4 ms·

I have AT&T Fiber at home and have IPv6 turned off at the router because I don't believe consumer grade firewalls are as good as plain ol' NAT traversal for bas

I have AT&T Fiber at home and have IPv6 turned off at the router because I don't believe consumer grade firewalls are as good as plain ol' NAT traversal for basic security. IPv6 seems to want everything directly connected to the Internet which I find crazy. Update me - am I crazy? Is this old info or a bad take?

rie_t 4y ago
NAT is not a security feature, nor is everything publicly exposed to the internet on IPv6. With most routers you would have to explicitly forward a port in the router to expose that to the client anyways.
deleted 4y ago
[deleted]
zamadatix 4y ago
The only difference between NAT traversal and zone based state firewalling is whether you translate the address before you put it in the state table. The security functionality is roughly identical, NAT itself is not actually the security layer it just forces having the concept of tracking what is outbound initiated to work. In pure academic sense you can have NAT without disallowing inbound initiated sessions to internal addresses but that's insecure because it's just hiding the routing information not actually blocking inbound sessions. The only thing to worry about with the gateway they give you for AT&T fiber is if you have the crap model that has an extremely limited session table (4k) and if so you should ask for the new one (16k). This applies regardless of IP version preference.
- russellbeattie 4y ago
  > an extremely limited session table Interesting. You're right - I just found a reddit thread from a few months ago and ATT fiber seems to still have horrible IPv6 support, for that reason and others. I think I'll leave it off. https://www.reddit.com/r/ATT/comments/stuzjy/switched_to_att_2git_plan_too_bad_ipv6_is_broken/ https://www.reddit.com/r/ATT/comments/stuzjy/switched_to_att...
  - zamadatix 4y ago
    The conntrack table on the BG320 is 8k regardless if it's doing NAT with v4 or plain session tracking with IPv6. You just want to make sure you don't have the older model with the 2k limit as that'll cause problems for even light usage households. The way the IPv6 rollout is broken on ATT is the same as their IPv4 rollout is broken, they don't support bridge mode. Passthrough IP doesn't quite work the same as traditional bridge mode and still hits the conntrack limits. DHCPv6 and PD work fine though, I have it configured right now.
- autoexec 4y ago
  > The only difference between NAT traversal and zone based state firewalling is whether you translate the address before you put it in the state table. The security functionality is roughly identical Except that not translating your IP address means allowing certain types of tracking that NAT prevented. One unique IP address per device means that with nothing more than a list of IP addresses and timestamps servers can identify the number of devices you used on your network to connect to them, and can track which device was in use at which time. NAT prevents that scenario very well.
  - zamadatix 4y ago
    IPv6 has some features around this, most commonly implemented on devices (even more than just grabbing an assignment and sticking with it) is using temporary address assignments which change over time. Neither NAT or IPv6 randomization really do much for tracking prevention though. Servers get to see a lot more than just source port (~2 bytes of fingerprinting info) and source node (~0-2 bytes depending on the number of devices in the network) e.g. even just a TCP handshake has a larger fingerprinting signature and that's before you've even gotten to the application level protocol you're talking to the server with or the data in the connection itself.
    - autoexec 4y ago
      With enough effort you probably could enumerate the devices on a remote network using NAT, but the amount of effort matters too. NAT is easy for most end user's needs, works with a huge number of devices/gateways and somehow does a decent enough job at keeping the internet from passively learning about each of the devices on your network and tracking them over time that it's foiled the plans of many site operators and nosy organizations looking to do just that. Granted, there are other ways to track devices and as long as an application can be installed on a device and communicate to the outside world it can share whatever data it wants, but the last time I looked into it IPv6 made the situation worse not better, and there were multiple flaws found in its privacy extensions. It's admittedly been a few years and so maybe things have changed and it's time to give it another look.
throw0101a 4y ago
> Is this old info or a bad take? Yes. With IPv6 there are still stateful firewalls on routers. An app/service still generally needs to do firewall hole punching via UPnP or PCP. The main thing that goes away is the rigamarole of figuring out the public IP address: * https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ With my Asus RT-AC68U I can ping my IPv6 address: * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-ping.php https://www.subnetonline.com/pages/ipv6-network-tools/online... But cannot connect to SSH from the Internet (but localhost works), or port 80 (if I launch 'nc -6 -l 80'): * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-port-scanner.php https://www.subnetonline.com/pages/ipv6-network-tools/online... Firewalls do not stop working with IPv6.
labcomputer 4y ago
> Update me - am I crazy? Is this old info or a bad take? 1. NAT does nothing to prevent network egress. NAT is not a firewall--it monitors outgoing connection to remember how to re-write incoming packets. Any IoT shit or malware that wants to call home to a control server is free to do so. 2. Most consumer-NAT implementation have a facility for "inside" hosts to map "outside" ports to "inside" IP address-port combinations (for games). The facility has no authentication, other than (usually) ignoring packets from "outside". So a single infected device on your network can poke arbitrary holes in your "firewall". 3. Most modern IPv6 stacks create new auto-configured addresses and rotate them on a regular basis (the address space is big enough to do that). So "your address" is constantly in flux. Obscurity isn't good security, but at least it makes it harder for the bad guys to know where to send the packets. 4. The IPv6 packet structure is simpler, so, in theory, you might expect fewer vulnerabilities in your IP stack.

