6 ms·

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for secu

by takeda 6y ago

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

mavhc 6y ago
NAT can mean 2 things, 1 to 1, and 1 to many. Firewall is a concept not a thing. IPv6 could be set up so every computer has an internal address and you choose to map external to internet using 1 to 1 NAT.
- imwillofficial 6y ago
  As a former maintainer of firewalls... You are wrong. From beginning to end, utterly, and completely. ::Pets His firewalls lovingly:: “Don’t listen to Him, He didn’t mean it.”
- nix23 6y ago
  Ah yeah the good old IPv6-NAT....
rubatuga 6y ago
Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.
- nemosaltat 6y ago
  This is what I did a couple years ago. The documentation for OpenWRT is great, and Luci/LDE makes it approachable if you don’t feel comfortable managing from the CLI. I have one VLAN for my “privileged” devices and one for the “IO(shi)T” devices.
- kaylynb 6y ago
  This is the way to do it. NAT is not really security and UPnP doesn't really do much to prevent malicious software already on your network from doing malicious things except perhaps hosting itself on your WAN to spread further. What disabling it does help is prevent improperly configured or flawed devices from accidentally exposing themselves to your WAN. IOT devices? Put them on a network with no UPnP. Workstations and video game consoles with up-to-date patches? UPnP is probably fine.
- bscphil 6y ago
  Aren't these two points slightly contradictory? > the author depends on NAT as a security feature, when it was never designed to be one > UPnP is a convenience feature, and is disabled in all security focused networks. uPnP punches holes in a NAT. If you shouldn't be trusting NAT to protect you anyway, why bother disabling a feature that's designed to punch holes in it? Just set up your firewall to protect your network, and it's not an issue. (I suppose some routers might automatically add a firewall exception when doing uPnP hole punching, but if so that's an issue with those routers, not with the idea of relying on a firewall.)
  - rubatuga 6y ago
    Ah that’s fair, but it’s the combination of both that is the worst
  - cbsks 6y ago
    > I suppose some routers might automatically add a firewall exception when doing uPnP hole punching Every consumer router I’ve ever had will open up a port in the firewall when uPnP is enabled and a request is received. Is that not standard?
  - netflixandkill 6y ago
    UPNP doesn't "punch holes in NAT." It is dynamically configuring NAT to provide a specific translation. The same kind of dynamic translation happens the other way for any allowed outgoing traffic, and lots of old NAT traversal tricks made use of that before UPNP was a thing. The hole was always there. People get this topic confused all the time because the majority of network devices doing NAT are also acting as firewalls of varying efficacy. There are basically no non-firewall routers anymore, they all have at least simple network address ACLs. The purpose of upnp is touchless configuration. If you care about security, that is orthogonal to your goals, and so it must be restricted by some other policy enforcement.
    - deleted 6y ago
      [deleted]
    - 6y ago
netflixandkill 6y ago
This sort of thinking is endemic in industrial networks; they finally internalized basic ipv4 concepts in the late 00s and never considered maybe the stateful tracking required for UPNP and other NAT tricks also might exist without it. I've set up several private v6 networks to deal with renewable energy projects in which the integrator used the same ipv4 address blocks on every single one, and the whole 6to4 translation explanation landed like they had just seen a devil sorcerer graft a goat head onto a human.
- kaliszad 6y ago
  There are many, many networking and originally UNIX tools tricks (e.g. SSH) you can show to the poor people supporting industrial networks/ hardware. I have written some of my tricks down in this OrgPage: https://www.orgpad.com/s/UHUor4 https://www.orgpad.com/s/UHUor4 there are screenshots for Linux and Windows for some things related to SSHFS, SOCKS Proxy and more. Click units with shadows to open them. From time to time, I update it to reflect new tricks. This knowledge saved at least 2 companies hundreds if not thousands of euros in on-site support, hardware and other expenses. Funnily, while these things are quite hacky, they tend to work better than most of the dedicated hardware I have seen in practice, while keeping you/ the technician/ engineer in control. With any kind of working infrastructure, you can estimate how good your solutions are because you don't get called at random times and from monitoring/ explicit contact you just see/ hear the things work fine.
