5 ms·

I think most corporate network should be able to do pure IPv6 internally, and then tunnel to IPv4 at the gateway. The number one complaint I hear (and have mys

I think most corporate network should be able to do pure IPv6 internally, and then tunnel to IPv4 at the gateway. The number one complaint I hear (and have myself) is that maybe I don’t _want_ all devices on my LAN to have public IP addresses. NAT makes security a lot easier to reason about.

NavinF 5y ago
NAT doesn’t improve security if port numbers are easy to guess, which is usually the case. If you wanna block inbound connections, just drop them with your firewall. Most home routers already do this by default and if yours doesn’t, you better enable it for IPv4 too.
- thrashh 5y ago
  NAT sucks but is harder to misconfigure. I’ve never accidentally let something through NAT. But accidentally not configuring a firewall? Everyone does that and has done that and will forever do it.
  - BenjiWiebe 5y ago
    I hear this and I'm always curious how this happens. The Linux distributions I've used, the home routers I've encountered, etc, all default to a restrictive firewall that only needs to be changed if you want stuff allowed through.
    - withinboredom 5y ago
      The thing is, once you start to do any complicated firewall setup where defaults can no longer be restrictive, you are bound to screw it up at some point.
      - mentat 5y ago
        What kind of firewall work didn't have default drop? Once you take that off the table you really do have a problem but I've only seen that one in 20 years of professional work.
        withinboredom 5y ago
        I’ve had to do it fairly recently due to a lot of dynamic bridges and routing on the internal network vlan. I wanted to allow all traffic through the vlan from any device. However, wanted a default drop on the external interface.
        X-Istence 5y ago
        Once you are working with VLAN's you are out of the bailiwick of consumer hardware, and you should be looking at more enterprise grade gear. At that point having a default drop on the external interface and different rules for traffic traversing VLAN's is entirely possible, in fact that is what it is designed and built to do.
        withinboredom 5y ago
        My consumer router has vlan support…
    - nunez 5y ago
      Yeah, incorrect firewall rules are a HUGE problem at super large companies that aren't doing infra-as-code at scale yet. Sysadmins/server engineering/DevOps/SRE, Networks, and Security are usually hard silos at big companies. "DevOps" gets a request from an app team to open a port between subnet A and subnet B. DevOps asks Networks to do it. Security needs to approve it before Networks can do it (usually). A cohort of VPs somewhere need to approve it if those subnets are "production" (i.e. subject to serious fines if the data therein fails audit). Networks outsources the request to their global services team in India/Phillippines/China/Brazil since it's literally a single command, but they are done in bulk. These changes are only done afterhours, partly because of outsourcing latency, partly because of regulations. The firewall person types in the wrong port. Emergency change request gets filed to fix. Fixed in 1-3 days after the CTO/CIO and some SVPs approve it (and maybe yells at people for wasting their time). The requester asks for the wrong port. Too bad, so sad, you're waiting another week. The app team asked for the wrong port. Same outcome as the DevOps person.
  - blibble 5y ago
    there's plenty of instances of shitty applications setting up massive port forwarding rules using upnp
  - yakkers 5y ago
    As far as consumer routers go, wouldn’t it be trivial to re-tool the usual port forwarding interface to simply accept connections to a specific address-port? That combined with a internal block-all-inbound rule would be quite hard for a user to footgun themselves horribly with. From a quick search, UPnP seems capable of automating this for user convenience, especially with stateless addressing.
  - Dagger2 5y ago
    Are you sure you haven't? NAT in fact doesn't stop connections, so if you accidentally didn't configure the firewall then you won't be saved by NAT. Odds are that there weren't many people in a position to connect to you, and probably nobody actually did so, but it would certainly have been possible without a firewall in place.
- stingraycharles 5y ago
  “Block everything” works as long as you aren’t actually opening any services on the local network. If I want to open up a device with a single port, I should open that in the firewall. But wait, my IPv6 addresses aren’t stateful, so they can change any time. And then suddenly someone decides to just open port 80 and 443 on the main router, and bam! I’ve just opened up those ports for _all_ IPv6 clients in my LAN. You think all those IP cameras and ring doorbells were vulnerable when they are behind a NAT? Just wait what happens when they all get assigned public IPv6 addresses. I’m not saying that these problems are unsolvable. But I think it’s important to at least recognize that, yes, this is different than how we did things with NAT, and you now have more tools to shoot yourself in the foot with.
  - spookthesunset 5y ago
    > you now have more tools to shoot yourself in the foot with And the tools for managing IPv6 firewall rules suck on "SMB grade" stuff like ubiquiti and are virtually non-existant on any consumer grade router. If I have to SSH into the router and treat it like a "real" router to set up IPv6 firewall rules... it is never gonna fly for anybody who isn't proficient with "real" routers (i.e. >99% of the world). Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default). IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6. Honestly I just don't really see IPv6 replacing IPv4. It introduces too many problems and offers too little benefit. Whatever actually replaces IPv4 will either need to be 10x better than IPv4 in every way or be a completely transparent migration that works with IPv4 "but with more addresses".
