4 ms·

Not OP but that’s how I think of it. If my internal network is 10.0.0.0/8 and I have 100,000 hosts and a single IPV4 address that they all appear to be to the

by 300bps 5y ago

Not OP but that’s how I think of it. If my internal network is 10.0.0.0/8 and I have 100,000 hosts and a single IPV4 address that they all appear to be to the public Internet, I’ll sleep a lot better than if I had all 100,000 hosts with public routable IPV6 IP addresses attached to them. Yes, you can depend on a firewall to protect you but at the very least it exposes information about your internal network and at worst opens you up to future firewall flaws. I remember the days when people used to have every system have it’s own public IP address. People would scan for broadcast addresses of their networks and we got Smurf attacks as a result. Obviously those wouldn’t work with properly firewalled hosts but it still scares me.

fishtacos 5y ago
This is why we have firewalls. My pfSense router e.g. blocks external access by virtue of it being a firewall with sensible defaults. All routers w/ firewalls will/should have them.
- pm90 5y ago
  Firewalls are fine but having the ability to make machines unroutable is even more powerful, no? While I get that firewalls are probably safe like 99.99% of the time… I’ve gotta say, I just don’t trust software to not have vulns of some sort that someone important already knows how to break. So eg for a corporate network I would be hesitant to do this, for my personal network not so much (unlikely that a 3 letter agency gives a shit about what I do). Additionally. Firewall changes can sometimes fail for whatever reasons so you might have accidentally exposed a node publicly for some time. Making those nodes not reachable from the internet seems prudent. It’s like your office building has a public address but your office assignments don’t need to be public.
  - mrkurt 5y ago
    Anything smaller than a IPv6 /48 is effectively unroutable. Your ISP has to route smaller blocks, like /64s, privately (because only /48s hit public bgp). And then you have to route the /64 they assign you privately once again.
  - zekica 5y ago
    No. There is no difference between the two from a security point.
  - justsomehnguy 5y ago
    >Firewalls are fine but having the ability to make machines unroutable is even more powerful, no? For the whole world there is absolutely no difference betwen routable address, non-routable address or even an absense of the machine... behind a firewall with drop all on a public interface.
    - 300bps 5y ago
      Your statement doesn’t address the point you are responding to so it makes me think you completely missed the point you are replying to. You are correct in theory. What you don’t seem to be taking into consideration are firewall vulnerabilities or other unknown things that could happen that make it different from a practical standpoint. I started an ISP from the ground in 1996. I’ve seen a lot of weird stuff. You seem to just hand waive it away like firewalls are this perfect bastion of security. Maybe you have more experience than I do?
      - blibble 5y ago
        where do you think the NAT and associated connection tracking is occurring exactly?
  - floatboth 5y ago
    Even firewalls are just a last resort defense IMO. The primary thing is not having any crap listening on ports in the first place.
mrkurt 5y ago
IPv4 with nat is effectively routing your 100,000 hosts through one of 4,294,967,296 possible IP prefixes (a /32). IPv6 with a /64 routes one of 18,889,465,931,478,580,854,783 possible IP prefixes to your router. Everything that happens behind that is opaque. There are so many IPs in that prefix that people can't even guess which ones you're using. It's easier to guess internal IPv4 NAT addresses. The internet can't see your IPs. "Publicly routable" doesn't mean much when you're talking about prefixes.
- otabdeveloper4 5y ago
  Unless you're planning to assign random IPv6 addresses for each connecton then it's not at all the same thing. And anyways, when you have a NAT you're probably routing traffic through a level 4 balancer or jumphost or using a VPN somewhere in your LAN.
  - blibble 5y ago
    > Unless you're planning to assign random IPv6 addresses for each connecton then it's not at all the same thing. SLAAC
    - Dylan16807 5y ago
      SLAAC has an option to randomize, but it's a lot slower than per-connection.
  - mrkurt 5y ago
    We assign IPv6 deterministically. Incrementing them is the most boring way to use IPv6 space. You can also just start in the middle of a block and make a sequence of 10,000 IPs effectively unguessable. I don't buy that keeping addresses private has much value, but IPv6 still isn't worse than NAT in that respect.
- doubleunplussed 5y ago
  As soon as one of the computers in the subnet initiates traffic outside the network, its IP address becomes public knowledge though, right? Doesn't matter how large the space is, that information leaks, whereas with NAT it doesn't.