  - ComodoHacker 6y ago
    Your link doesn't open in my Firefox, unfortunately.
    - kaliszad 6y ago
      I tried just now in two different Firefox (ESR and current) versions and it works. Perhaps you have to enable JavaScript, since OrgPad is a web application? You can also try this not-shortened link: https://www.orgpad.com/o/AWhUSD7lhAjYC0sw-9lcDd https://www.orgpad.com/o/AWhUSD7lhAjYC0sw-9lcDd
alias_neo 6y ago
IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic. The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GUI at all.
- posguy 6y ago
  Ubiquiti's router offerings are rather poor, VPNs can't roll over to WAN2 automatically, redundant tunnels are hard to configure, IPv6 support is a mess, asking Ubiquiti for support gets you an unhelpful chat that redirects you to help articles you've already read. Other players in this space have had these capabilities for over a decade, and you can call to get help. Ubiquiti might be inexpensive, but its still more than double the price of Grandstream's SoHo/SMB router and access point offerings while offering equivalent support and features. Really neither of these offerings are good outside the SoHo and single location business space. I wish for OpenWRT, OPNsense or WatchGuard's configurability wrapped in a single interface that lets you see the router, switches and access points performance live while letting you alter their settings, without seriously kneecapped router capabilities.
- jiggawatts 6y ago
  > IPv6 can be a privacy issue Why do people throw this out there as if it's a fact we all agree on? I've heard of one potential privacy issue 20 years ago, which was that IPv6 autoconf used the MAC address for the host part of the address, but this has long since been replaced with regularly rotating random suffixes. So... why keep saying this?
  - manigandham 6y ago
    Because the prefix stays the same. And many ISPs that provide IPv6 don’t rotate very often, if at all.
    - Dylan16807 6y ago
DarkmSparks 6y ago
IMHO IPv6 is an ISP problem, I don't need every (any, really) of my devices accessible from outside my personal VPN, and IPV4 private space is more than sufficient for that. IPv6 is overly complex, therefore insecure. Thanks to the US Patriot Act I dont even trust the VPN stuff tbh.
- yesco 6y ago
  > IPv6 is overly complex I'm being a bit pedantic about this since you're right that in practice, setting up stuff for IPv6 is in-fact complex since support for it is all over the place. But I want to stress that IPv6 as a protocol is much simpler, more intuitive and much more versatile than IPv4. I'd even go so far as to say that it's actually fantastically suited for local networks, especially so in complicated setups with multiple subnets (in an alternate reality where everything supports it). It's really, truly, a genuine shame that it never gained the momentum it could have.
  - DarkmSparks 6y ago
    The basics of the client side are simple. But the routing is not simple. I'm pretty well versed in networking generally - even IPv6, but a quick glance over something like: http://ipv6now.com.au/primers/IPv6RoutingSecurity.php http://ipv6now.com.au/primers/IPv6RoutingSecurity.php Makes it obvious why it still hasn't gotten anywhere, _no one_ wants to dig through all that unless they really really have to. Security depends on securing the routing and address allocation. So it is hardly surprising very few were/are willing to step up a declare IPv6 installations safe for service. Combine that with most users being happy and comfortable with 1 IP address and there was no mass market appeal for IPv6 hardware or software. I'd go so far as saying the vast majority of people do not even realise their machines can be accessed from the outside world when they only have one public address behind their "firewalled super safe ISP router", and would be terrified to find out they can.
    - eqvinox 6y ago
      > http://ipv6now.com.au/primers/IPv6RoutingSecurity.php http://ipv6now.com.au/primers/IPv6RoutingSecurity.php Everything listed there either also applies/transfers to IPv4 or is not applicable at all to the situation you're evaluating. > Makes it obvious why it still hasn't gotten anywhere Uh.... https://www.google.com/search?q=google+ipv6+traffic+percentage https://www.google.com/search?q=google+ipv6+traffic+percenta... 44.44% https://www.google.com/search?q=google+global+ipv6+traffic+percentage https://www.google.com/search?q=google+global+ipv6+traffic+p... 34.15% [EDIT: sibling post by minimaul has the better link:] https://www.google.com/intl/en/ipv6/statistics.html#tab=ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=ipv6...