    - X-Istence 5y ago
      > Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default). Comcasts cable modem also doesn't have any firewall for IPv4... it's a cable modem, it passes packets. Your CPE (customer premises endpoint) is where the firewall lives. > IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6. Most newer consumer gear that does IPv6 blocks all in-bound traffic on IPv6, just like it does on IPv4.
- nitrogen 5y ago
  It's not just about inbound connections, people also generally don't want to have their outbound devices clearly visible by counting unique IPs, or MAC addresses (and thus manufacturer) of devices sent out with every packet when MAC is used to generate the address, or another globally unique identifier for ad networks to track.
  - tolien 5y ago
    As sibling points out, that’s already covered by the IPv6 privacy extensions, which every major OS has some support for [1] 1: https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941
  - kstrauser 5y ago
    I think all major OSes have privacy extensions enabled by default, and therefore use random addresses that change regularly.
    - alar44 5y ago
      They 100% most certainly don't. I would have no idea what anything is on my network if every workstation's MAC addresses was constantly changing. Some OS's do randomize per SSID, but it doesn't constantly change, it would break DHCP by using up all the addresses. You can't just constantly change your L2 address.
      - kstrauser 5y ago
        This is in IPv6, not v4. I highlight that because you mention DHCP, which generally isn’t used there. And it’s not the MAC address that changes, but the 64-bit interface identifier. Ethernet would probably stop working if the MAC address changed with any regularity. You can read more about this at https://www.internetsociety.org/blog/2014/12/ipv6-privacy-addresses-provide-protection-against-surveillance-and-tracking/ https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad... From that article written in 2014, these OSes have privacy extensions enabled by default: - All versions of Windows after Windows XP - All versions of Mac OS X from 10.7 onward - All versions of iOS since iOS 4.3 - All versions of Android since 4.0 (ICS) - Some versions of Linux (and for others it can be easily configured)
redprince 5y ago
> I think most corporate network should be able to do pure IPv6 internally, and then tunnel to IPv4 at the gateway. With the amount of legacy applications and systems populating the typical internal network that idea won't be going far. Where IPv6 actually can be used and should be deployed in addition to v4 is in the perimeter networks. Offering or being able to use services on the internet over v6 (via proxy) overcomes the real shortage of ipv4 addresses in the internet at large. I expect internal networks to be last places to be moved to IPv6 only.
redprince 5y ago
> The number one complaint I hear (and have myself) is that maybe I don’t _want_ all devices on my LAN to have public IP addresses. This isn't a goal in itself. The formerly problematic and unwanted side effects of NAT, namely a broken peer to peer relationship of hosts on the internet, are now understood as a feature. Machines were forced by this technology to be clients and the initiators of all connections to the internet. Historically this has interfered greatly with several internet protocols (ftp, IRC DCC, p2p file sharing, ...) all mostly dead now or reworked to operate in a world full of NAT gateways. IPv6 would reverse this state of affairs. If machines need to be denied the server role, this can be enforced by a firewall. As far as tracking of clients by IP goes, dynamic address assignment via DHCP or IPv6 privacy extension take care of that.
- imoverclocked 5y ago
  One can still have intentionally unroutable addresses in IPv6.
  - tsimionescu 5y ago
    Sure, but then you're again on par with IPv4+NAT in the area of connectivity - no worse, but no better. So why switch?
    - gumby 5y ago
      Because you have all the overhead of NAT plus losing functionality that cannot operate through NAT. If all you want is to have addresses that done leave the local net, just do that. You’ll lose weight in a famine but nobody would suggest it as a diet plan.
      - tsimionescu 5y ago
        > Because you have all the overhead of NAT What overhead does NAT add compared to a L4 firewall? > plus losing functionality that cannot operate through NAT. What functionality does NAT prevent that a L4 firewall doesn't?
nunez 5y ago
IPAM, subnetting and firewalls still exist, though. That's just a lazy excuse.
iso1631 5y ago
This simple workflow, a new internal network deployed on IPv6 only Edge Firewalls -- source natting to allow access to IPv4 networks Edge Firewalls -- destination natting to allow access from IPv4 to a service hosted on IPv6 Doesn't seem to widely adopted. It's all dual stack stuff, which means more work and more things to go wrong for no benefit. Of course there's then the renumbering of your entire internal network every time you change ISP because you're using public IPs rather than private ones
Dagger2 5y ago
NAT actually makes security harder to reason about. For example, did you know that NAT doesn't prevent inbound connections? At least in v6 people are more likely to realize that, yes, they do need a firewall.

