPT Google works fine, but when somebody sends the external interface of my router a packet with destination address 192.168.1.42 (as can often be done from any compromised router on the same cable segment), it gets forwarded to 192.168.1.42 on the internal network. NAT is not a firewall.

The equivalent is buying her a $30 Chinese router that supports IPv6 and comes with a firewall enabled by default (or is configurable).

by growse 8y ago

The equivalent is buying her a $30 Chinese router that supports IPv6 and comes with a firewall enabled by default (or is configurable).

KMag 8y ago

Exactly. Rip out all of that logic that maintains the address translation table and performs address mangling and you have a simple stateful firewall that's obviously less complex. It's difficult to see how ripping out the address translation could be more exploitable or costly to maintain. Ideally, we'd start with things written from the beginning to be stateful firewalls, but if I worked for a home/small office router ventor, my first course of action would be to just ripp out that potentially buggy address translation part of our existing NAT implementation.

tjoff 8y ago

Great! Which one is that? Do I need to buy it and perform some extensive testing first to figure that out? Looking forward to it!

jmanderley 8y ago
Pretty much all of them?
- tjoff 8y ago
  My expectation is far far lower. And those that are might not still be decent after an upgrade (and you won't know if the hardware or software you buy will be of another revision). Hardware that happens to be popular are often updated to a cheaper variant where the manufacturer rides on the fame and good reviews of the original version. So you can't even do the research once and expect it to hold for future purchases/replacements.
  - takeda 8y ago
    Well, instead having "expectations", how about just checking it yourself before spreading FUD?
    - tjoff 8y ago
      No amount of FUD comes close to the reality when it comes to home routers. usrusr explained it nicely. It will likely take years before anyone will realize that the firewall doesn't work at all. Whereas a similarly broken NAT router will be declared DOA.

usrusr 8y ago

The problem is that you can perfectly fail at implementing a firewall without breaking access to google.com, whereas broken NAT will mean no google for you. A bridge is not NAT with some features switched off, it's an entirely different topology. A v6 router without the firewall will still be a router. When setting up, people just want "the internet" to appear in their browser, that's their definition of done and NAT made it extremely unlikely to get there with universally open ports.

zrm 8y ago
> The problem is that you can perfectly fail at implementing a firewall without breaking access to google.com, whereas broken NAT will mean no google for you. Broken NAT: iptables -t nat -A POSTROUTING -o outside0 -j MASQUERADE iptables -P FORWARD ACCEPT Google works fine, but when somebody sends the external interface of my router a packet with destination address 192.168.1.42 (as can often be done from any compromised router on the same cable segment), it gets forwarded to 192.168.1.42 on the internal network. NAT is not a firewall.