by takeda 6y ago

mavhc 6y ago

NAT can mean 2 things, 1 to 1, and 1 to many. Firewall is a concept not a thing. IPv6 could be set up so every computer has an internal address and you choose to map external to internet using 1 to 1 NAT.

imwillofficial 6y ago
As a former maintainer of firewalls... You are wrong. From beginning to end, utterly, and completely. ::Pets His firewalls lovingly:: “Don’t listen to Him, He didn’t mean it.”
nix23 6y ago
Ah yeah the good old IPv6-NAT....

rubatuga 6y ago

Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.

nemosaltat 6y ago
This is what I did a couple years ago. The documentation for OpenWRT is great, and Luci/LDE makes it approachable if you don’t feel comfortable managing from the CLI. I have one VLAN for my “privileged” devices and one for the “IO(shi)T” devices.
kaylynb 6y ago
This is the way to do it. NAT is not really security and UPnP doesn't really do much to prevent malicious software already on your network from doing malicious things except perhaps hosting itself on your WAN to spread further. What disabling it does help is prevent improperly configured or flawed devices from accidentally exposing themselves to your WAN. IOT devices? Put them on a network with no UPnP. Workstations and video game consoles with up-to-date patches? UPnP is probably fine.
bscphil 6y ago
Aren't these two points slightly contradictory? > the author depends on NAT as a security feature, when it was never designed to be one > UPnP is a convenience feature, and is disabled in all security focused networks. uPnP punches holes in a NAT. If you shouldn't be trusting NAT to protect you anyway, why bother disabling a feature that's designed to punch holes in it? Just set up your firewall to protect your network, and it's not an issue. (I suppose some routers might automatically add a firewall exception when doing uPnP hole punching, but if so that's an issue with those routers, not with the idea of relying on a firewall.)
- rubatuga 6y ago
  Ah that’s fair, but it’s the combination of both that is the worst
- cbsks 6y ago
  > I suppose some routers might automatically add a firewall exception when doing uPnP hole punching Every consumer router I’ve ever had will open up a port in the firewall when uPnP is enabled and a request is received. Is that not standard?
- netflixandkill 6y ago
  UPNP doesn't "punch holes in NAT." It is dynamically configuring NAT to provide a specific translation. The same kind of dynamic translation happens the other way for any allowed outgoing traffic, and lots of old NAT traversal tricks made use of that before UPNP was a thing. The hole was always there. People get this topic confused all the time because the majority of network devices doing NAT are also acting as firewalls of varying efficacy. There are basically no non-firewall routers anymore, they all have at least simple network address ACLs. The purpose of upnp is touchless configuration. If you care about security, that is orthogonal to your goals, and so it must be restricted by some other policy enforcement.
  - deleted 6y ago
    [deleted]
  - 6y ago

netflixandkill 6y ago

This sort of thinking is endemic in industrial networks; they finally internalized basic ipv4 concepts in the late 00s and never considered maybe the stateful tracking required for UPNP and other NAT tricks also might exist without it. I've set up several private v6 networks to deal with renewable energy projects in which the integrator used the same ipv4 address blocks on every single one, and the whole 6to4 translation explanation landed like they had just seen a devil sorcerer graft a goat head onto a human.

kaliszad 6y ago
There are many, many networking and originally UNIX tools tricks (e.g. SSH) you can show to the poor people supporting industrial networks/ hardware. I have written some of my tricks down in this OrgPage: https://www.orgpad.com/s/UHUor4 https://www.orgpad.com/s/UHUor4 there are screenshots for Linux and Windows for some things related to SSHFS, SOCKS Proxy and more. Click units with shadows to open them. From time to time, I update it to reflect new tricks. This knowledge saved at least 2 companies hundreds if not thousands of euros in on-site support, hardware and other expenses. Funnily, while these things are quite hacky, they tend to work better than most of the dedicated hardware I have seen in practice, while keeping you/ the technician/ engineer in control. With any kind of working infrastructure, you can estimate how good your solutions are because you don't get called at random times and from monitoring/ explicit contact you just see/ hear the things work fine.
- ComodoHacker 6y ago
  Your link doesn't open in my Firefox, unfortunately.
  - kaliszad 6y ago
    I tried just now in two different Firefox (ESR and current) versions and it works. Perhaps you have to enable JavaScript, since OrgPad is a web application? You can also try this not-shortened link: https://www.orgpad.com/o/AWhUSD7lhAjYC0sw-9lcDd https://www.orgpad.com/o/AWhUSD7lhAjYC0sw-9lcDd

alias_neo 6y ago

IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic. The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GUI at all.