rie_t 4y ago

NAT is not a security feature, nor is everything publicly exposed to the internet on IPv6. With most routers you would have to explicitly forward a port in the router to expose that to the client anyways.

deleted 4y ago

[deleted]

zamadatix 4y ago

The only difference between NAT traversal and zone based state firewalling is whether you translate the address before you put it in the state table. The security functionality is roughly identical, NAT itself is not actually the security layer it just forces having the concept of tracking what is outbound initiated to work. In pure academic sense you can have NAT without disallowing inbound initiated sessions to internal addresses but that's insecure because it's just hiding the routing information not actually blocking inbound sessions. The only thing to worry about with the gateway they give you for AT&T fiber is if you have the crap model that has an extremely limited session table (4k) and if so you should ask for the new one (16k). This applies regardless of IP version preference.

russellbeattie 4y ago
> an extremely limited session table Interesting. You're right - I just found a reddit thread from a few months ago and ATT fiber seems to still have horrible IPv6 support, for that reason and others. I think I'll leave it off. https://www.reddit.com/r/ATT/comments/stuzjy/switched_to_att_2git_plan_too_bad_ipv6_is_broken/ https://www.reddit.com/r/ATT/comments/stuzjy/switched_to_att...
- zamadatix 4y ago
  The conntrack table on the BG320 is 8k regardless if it's doing NAT with v4 or plain session tracking with IPv6. You just want to make sure you don't have the older model with the 2k limit as that'll cause problems for even light usage households. The way the IPv6 rollout is broken on ATT is the same as their IPv4 rollout is broken, they don't support bridge mode. Passthrough IP doesn't quite work the same as traditional bridge mode and still hits the conntrack limits. DHCPv6 and PD work fine though, I have it configured right now.
autoexec 4y ago
> The only difference between NAT traversal and zone based state firewalling is whether you translate the address before you put it in the state table. The security functionality is roughly identical Except that not translating your IP address means allowing certain types of tracking that NAT prevented. One unique IP address per device means that with nothing more than a list of IP addresses and timestamps servers can identify the number of devices you used on your network to connect to them, and can track which device was in use at which time. NAT prevents that scenario very well.
- zamadatix 4y ago
  IPv6 has some features around this, most commonly implemented on devices (even more than just grabbing an assignment and sticking with it) is using temporary address assignments which change over time. Neither NAT or IPv6 randomization really do much for tracking prevention though. Servers get to see a lot more than just source port (~2 bytes of fingerprinting info) and source node (~0-2 bytes depending on the number of devices in the network) e.g. even just a TCP handshake has a larger fingerprinting signature and that's before you've even gotten to the application level protocol you're talking to the server with or the data in the connection itself.
  - autoexec 4y ago
    With enough effort you probably could enumerate the devices on a remote network using NAT, but the amount of effort matters too. NAT is easy for most end user's needs, works with a huge number of devices/gateways and somehow does a decent enough job at keeping the internet from passively learning about each of the devices on your network and tracking them over time that it's foiled the plans of many site operators and nosy organizations looking to do just that. Granted, there are other ways to track devices and as long as an application can be installed on a device and communicate to the outside world it can share whatever data it wants, but the last time I looked into it IPv6 made the situation worse not better, and there were multiple flaws found in its privacy extensions. It's admittedly been a few years and so maybe things have changed and it's time to give it another look.

throw0101a 4y ago

> Is this old info or a bad take? Yes. With IPv6 there are still stateful firewalls on routers. An app/service still generally needs to do firewall hole punching via UPnP or PCP. The main thing that goes away is the rigamarole of figuring out the public IP address: * https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ With my Asus RT-AC68U I can ping my IPv6 address: * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-ping.php https://www.subnetonline.com/pages/ipv6-network-tools/online... But cannot connect to SSH from the Internet (but localhost works), or port 80 (if I launch 'nc -6 -l 80'): * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-port-scanner.php https://www.subnetonline.com/pages/ipv6-network-tools/online... Firewalls do not stop working with IPv6.

labcomputer 4y ago

> Update me - am I crazy? Is this old info or a bad take? 1. NAT does nothing to prevent network egress. NAT is not a firewall--it monitors outgoing connection to remember how to re-write incoming packets. Any IoT shit or malware that wants to call home to a control server is free to do so. 2. Most consumer-NAT implementation have a facility for "inside" hosts to map "outside" ports to "inside" IP address-port combinations (for games). The facility has no authentication, other than (usually) ignoring packets from "outside". So a single infected device on your network can poke arbitrary holes in your "firewall". 3. Most modern IPv6 stacks create new auto-configured addresses and rotate them on a regular basis (the address space is big enough to do that). So "your address" is constantly in flux. Obscurity isn't good security, but at least it makes it harder for the bad guys to know where to send the packets. 4. The IPv6 packet structure is simpler, so, in theory, you might expect fewer vulnerabilities in your IP stack.