8 ms·

It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. Yo

• justusthane 4y ago
  > Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. Right? Sure, of course. That’s how firewalls work for IPv4 as well— you have an implicit deny rule at the end, and then allow rules come before it.
• gertrunde 4y ago
  No.... Absolutely no... NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports. And how is "You have to think about which ports you want the NAT gateway to forward." any different from thinking about firewall rules? And most consumer CPE devices (i.e. 'router' etc) are perfectly capable of running a firewall, and often do. And any firewall that doesn't drop inbound traffic by default is not really much use at all. And lastly, if you want you can still do NAT66 if you really must, or IPv6 network prefix translation, which is a slightly improved version.
  • lzaaz 4y ago
    It is a substitute to an actual firewall because I don't need a firewall since NAT makes all of my listening ports unavailable to my WAN.
    • noipv6 4y ago
      those of us who want to have the same port on different computers available to the internet might see that as a bad thing
    • staringback 4y ago
      Oh you don't need a firewall then? I guess accessing a routers web interface from the WAN is a-okay
      • jraph 4y ago
        My shitty cable modem which is also a router does not expose its web interface to the world by default. I don't understand why you'd need a firewall if - you trust devices on your network (yes, big if, but even then: the only reachable ports of a machine from the outside are those explicitly open to the outside, most stuff listens to 127.0.0.1 anyway) - you only configure your NAT to forward ports you would open on your firewall
        • staringback 4y ago
          • jraph 4y ago
            What's with the attacks?? I make sure what I build supports IPv6 (and I'll use tunnels if it's what it takes) but I can't make the only cable ISP available at my place support IPv6. I wish it did. I wish I didn't have to use its garbage hardware.
        • sph 4y ago
          My shitty router also firewalls incoming IPv6 connections by default, unless I manually allow them per-device, so I don't get your point.
          • jraph 4y ago
            My point is lzaaz's one https://news.ycombinator.com/item?id=33897568 https://news.ycombinator.com/item?id=33897568 I didn't think of my cable modem as a firewall. Maybe technically it has one to provide the feature of blocking access to its web interface from the world, or maybe it just listens to the right network. I don't know, but for all intent and purposes, setting up a firewall myself does not seem necessary. To be fair, I was also a bit annoyed by staringback's phrasing.
    • vel0city 4y ago
      Depending on the NAT implementation this can be incredibly naive. Many home routers will send ANY traffic incoming on a port to the NAT'd IP address, even if the sources don't line up. So say Alice is behind a crappy NAT and wants to talk to Bob. Alice's router opens a port on its edge, lets say 1234, and sends traffic to Bob on port 80. Let's say Charles knows Alice's IP address. Charles starts spamming Alice's router, eventually hitting port 1234 with bad data. Alice's router is dumb. It sees traffic on port 1234, checks its NAT table, and sees that data is supposed to go to Alice. It happily rewrites that packet and passes it along to Alice. Now Alice is getting traffic from Bob *and* Charles. Uh oh! Many game consoles are explicitly designed around this bad, broken behavior. You'll open a port to the matchmaking server and then the matchmaking server will tell people to connect to that IP address and port combination. Crappy home routers will happily route that data through its NAT configuration to the console despite the console never explicitly opening up traffic to those other parties. This is why some game consoles will complain about closed NAT versus open NAT.
      • lzaaz 4y ago
        That's like saying that a bad firewall implementation leaks like a sieve. This is not what I was talking about.
        • lazide 4y ago
          Any router running a poor NAT implementation (aka most of them) essentially has a built in firewall bypass for the right attacker. A naive NAT implementation can allow an attacker to bypass the firewall.
          • jraph 4y ago
            Curious, could you expand on this?
            • vel0city 4y ago
              I gave an example just a few comments above this. Alice never wanted Charles' traffic, the firewall should not have let it through. But because the NAT is dumb, and the firewall rules are often tied to the NAT on these crappy home routers, it's allowed. So now because Alice wanted to talk to Bob, she opened a port to the world that she never wanted opened as wide.
    • Dagger2 4y ago
      This is straight up untrue. The only thing NAT does is change the apparent source address of outbound connections. Inbound connections aren't outbound connections, so it does nothing to them. NAT is not a substitute for a firewall.
  • spiritplumber 4y ago
    I use an old Parallax Propeller server as my DMZ, with instructions to log everything and answer "OK" to everything. It's funny what people try to do to it.
