3 ms·

Depending on whether you‘re someone trying to build clever, distributed applications or someone trying to defend a corporate network against them, that may be a

Depending on whether you‘re someone trying to build clever, distributed applications or someone trying to defend a corporate network against them, that may be a bug or a feature.

georgyo 5y ago
There are many good reasons for IPv6 nat. Security is not one of them at all. There is no security gained from IPv6 nat, in fact some may even be lost. I think this page has a bunch of good examples on when IPv6 nat is useful: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 For why NAT doesn't actually add to security this is a decent article: https://www.internetsociety.org/blog/2015/01/ipv6-security-myth-3-no-ipv6-nat-means-less-security/ https://www.internetsociety.org/blog/2015/01/ipv6-security-m...
perryizgr8 5y ago
> someone trying to defend a corporate network against them If nat is part of your security strategy, you need a new security strategy.
- jve 5y ago
  Why? I mean, security is always defence-in-depth thing, a think that consists of multiple layers, etc. If you would have left out the "part of" words, then yeah, implying that NAT is the only defense, that strategy must be thrown out of the window. By the way, ~20 years ago, when ISP just gave public IP and that was directly hooked to PC... yeah, got bitten by some random script on internet that just deleted my files via SMB thanks to how insecure windows configuration was. Was grateful when router was my defense :) Not that something important was there for a kid, but credit goes to... NAT. I think that may have been the time when I learned something about open shares.
  - kuschku 5y ago
    NAT is not a defense in ANY way. Your router’s stateful firewall, that’s what saved you. But that’s separate and continues working with IPv6
JustFinishedBSG 5y ago
> trying to defend a corporate network against them That's not what NAT is for... That's what firewalls are for. Firewalls still exists in IPv6. The fact that NAT sucks so much that it makes penetration harder is not a feature, it's a bug so severe it even affect hackers.

Depending on whether you‘re someone trying to build clever, distributed applications or someone trying to defend a corporate network against them, that may be a bug or a feature.

georgyo 5y ago

There are many good reasons for IPv6 nat. Security is not one of them at all. There is no security gained from IPv6 nat, in fact some may even be lost. I think this page has a bunch of good examples on when IPv6 nat is useful: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 For why NAT doesn't actually add to security this is a decent article: https://www.internetsociety.org/blog/2015/01/ipv6-security-myth-3-no-ipv6-nat-means-less-security/ https://www.internetsociety.org/blog/2015/01/ipv6-security-m...

perryizgr8 5y ago

> someone trying to defend a corporate network against them If nat is part of your security strategy, you need a new security strategy.

jve 5y ago
Why? I mean, security is always defence-in-depth thing, a think that consists of multiple layers, etc. If you would have left out the "part of" words, then yeah, implying that NAT is the only defense, that strategy must be thrown out of the window. By the way, ~20 years ago, when ISP just gave public IP and that was directly hooked to PC... yeah, got bitten by some random script on internet that just deleted my files via SMB thanks to how insecure windows configuration was. Was grateful when router was my defense :) Not that something important was there for a kid, but credit goes to... NAT. I think that may have been the time when I learned something about open shares.
- kuschku 5y ago
  NAT is not a defense in ANY way. Your router’s stateful firewall, that’s what saved you. But that’s separate and continues working with IPv6

JustFinishedBSG 5y ago

> trying to defend a corporate network against them That's not what NAT is for... That's what firewalls are for. Firewalls still exists in IPv6. The fact that NAT sucks so much that it makes penetration harder is not a feature, it's a bug so severe it even affect hackers.