posguy 6y ago
Ubiquiti's router offerings are rather poor, VPNs can't roll over to WAN2 automatically, redundant tunnels are hard to configure, IPv6 support is a mess, asking Ubiquiti for support gets you an unhelpful chat that redirects you to help articles you've already read. Other players in this space have had these capabilities for over a decade, and you can call to get help. Ubiquiti might be inexpensive, but its still more than double the price of Grandstream's SoHo/SMB router and access point offerings while offering equivalent support and features. Really neither of these offerings are good outside the SoHo and single location business space. I wish for OpenWRT, OPNsense or WatchGuard's configurability wrapped in a single interface that lets you see the router, switches and access points performance live while letting you alter their settings, without seriously kneecapped router capabilities.
jiggawatts 6y ago
> IPv6 can be a privacy issue Why do people throw this out there as if it's a fact we all agree on? I've heard of one potential privacy issue 20 years ago, which was that IPv6 autoconf used the MAC address for the host part of the address, but this has long since been replaced with regularly rotating random suffixes. So... why keep saying this?
- manigandham 6y ago
  Because the prefix stays the same. And many ISPs that provide IPv6 don’t rotate very often, if at all.
  - Dylan16807 6y ago

DarkmSparks 6y ago

IMHO IPv6 is an ISP problem, I don't need every (any, really) of my devices accessible from outside my personal VPN, and IPV4 private space is more than sufficient for that. IPv6 is overly complex, therefore insecure. Thanks to the US Patriot Act I dont even trust the VPN stuff tbh.

yesco 6y ago
> IPv6 is overly complex I'm being a bit pedantic about this since you're right that in practice, setting up stuff for IPv6 is in-fact complex since support for it is all over the place. But I want to stress that IPv6 as a protocol is much simpler, more intuitive and much more versatile than IPv4. I'd even go so far as to say that it's actually fantastically suited for local networks, especially so in complicated setups with multiple subnets (in an alternate reality where everything supports it). It's really, truly, a genuine shame that it never gained the momentum it could have.
- DarkmSparks 6y ago
  The basics of the client side are simple. But the routing is not simple. I'm pretty well versed in networking generally - even IPv6, but a quick glance over something like: http://ipv6now.com.au/primers/IPv6RoutingSecurity.php http://ipv6now.com.au/primers/IPv6RoutingSecurity.php Makes it obvious why it still hasn't gotten anywhere, _no one_ wants to dig through all that unless they really really have to. Security depends on securing the routing and address allocation. So it is hardly surprising very few were/are willing to step up a declare IPv6 installations safe for service. Combine that with most users being happy and comfortable with 1 IP address and there was no mass market appeal for IPv6 hardware or software. I'd go so far as saying the vast majority of people do not even realise their machines can be accessed from the outside world when they only have one public address behind their "firewalled super safe ISP router", and would be terrified to find out they can.
  - eqvinox 6y ago
    > http://ipv6now.com.au/primers/IPv6RoutingSecurity.php http://ipv6now.com.au/primers/IPv6RoutingSecurity.php Everything listed there either also applies/transfers to IPv4 or is not applicable at all to the situation you're evaluating. > Makes it obvious why it still hasn't gotten anywhere Uh.... https://www.google.com/search?q=google+ipv6+traffic+percentage https://www.google.com/search?q=google+ipv6+traffic+percenta... 44.44% https://www.google.com/search?q=google+global+ipv6+traffic+percentage https://www.google.com/search?q=google+global+ipv6+traffic+p... 34.15% [EDIT: sibling post by minimaul has the better link:] https://www.google.com/intl/en/ipv6/statistics.html#tab=ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=ipv6...