4 ms·

Something I'm a bit fuzzy on, but can WAN/LAN address separation be done without NAT? I think it can, but if it can't that seems like a good argument in favor o

by slaymaker1907 4y ago

Something I'm a bit fuzzy on, but can WAN/LAN address separation be done without NAT? I think it can, but if it can't that seems like a good argument in favor of keeping some form of NAT even for IPv6. While it definitely shouldn't be the only defense, I think it is a reasonable layer of defense for home networking.

zamalek 4y ago
The IPv6 answer is Network Prefix Translation, the article has more details on what it does.
Arnavion 4y ago
Depends on what you mean by "separation". My LAN devices have IPv6 addresses that would be reachable from the WAN if my router's firewall didn't block incoming packets to those addresses. For some of those devices that host public services, I enable traffic just for the relevant protocol and port to their IP, instead of bothering with port forwarding.
- gary_0 4y ago
  This answer is what every argument about IPv6 and NAT boils down to: they say "NAT" but really mean "firewall". In my opinion, using NAT for IPv6 networks is just a false sense of security to make you think LAN nodes are more protected because their address numbers look different, when all you're really trying to say is "don't route to this node from outside".
  - dopp0 4y ago
    why it would be a 'false' sense of security if it's not exposed? I don't seem to get it as 'security through obscurity' at all. sincere question, I'm not a network guy.
- redblacktree 4y ago
  I'm not a networking guy. Do you think that approach would work for a device behind CG-NAT? (i.e. route the IPv6 address over the WAN, rather than port forwarding; which I can't do because of the CG-NAT)
  - Arnavion 4y ago
    You mean you have CGNAT for IPv4 but a publically routable IPv6 delegated subnet? If so, sure, what I wrote depends only on the IPv6 delegated subnet. How you get your IPv4 address is not relevant to it. What I'm saying is that if you can get, say, 2001:db8:1234::/48 delegated to your router, then: 1. You would configure your LAN to have the subnet 2001:db8:1234:1::/64 2. You would configure the webserver on your LAN to have a static IP like 2001:db8:1234:1::1 3. You would add a firewall rule in your router on the WAN interface to allow incoming TCP traffic with destination [2001:db8:1234:1::1]:443 . This rule would have higher precedence than the default rule that blocks all incoming traffic). At this point, anyone in the world who attempts to reach 2001:db8:1234:1::1 will reach your ISP, which will route it to your router's WAN interface (because the ISP delegated the prefix to your router), which will allow the packet to cross from WAN to LAN because of the firewall rule, which will then route it to your webserver.
tenebrisalietum 4y ago
> I think it is a reasonable layer of defense for home networking. Let's say Amazon won't deliver to your apartment number, just a central point at your apartment. - This is like thinking you can stop locking your door because your apartment number isn't public information. - It would be better if your apartment had a direct public address so you could get packages to your doorstep instead of having them wait in some common area. - Most people take regular, obsessive trips to application-level exchanges like "Facebook" to interact with others and are fine with it. Hopefully everything you ever want to do is OK with Facebook.
jimcavel888 4y ago
LeoPanthera 4y ago
Of course. You use a firewall. Thinking of NAT as a firewall is a common misunderstanding. With IPv6 you will still want a firewall, which is often built into your external gateway/router.
gerdesj 4y ago
My work network has a /64 for WAN (yes quite a lot of addresses for a point to point link) and a /48 for "internal use". So WAN is merely a few billion IPs and VLANS - gazillions of IPs. OK we also have six other WANs and allocations but that is another story. We have no need for NAT in the traditional IPv4 sense but NPT is handy for failover and that is why it was invented because IPV6's design lacked one crucial thing: telling the clients which internets are available so they can select which local address to start out from. Perhaps everyone should run BFD(v6) by default.
- throw0101a 4y ago
  > My work network has a /64 for WAN (yes quite a lot of addresses for a point to point link) […] Technical footnote: /127 addresses are supported (and were a thing for a short while) on inter-router links: * https://datatracker.ietf.org/doc/html/rfc6164 https://datatracker.ietf.org/doc/html/rfc6164 Technical technical footnote: you can just use link-local address for inter-router links because all the router cares about is the next next-hop, and you don't need a globally routable address for that. In an IPv6 network, it is possible to use only link-local addresses on infrastructure links between routers. This document discusses the advantages and disadvantages of this approach to facilitate the decision process for a given network. * https://datatracker.ietf.org/doc/html/rfc7404 https://datatracker.ietf.org/doc/html/rfc7404
  - gerdesj 4y ago
    "Technical footnote: /127 addresses are supported" Yes they are but I want a shit load of stuff on my WAN available to the world and I don't want to piss around with NAT n that. The IPv6 address-space is big enough to deal with PtP links. It doesn't really matter, You could do a /127 for WAN and then I allocate a /64 from my /48 for WAN. Or you could use a recent RFC that enables a /64 or smaller to be used for WAN without a separate allocation.
unethical_ban 4y ago
"NAT as security" can be reframed. Instead of a router coming default with NO access control/firewall, and inbound connections being denied by the technical impossibility of addressing an inbound Internet packet to a private address, the industry should shift to "default ACL of allow all outbound, allow none inbound" and then have users craft inbound firewall rules as needed.
- mort96 4y ago
  > and then have users craft inbound firewall rules as needed Try explaining that to non-techies. There's a reason UPnP exists. We would ideally want something like NAT hole punching but more standardized.
1MachineElf 4y ago
>Something I'm a bit fuzzy on, but can WAN/LAN address separation be done without NAT? Yes, it can. I used to work in a place that had so many public IPv4 addresses that they were using them for laptops and workstations. With a good firewall configuration it is certainly possible. However I agree with you that IPv6 NAT may be useful still.

zamalek 4y ago

The IPv6 answer is Network Prefix Translation, the article has more details on what it does.