NavinF 5y ago

NAT doesn’t improve security if port numbers are easy to guess, which is usually the case. If you wanna block inbound connections, just drop them with your firewall. Most home routers already do this by default and if yours doesn’t, you better enable it for IPv4 too.

thrashh 5y ago
NAT sucks but is harder to misconfigure. I’ve never accidentally let something through NAT. But accidentally not configuring a firewall? Everyone does that and has done that and will forever do it.
- BenjiWiebe 5y ago
  I hear this and I'm always curious how this happens. The Linux distributions I've used, the home routers I've encountered, etc, all default to a restrictive firewall that only needs to be changed if you want stuff allowed through.
  - withinboredom 5y ago
    The thing is, once you start to do any complicated firewall setup where defaults can no longer be restrictive, you are bound to screw it up at some point.
    - mentat 5y ago
      What kind of firewall work didn't have default drop? Once you take that off the table you really do have a problem but I've only seen that one in 20 years of professional work.
      - withinboredom 5y ago
        I’ve had to do it fairly recently due to a lot of dynamic bridges and routing on the internal network vlan. I wanted to allow all traffic through the vlan from any device. However, wanted a default drop on the external interface.
        X-Istence 5y ago
        Once you are working with VLAN's you are out of the bailiwick of consumer hardware, and you should be looking at more enterprise grade gear. At that point having a default drop on the external interface and different rules for traffic traversing VLAN's is entirely possible, in fact that is what it is designed and built to do.
        withinboredom 5y ago
        My consumer router has vlan support…
  - nunez 5y ago
    Yeah, incorrect firewall rules are a HUGE problem at super large companies that aren't doing infra-as-code at scale yet. Sysadmins/server engineering/DevOps/SRE, Networks, and Security are usually hard silos at big companies. "DevOps" gets a request from an app team to open a port between subnet A and subnet B. DevOps asks Networks to do it. Security needs to approve it before Networks can do it (usually). A cohort of VPs somewhere need to approve it if those subnets are "production" (i.e. subject to serious fines if the data therein fails audit). Networks outsources the request to their global services team in India/Phillippines/China/Brazil since it's literally a single command, but they are done in bulk. These changes are only done afterhours, partly because of outsourcing latency, partly because of regulations. The firewall person types in the wrong port. Emergency change request gets filed to fix. Fixed in 1-3 days after the CTO/CIO and some SVPs approve it (and maybe yells at people for wasting their time). The requester asks for the wrong port. Too bad, so sad, you're waiting another week. The app team asked for the wrong port. Same outcome as the DevOps person.
- blibble 5y ago
  there's plenty of instances of shitty applications setting up massive port forwarding rules using upnp
- yakkers 5y ago
  As far as consumer routers go, wouldn’t it be trivial to re-tool the usual port forwarding interface to simply accept connections to a specific address-port? That combined with a internal block-all-inbound rule would be quite hard for a user to footgun themselves horribly with. From a quick search, UPnP seems capable of automating this for user convenience, especially with stateless addressing.
- Dagger2 5y ago
  Are you sure you haven't? NAT in fact doesn't stop connections, so if you accidentally didn't configure the firewall then you won't be saved by NAT. Odds are that there weren't many people in a position to connect to you, and probably nobody actually did so, but it would certainly have been possible without a firewall in place.
stingraycharles 5y ago
“Block everything” works as long as you aren’t actually opening any services on the local network. If I want to open up a device with a single port, I should open that in the firewall. But wait, my IPv6 addresses aren’t stateful, so they can change any time. And then suddenly someone decides to just open port 80 and 443 on the main router, and bam! I’ve just opened up those ports for _all_ IPv6 clients in my LAN. You think all those IP cameras and ring doorbells were vulnerable when they are behind a NAT? Just wait what happens when they all get assigned public IPv6 addresses. I’m not saying that these problems are unsolvable. But I think it’s important to at least recognize that, yes, this is different than how we did things with NAT, and you now have more tools to shoot yourself in the foot with.
- spookthesunset 5y ago
  > you now have more tools to shoot yourself in the foot with And the tools for managing IPv6 firewall rules suck on "SMB grade" stuff like ubiquiti and are virtually non-existant on any consumer grade router. If I have to SSH into the router and treat it like a "real" router to set up IPv6 firewall rules... it is never gonna fly for anybody who isn't proficient with "real" routers (i.e. >99% of the world). Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default). IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6. Honestly I just don't really see IPv6 replacing IPv4. It introduces too many problems and offers too little benefit. Whatever actually replaces IPv4 will either need to be 10x better than IPv4 in every way or be a completely transparent migration that works with IPv4 "but with more addresses".
  - X-Istence 5y ago
    > Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default). Comcasts cable modem also doesn't have any firewall for IPv4... it's a cable modem, it passes packets. Your CPE (customer premises endpoint) is where the firewall lives. > IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6. Most newer consumer gear that does IPv6 blocks all in-bound traffic on IPv6, just like it does on IPv4.
nitrogen 5y ago
It's not just about inbound connections, people also generally don't want to have their outbound devices clearly visible by counting unique IPs, or MAC addresses (and thus manufacturer) of devices sent out with every packet when MAC is used to generate the address, or another globally unique identifier for ad networks to track.
- tolien 5y ago
  As sibling points out, that’s already covered by the IPv6 privacy extensions, which every major OS has some support for [1] 1: https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941
- kstrauser 5y ago
  I think all major OSes have privacy extensions enabled by default, and therefore use random addresses that change regularly.
  - alar44 5y ago
    They 100% most certainly don't. I would have no idea what anything is on my network if every workstation's MAC addresses was constantly changing. Some OS's do randomize per SSID, but it doesn't constantly change, it would break DHCP by using up all the addresses. You can't just constantly change your L2 address.
    - kstrauser 5y ago
      This is in IPv6, not v4. I highlight that because you mention DHCP, which generally isn’t used there. And it’s not the MAC address that changes, but the 64-bit interface identifier. Ethernet would probably stop working if the MAC address changed with any regularity. You can read more about this at https://www.internetsociety.org/blog/2014/12/ipv6-privacy-addresses-provide-protection-against-surveillance-and-tracking/ https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad... From that article written in 2014, these OSes have privacy extensions enabled by default: - All versions of Windows after Windows XP - All versions of Mac OS X from 10.7 onward - All versions of iOS since iOS 4.3 - All versions of Android since 4.0 (ICS) - Some versions of Linux (and for others it can be easily configured)

