5 ms·

As a networking novice that article actually made me feel positive about IPv6 during most of it. I feel like maybe firewall based security is a bit of an outda

by audunw 6y ago

As a networking novice that article actually made me feel positive about IPv6 during most of it. I feel like maybe firewall based security is a bit of an outdated model. It’s going to take a while to figure out how to secure our networks/devices well, but it feels like a model that pushes more of the configuration to the device will be more secure and more universal (since more and more devices will be LTE connected) The model where you by default have access to everything inside the network if you can just get a connection behind the firewall never seemed all that great to me. If we can’t assume that any connection from the local network is authorized anymore, maybe it’ll push us to make servers/services more inherently secure, and accept/reject connections based on actually authenticating the user/device connecting to it. But then again, I’m not a professional so I may be wrong.

benc666 6y ago
A layered approach to security (onion model) is the only sane approach because any given layer will always have flaws. The notion I get from the article is that security becomes a huge problem when every node is exposed to almost every other node by design intent. That's why NAT is mentioned several times.
- djhaskin987 6y ago
  Exactly. Security at the endpoint level, rather than the firewall level, means that those that build those applications are in charge of security. There is no way my multi-business-unit company is going to solely trust developers with its security and compliance story. It's going to hire people whose job it is to secure the network as well. Given that these people don't even know all of the developers (or yet even their managers) inside this multi-business business, the only good thing those people have is firewalls and traffic inspection at large.
  - bb88 6y ago
    You're still going to have a firewall, it just won't be NAT based.
    - Dagger2 6y ago
      NAT isn't even a firewall in the first place. The firewall you need for v6? You've already got it in v4, if you've secured your v4 network. ...which a lot of people haven't, because they falsely believe that NAT by itself is enough to stop all inbound connections to their network.
- bb88 6y ago
  NAT was never meant to be a true firewall, and just causes so many problems for internet connectivity.
- TrueDuality 6y ago
  NAT was never intended to be a firewall and there are mulitple ways of bypassing it to talk to the hosts behind it without them initiating a connection. A new method was just discovered (link: https://samy.pl/slipstream/ https://samy.pl/slipstream/). It's very very easy to replicate the filtering behaviour of NAT for situations where its being used that way. Simply block connections into the network that weren't initiated by clients in the network itself. Every stateful firewall can easily handle that and it doesn't come with the security loopholes of NAT.
cratermoon 6y ago
It is outdated, and the Zero Trust model is gaining traction. Make access default closed, authenticate everyone and everything, and of course encrypt everything.
guenthert 6y ago
While the evil-Internet, DMZ, walled-garden scheme might be flawed, I doubt it'll go away anytime soon. - compute clusters / rendering farms: people pay for performance and aren't necessarily willing to sacrifice it for increased security (be it local firewall or SPECTRE mitigation) there - engineering sub-divisions in large enterprises: its not unheard of that equipment in those is maintained by the engineers themselves (who are not necessarily well versed in network security matters and have other priorities) rather then the enterprise's IT team (this can coincide with the MS Windows / Unix schism)
- kanox 6y ago
  Both of those scenarios are perfectly compatible with ipv6, corporate IT needs to replace NAT with an ipv6 firewall for access to the public internet. However it's also true that ipv6 does not give many advantages to a team that already has a 10.x.y.0/24 inside the corporate network.
  - welterde 6y ago
    Depends on your scale.. As soon as you start to have to resort to overlapping private IPv4 networks it really starts to get fun if you have to connect certain things together that weren't planned to be able to reach each other initially. With IPv6 this is a non-issue.

by audunw 6y ago

benc666 6y ago

A layered approach to security (onion model) is the only sane approach because any given layer will always have flaws. The notion I get from the article is that security becomes a huge problem when every node is exposed to almost every other node by design intent. That's why NAT is mentioned several times.

djhaskin987 6y ago
Exactly. Security at the endpoint level, rather than the firewall level, means that those that build those applications are in charge of security. There is no way my multi-business-unit company is going to solely trust developers with its security and compliance story. It's going to hire people whose job it is to secure the network as well. Given that these people don't even know all of the developers (or yet even their managers) inside this multi-business business, the only good thing those people have is firewalls and traffic inspection at large.
- bb88 6y ago
  You're still going to have a firewall, it just won't be NAT based.
  - Dagger2 6y ago
    NAT isn't even a firewall in the first place. The firewall you need for v6? You've already got it in v4, if you've secured your v4 network. ...which a lot of people haven't, because they falsely believe that NAT by itself is enough to stop all inbound connections to their network.
bb88 6y ago
NAT was never meant to be a true firewall, and just causes so many problems for internet connectivity.
TrueDuality 6y ago
NAT was never intended to be a firewall and there are mulitple ways of bypassing it to talk to the hosts behind it without them initiating a connection. A new method was just discovered (link: https://samy.pl/slipstream/ https://samy.pl/slipstream/). It's very very easy to replicate the filtering behaviour of NAT for situations where its being used that way. Simply block connections into the network that weren't initiated by clients in the network itself. Every stateful firewall can easily handle that and it doesn't come with the security loopholes of NAT.

cratermoon 6y ago

It is outdated, and the Zero Trust model is gaining traction. Make access default closed, authenticate everyone and everything, and of course encrypt everything.

guenthert 6y ago

While the evil-Internet, DMZ, walled-garden scheme might be flawed, I doubt it'll go away anytime soon. - compute clusters / rendering farms: people pay for performance and aren't necessarily willing to sacrifice it for increased security (be it local firewall or SPECTRE mitigation) there - engineering sub-divisions in large enterprises: its not unheard of that equipment in those is maintained by the engineers themselves (who are not necessarily well versed in network security matters and have other priorities) rather then the enterprise's IT team (this can coincide with the MS Windows / Unix schism)

kanox 6y ago
Both of those scenarios are perfectly compatible with ipv6, corporate IT needs to replace NAT with an ipv6 firewall for access to the public internet. However it's also true that ipv6 does not give many advantages to a team that already has a 10.x.y.0/24 inside the corporate network.
- welterde 6y ago
  Depends on your scale.. As soon as you start to have to resort to overlapping private IPv4 networks it really starts to get fun if you have to connect certain things together that weren't planned to be able to reach each other initially. With IPv6 this is a non-issue.