Arnavion 4y ago

Depends on what you mean by "separation". My LAN devices have IPv6 addresses that would be reachable from the WAN if my router's firewall didn't block incoming packets to those addresses. For some of those devices that host public services, I enable traffic just for the relevant protocol and port to their IP, instead of bothering with port forwarding.

gary_0 4y ago
This answer is what every argument about IPv6 and NAT boils down to: they say "NAT" but really mean "firewall". In my opinion, using NAT for IPv6 networks is just a false sense of security to make you think LAN nodes are more protected because their address numbers look different, when all you're really trying to say is "don't route to this node from outside".
- dopp0 4y ago
  why it would be a 'false' sense of security if it's not exposed? I don't seem to get it as 'security through obscurity' at all. sincere question, I'm not a network guy.
redblacktree 4y ago
I'm not a networking guy. Do you think that approach would work for a device behind CG-NAT? (i.e. route the IPv6 address over the WAN, rather than port forwarding; which I can't do because of the CG-NAT)
- Arnavion 4y ago
  You mean you have CGNAT for IPv4 but a publically routable IPv6 delegated subnet? If so, sure, what I wrote depends only on the IPv6 delegated subnet. How you get your IPv4 address is not relevant to it. What I'm saying is that if you can get, say, 2001:db8:1234::/48 delegated to your router, then: 1. You would configure your LAN to have the subnet 2001:db8:1234:1::/64 2. You would configure the webserver on your LAN to have a static IP like 2001:db8:1234:1::1 3. You would add a firewall rule in your router on the WAN interface to allow incoming TCP traffic with destination [2001:db8:1234:1::1]:443 . This rule would have higher precedence than the default rule that blocks all incoming traffic). At this point, anyone in the world who attempts to reach 2001:db8:1234:1::1 will reach your ISP, which will route it to your router's WAN interface (because the ISP delegated the prefix to your router), which will allow the packet to cross from WAN to LAN because of the firewall rule, which will then route it to your webserver.

tenebrisalietum 4y ago

> I think it is a reasonable layer of defense for home networking. Let's say Amazon won't deliver to your apartment number, just a central point at your apartment. - This is like thinking you can stop locking your door because your apartment number isn't public information. - It would be better if your apartment had a direct public address so you could get packages to your doorstep instead of having them wait in some common area. - Most people take regular, obsessive trips to application-level exchanges like "Facebook" to interact with others and are fine with it. Hopefully everything you ever want to do is OK with Facebook.

jimcavel888 4y ago

LeoPanthera 4y ago

Of course. You use a firewall. Thinking of NAT as a firewall is a common misunderstanding. With IPv6 you will still want a firewall, which is often built into your external gateway/router.

gerdesj 4y ago

My work network has a /64 for WAN (yes quite a lot of addresses for a point to point link) and a /48 for "internal use". So WAN is merely a few billion IPs and VLANS - gazillions of IPs. OK we also have six other WANs and allocations but that is another story. We have no need for NAT in the traditional IPv4 sense but NPT is handy for failover and that is why it was invented because IPV6's design lacked one crucial thing: telling the clients which internets are available so they can select which local address to start out from. Perhaps everyone should run BFD(v6) by default.

throw0101a 4y ago
> My work network has a /64 for WAN (yes quite a lot of addresses for a point to point link) […] Technical footnote: /127 addresses are supported (and were a thing for a short while) on inter-router links: * https://datatracker.ietf.org/doc/html/rfc6164 https://datatracker.ietf.org/doc/html/rfc6164 Technical technical footnote: you can just use link-local address for inter-router links because all the router cares about is the next next-hop, and you don't need a globally routable address for that. In an IPv6 network, it is possible to use only link-local addresses on infrastructure links between routers. This document discusses the advantages and disadvantages of this approach to facilitate the decision process for a given network. * https://datatracker.ietf.org/doc/html/rfc7404 https://datatracker.ietf.org/doc/html/rfc7404
- gerdesj 4y ago
  "Technical footnote: /127 addresses are supported" Yes they are but I want a shit load of stuff on my WAN available to the world and I don't want to piss around with NAT n that. The IPv6 address-space is big enough to deal with PtP links. It doesn't really matter, You could do a /127 for WAN and then I allocate a /64 from my /48 for WAN. Or you could use a recent RFC that enables a /64 or smaller to be used for WAN without a separate allocation.

unethical_ban 4y ago

"NAT as security" can be reframed. Instead of a router coming default with NO access control/firewall, and inbound connections being denied by the technical impossibility of addressing an inbound Internet packet to a private address, the industry should shift to "default ACL of allow all outbound, allow none inbound" and then have users craft inbound firewall rules as needed.

mort96 4y ago
> and then have users craft inbound firewall rules as needed Try explaining that to non-techies. There's a reason UPnP exists. We would ideally want something like NAT hole punching but more standardized.

1MachineElf 4y ago

>Something I'm a bit fuzzy on, but can WAN/LAN address separation be done without NAT? Yes, it can. I used to work in a place that had so many public IPv4 addresses that they were using them for laptops and workstations. With a good firewall configuration it is certainly possible. However I agree with you that IPv6 NAT may be useful still.