by 300bps 5y ago

fishtacos 5y ago

This is why we have firewalls. My pfSense router e.g. blocks external access by virtue of it being a firewall with sensible defaults. All routers w/ firewalls will/should have them.

pm90 5y ago
Firewalls are fine but having the ability to make machines unroutable is even more powerful, no? While I get that firewalls are probably safe like 99.99% of the time… I’ve gotta say, I just don’t trust software to not have vulns of some sort that someone important already knows how to break. So eg for a corporate network I would be hesitant to do this, for my personal network not so much (unlikely that a 3 letter agency gives a shit about what I do). Additionally. Firewall changes can sometimes fail for whatever reasons so you might have accidentally exposed a node publicly for some time. Making those nodes not reachable from the internet seems prudent. It’s like your office building has a public address but your office assignments don’t need to be public.
- mrkurt 5y ago
  Anything smaller than a IPv6 /48 is effectively unroutable. Your ISP has to route smaller blocks, like /64s, privately (because only /48s hit public bgp). And then you have to route the /64 they assign you privately once again.
- zekica 5y ago
  No. There is no difference between the two from a security point.
- justsomehnguy 5y ago
  >Firewalls are fine but having the ability to make machines unroutable is even more powerful, no? For the whole world there is absolutely no difference betwen routable address, non-routable address or even an absense of the machine... behind a firewall with drop all on a public interface.
  - 300bps 5y ago
    Your statement doesn’t address the point you are responding to so it makes me think you completely missed the point you are replying to. You are correct in theory. What you don’t seem to be taking into consideration are firewall vulnerabilities or other unknown things that could happen that make it different from a practical standpoint. I started an ISP from the ground in 1996. I’ve seen a lot of weird stuff. You seem to just hand waive it away like firewalls are this perfect bastion of security. Maybe you have more experience than I do?
    - blibble 5y ago
      where do you think the NAT and associated connection tracking is occurring exactly?
- floatboth 5y ago
  Even firewalls are just a last resort defense IMO. The primary thing is not having any crap listening on ports in the first place.

mrkurt 5y ago

IPv4 with nat is effectively routing your 100,000 hosts through one of 4,294,967,296 possible IP prefixes (a /32). IPv6 with a /64 routes one of 18,889,465,931,478,580,854,783 possible IP prefixes to your router. Everything that happens behind that is opaque. There are so many IPs in that prefix that people can't even guess which ones you're using. It's easier to guess internal IPv4 NAT addresses. The internet can't see your IPs. "Publicly routable" doesn't mean much when you're talking about prefixes.

otabdeveloper4 5y ago
Unless you're planning to assign random IPv6 addresses for each connecton then it's not at all the same thing. And anyways, when you have a NAT you're probably routing traffic through a level 4 balancer or jumphost or using a VPN somewhere in your LAN.
- blibble 5y ago
  > Unless you're planning to assign random IPv6 addresses for each connecton then it's not at all the same thing. SLAAC
  - Dylan16807 5y ago
    SLAAC has an option to randomize, but it's a lot slower than per-connection.
- mrkurt 5y ago
  We assign IPv6 deterministically. Incrementing them is the most boring way to use IPv6 space. You can also just start in the middle of a block and make a sequence of 10,000 IPs effectively unguessable. I don't buy that keeping addresses private has much value, but IPv6 still isn't worse than NAT in that respect.
doubleunplussed 5y ago
As soon as one of the computers in the subnet initiates traffic outside the network, its IP address becomes public knowledge though, right? Doesn't matter how large the space is, that information leaks, whereas with NAT it doesn't.