    • ddalex 4y ago
      Why don't you write a blog post about this? I'm interested to see what will go on
  • devnullbrain 4y ago
    >NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports. This is one of those infosec tenets that is technically true but functionally unhelpful. Like correct-horse-battery-stable debates. The claim is that IPv4 + NAT + bad firewall is better than IPv6 + bad firewall. Yes, both are insufficient and inferior to a good firewall - but how confident are you that you never interact with a bad firewall?
    • derefr 4y ago
      What makes you think that, for critical systems, "IPv4 + NAT + bad firewall" is the default IPv4 deployment paradigm, rather than "IPV4 + bad firewall"? Sure, big IaaS providers like AWS put you in a VPC by default. But most servers on the net are not hosted in an IaaS; they're hosted using a VPS or bare-metal hosting provider, or just coloed in a DC by their owner. And in all those cases, what that kind of deployment gets you, is a public IPv4 per VM/machine, that anyone on the Internet can march right up and talk to, where it's the responsibility of the machine itself to reject incoming packets (i.e. at the OS level with a kernel firewall.) NAT on IPv4 is only really a default assumption for residential networks. Anywhere else, it's pretty much like the movie WarGames: even the mainframe has a phone number you can call. Staying on IPv4 isn't making anyone safe.
      • 293984j29384 4y ago
        While I don't have any factual proof to refute your statements, in my personal experience almost every organization uses NAT & RFC1918 address space. The only client I can think of in my 20 years of experience that used a public IPv4 per VM/machine was the DoD, specifically, the U.S. Army. From your very last statement, I think you've confused self hosting (like buying a VPS from Digital Ocean and hosting your own blag) and how the real world works (like going to Dell.com and ordering a new laptop). "The mainframe" these days is almost always behind a L4/L7 load balancer or other network device and very rarely directly addressable.
        • SoftTalker 4y ago
  • ehPReth 4y ago
    Who's the monster that created NAT for IPv6 D:
• WastingMyTime89 4y ago
  My own ISP provided router is by default setup to deny all inbound traffic on IPv6. I'm surprised it's not the default everywhere.
  • noipv6 4y ago
    it's the default behaviour by most cpe, correct any exceptions to this should be roasted (my twitter dm's are open)
  • Semaphor 4y ago
    My ISP doesn’t support IPv6 at all, unless I want to voluntarily go behind a CGNAT.
• justsomehnguy 4y ago
  > With IPv6 the entire network is reachable outside by default Only, and only, if you configured your router that way. In both cases, it's absolutely the same: IPv4 -> allowed NAT ports -> NAT network -> Everything else is dropped/denied IPv4 -> allowed ports -> directly routed IPv4 network -> Everything else is dropped/denied IPv6 -> allowed ports -> directly routed IPv6 network -> Everything else is dropped/denied See? Of course if you are on someone's else network (typical for hosting when you aren't provided with your own v6 subnet, instead you have a bunch of addresses) then you should configure firewall on each your machine... which is what you need to do anyway?
• vel0city 4y ago
  > With IPv6 the entire network is reachable outside by default. The entire network might be routable, but it often isn't reachable. My router had a default deny rule, so everything in my network for sure wasn't reachable by default despite having IPv6 addressing. If anything, I like firewalling in IPv6 far better than dealing with NATs. Just imagine having multiple boxes you'd like to reach by SSH or HTTPS from the outside. With NAT, you can only run one on a standard port. With IPv6, there's no need to NAT, everything can just use one of their many public IPv6 addresses, and then I can firewall to allow traffic to each of those boxes at the standard ports. In fact, this gets even cooler. I can then have multiple services all bound to different IP addresses and have different firewall rules related to each of those services. There's so much more possible using IPv6 that you just practically can't do in IPv4, unless you just happened to have a /8 assigned to you back in the day. Think about this: every device in my home network gets more IP addresses assigned to it than there are IP addresses in IPv4. I can have every container on my cluster have its own publicly routable IPv6 address, every application I run could theoretically have its own address and have its own network rules applied. And then I can look at my network edge and immediately identify any and all traffic flowing through that edge. I can't wait until IPv4 is dead and I never have to deal with NAT issues again.
• marcosdumay 4y ago
  > The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. That is usually not true. NAT punching is a thing for decades now.