redprince 5y ago

> I think most corporate network should be able to do pure IPv6 internally, and then tunnel to IPv4 at the gateway. With the amount of legacy applications and systems populating the typical internal network that idea won't be going far. Where IPv6 actually can be used and should be deployed in addition to v4 is in the perimeter networks. Offering or being able to use services on the internet over v6 (via proxy) overcomes the real shortage of ipv4 addresses in the internet at large. I expect internal networks to be last places to be moved to IPv6 only.

redprince 5y ago

> The number one complaint I hear (and have myself) is that maybe I don’t _want_ all devices on my LAN to have public IP addresses. This isn't a goal in itself. The formerly problematic and unwanted side effects of NAT, namely a broken peer to peer relationship of hosts on the internet, are now understood as a feature. Machines were forced by this technology to be clients and the initiators of all connections to the internet. Historically this has interfered greatly with several internet protocols (ftp, IRC DCC, p2p file sharing, ...) all mostly dead now or reworked to operate in a world full of NAT gateways. IPv6 would reverse this state of affairs. If machines need to be denied the server role, this can be enforced by a firewall. As far as tracking of clients by IP goes, dynamic address assignment via DHCP or IPv6 privacy extension take care of that.

imoverclocked 5y ago
One can still have intentionally unroutable addresses in IPv6.
- tsimionescu 5y ago
  Sure, but then you're again on par with IPv4+NAT in the area of connectivity - no worse, but no better. So why switch?
  - gumby 5y ago
    Because you have all the overhead of NAT plus losing functionality that cannot operate through NAT. If all you want is to have addresses that done leave the local net, just do that. You’ll lose weight in a famine but nobody would suggest it as a diet plan.
    - tsimionescu 5y ago
      > Because you have all the overhead of NAT What overhead does NAT add compared to a L4 firewall? > plus losing functionality that cannot operate through NAT. What functionality does NAT prevent that a L4 firewall doesn't?

nunez 5y ago

IPAM, subnetting and firewalls still exist, though. That's just a lazy excuse.

iso1631 5y ago

This simple workflow, a new internal network deployed on IPv6 only Edge Firewalls -- source natting to allow access to IPv4 networks Edge Firewalls -- destination natting to allow access from IPv4 to a service hosted on IPv6 Doesn't seem to widely adopted. It's all dual stack stuff, which means more work and more things to go wrong for no benefit. Of course there's then the renumbering of your entire internal network every time you change ISP because you're using public IPs rather than private ones

Dagger2 5y ago

NAT actually makes security harder to reason about. For example, did you know that NAT doesn't prevent inbound connections? At least in v6 people are more likely to realize that, yes, they do need a firewall.