  • pflanze 4y ago
    - NAT punching does require cooperation of programs on the protected machines, though, no? How is it different from them inviting traffic in any other way (like, requesting a page via https from an infected server could hijack the client on the protected machine if the client has security holes in the right places; the https client is willing to get traffic here, just as some VoIP program is willing to receive a call)? - And is it any different from a stateful firewall on IPv6?
    • marcosdumay 4y ago
      > NAT punching does require cooperation of programs on the protected machines As does listening to a port. > And is it any different from a stateful firewall on IPv6? Hum, not much. And that's the point, all of those are basically the same. NAT doesn't give you much security, and NAT without a firewall usually gives you less security than a firewall, since NAT usually is configured for connectivity, and a firewall for protection.
      • pflanze 4y ago
        > > NAT punching does require cooperation of programs on the protected machines > As does listening to a port. Listening on a port is for incoming connections, exactly the kind that we're blocking with either a (stateful) firewall or NAT. Listening on a port is a declaration of a program (a server) to communicate with whichever counter party can connect to this port (until the server program decides to close the connection), and limiting that reach is the topic here. NAT hole punching is more like an outgoing connection in that the client agrees to communicate with a particular single counter party for each punch. That's why I made the comparison to opening an https connection to a server. The risks look basically the same to me (the client has to trust the server in the https case, and the client has to trust the intermediating server in the NAT hole punching case to intermediate with the right client; admittedly it additionally has to trust the other peer (e.g. that its compressed data doesn't try to break decoders), but in cases where it communicates with another party via a server the situation may be the same again (unless the server re-encodes the data and does that securely)). > And that's the point, all of those are basically the same. That's a relief for me to hear, as I started to doubt myself whether I am missing something ("why is it not OK to use NAT to block incoming connections?"). > since NAT usually is configured for connectivity, and a firewall for protection. Sure, a firewall can add additional restrictions. I have always understood NAT's protection to be limited to prohibiting incoming connections (unless when adding port forwarding), while allowing outgoing connections including NAT hole punching. I'm also talking in the context of configuring a Linux machine via iptables (where you configure both NAT and other firewalling rules). Maybe you're thinking more in terms of consumer "NAT" vs. consumer "firewalling" devices and their respective capabilities. Or maybe this whole "don't consider NAT to be a security feature" movement is just to pull people towards IPv6 by saying they don't need NAT to be as secure (or better if they configure additional restrictions)?
• jeroenhd 4y ago
  Every consumer and professional router I've seen comes with a deny rule for incoming traffic by default, unless the device is configured as a "router router", like inside an ISP. NAT has many problems because people rely on it for security. For example, many shitty IoT devices and even consoles (looking at you, Nintendo Switch) tell you to put their device in the DMZ to make them work. The norm for IPv6 in practice is that you've got your firewall on and need to make exceptions for ports you want open, just like on IPv4, except that with IPv6 you don't need some kind of interactive state machine attackers can confuse and abuse running inside your router's kernel (ALG).
• Quillbert182 4y ago
  I just started University, and as a result I have had my first experience of Internet without NAT. The firewall rules provided are simply On or Off, which has been very strange to me, and it doesn’t seem all that secure.
• crest 4y ago
  > It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward. Have you never had more than a handful of IPv4 addresses? IPv6 works the same in this regard as a router IPv4 network e.g. universities, large/old enterprises etc. NAT started as a workaround to make the available public address space last longer. The address (and port) translation wasn't intended as a security feature on its own. These days lots of protocols automatically deal with NAT and mostly manage to establish bidirectional communication over UDP or TCP through NATs. I rather deal with stateful firewalls and public IPv6 addresses end to end instead of gluing the segments of flows between IPv4 translators back together.
  • oceanplexian 4y ago
    NAT wasn’t started as a way to make the address space last longer. A few decades ago you could get hundreds of thousands of IP’s by filling out a form with ARIN without any serious justification if you wanted them. I worked at an ISP and IP’s weren’t a scarce resource. NAT started because having a network didn’t mean you were necessarily participating in the Internet. Globally unique addresses weren’t that important. At some point you had this decentralized situation where local networks wanted to bridge their users address space to the Internet without renumbering everything and thus NAT was born.
• asveikau 4y ago
  > Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. Right? That's what reasonable people would do for a V4 network too.
• anilakar 4y ago
  RFC7084 says a NAT-like stateful firewall mechanism should be enabled by default on customer IPv6 routers.