5 ms·

I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward

I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The best idea I can come up with (at least right now) is: put all less trustworthy (read: Closed source) devices into a special legacy IPv4 network and only use IPv6 on my workstation and little Raspis?

nickstinemates 4y ago
Network segmentation, i.e use of vlans is the traditional way to solve this.
- Godel_unicode 4y ago
  Not sure why you’re being downvoted, this is a very good answer. Maybe because you left out the implied “and then firewall off that vlan”?
  - soebbing 4y ago
    Yeah, it seems to be the common consensus to just block everything going in and just make exceptions, where you really want to offer a service to the internet. Makes total sense, thinking about it. I guess, all those years of just sitting behind a NAT makes one forget all these networking basics if you're not using them regularly. Moving closed-source IoT devices into a special vlan, with some even more rigid rules (something like: only allow http/https traffic into the internal network) might be an additional level of security. Thank all of you for your replies!
nijave 4y ago
>cannot be reached from the internet directly Stateful firewall that allows outgoing connections and blocks incoming (or maybe blocks both) In general, you probably don't want to allow unsolicited incoming connections to any devices, regardless of IoT.
cnorthwood 4y ago
You'd probably do it in the same way you'd do it with NAT, by using a stateful firewall blocking inbound connections (it's just that you get this for "free" with NAT)
jhoelzel 4y ago
You can configure your local ipv6 net without SLAAC (Stateless Address Autoconfiguration). Or differently put, you don't need to use the net your isp provides everywhere, ipv6 can still use NAT if you want it to: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6
vel0city 4y ago
> what would be the best way forward to keep it that way in a IPv6-only future? Firewalls. You configure what traffic should be allowed from who to who. Default deny incoming traffic, and its the same behavior as when you had a NAT. Something having a routable IP address doesn't mean it needs to receive all traffic addressed to it.
- groestl 4y ago
  My ISP does not allow BYOM (bring your own modem) and assigns me a /64 net, so I have a hard time running an (ipv6) router behind it that would do the firewalling.. I guess I'm stuck with ipv4 for the time being...
  - throwaway742 4y ago
    https://www.fortinet.com/resources/cyberglossary/transparent-firewall https://www.fortinet.com/resources/cyberglossary/transparent...
  - justeleblanc 4y ago
    Does your ISP's router not have a firewall?
    - groestl 4y ago
      A very very inconvenient one.
  - aaronax 4y ago
    A firewall can be run "in-line" and not have IP addresses on the interfaces. On a Palo Alto firewall this would be a "virtual wire", and "transparent firewall" or "bridging firewall" would be other common terms. Examples: https://docs.opnsense.org/manual/how-tos/transparent_bridge.html https://docs.opnsense.org/manual/how-tos/transparent_bridge.... https://docs.netgate.com/pfsense/en/latest/bridges/index.html#internal-external-bridges https://docs.netgate.com/pfsense/en/latest/bridges/index.htm... https://www.fortinet.com/resources/cyberglossary/transparent-firewall https://www.fortinet.com/resources/cyberglossary/transparent...
samcat116 4y ago
Most consumer routers will disable inbound connections for the IPv6 prefix by default from what I've seen. If not thats easy to enable.
wolrah 4y ago
> I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The same exact way you do it right now. Think of NAT as an implicit default-deny firewall rule, that's all it's doing. Basically any firewall worth using will do exactly the same thing in IPv6, deny unsolicited inbound traffic unless explicitly allowed. For some reason there's this belief out there that a device having a globally routable IP address inherently means it's globally reachable, and that's just not true. Your firewall still works exactly the same way.
- jiggawatts 4y ago
  Not to mention that 99.99% of IoT devices connect to the mothership using an outbound connection, which is permitted by default on both IPv6 and IPv4+NAT.
- martinald 4y ago
  But how does eg a device programmatically tell the firewall to allow traffic in in this case? This is done via UPNP on ipv4 NAT. If you're going to say there isn't a way and you need to add the firewall rules manually, then this is absolutely no improvement for 99%+ of consumer users who have absolutely no chance of understanding how to configure that. Think of for example Xbox users. On ipv4 with NAT it automatically configures it for serving games using upnp. If you had ipv6 only with a default deny rule and no upnp equivalent then the Xbox cannot open itself up to incoming connections. It's actually a downgrade in terms of "P2P" connectivity from NAT.
  - zoredache 4y ago
    Lots router have UPNP disabled or blocked, and thing still work. UPNP isn't great. First The firewalls are stateful. Client inside your network attempts to connect to some system outside. The firewall adds an entry to the state table with client ip, destination ip, protocol, ports, and so on. If an incoming packet is received by the firewall, the state table is checked. If there is an matching entry for the ips, proto, ports, etc, then the packet is forwarded. If there is no match the packet is dropped or rejected depending on your config. So it is easy to permit packets based on the interface it was received or transmitted on. Ports can be opened for some incoming traffic pretty much the same with as IPv4 using STUN, TURN, and so on. Past that, you can do manual port forwards the same way you do with IPv4.
wyager 4y ago
Put internet of shit devices on their own VLAN(s). Almost all wifi APs today support multiple SSIDs with separate VLANs. Have your firewall block inbound connections to devices on that VLAN. Every OS firewall has built-in support for this. I spent a lot of time figuring out how to do all this in the most efficient way (in terms of my time and effort) during covid, and I suggest getting any arbitrary box with 2 ethernet ports and putting freebsd on it.
- soebbing 4y ago
  I actually thought about that for a minute when I set up my home network a while ago, but that seems to be a pretty hard (or at least inconvenient) problem. Often I need to access a device from my local network (think: use my phone to control Wi-Fi LED Strips, Sonos speakers, etc.), which makes it impossible (I guess?) to separate these devices into their own network completely (if they aren't controlled by an online service in general). Or is it possible to allow access from my trusted network INTO the restricted network, but not the other way around? Total network noob here, in case you haven't figured that out yet. :)
  - throwaway742 4y ago
    >Or is it possible to allow access from my trusted network INTO the restricted network, but not the other way around? Yes
  - labcomputer 4y ago
    Each of the VLAN is (or can be) just another network from the router’s and firewall’s perspective. So you just have to set up appropriate firewall rules to allow traffic between the networks that you want to communicate. You could, for example, allow only TCP traffic initiated by hosts in the “normal” VLAN to hosts the IoT VLAN. So IoT stuff can’t initiate outgoing connections to any other network, and can only receive TCP connections from one network. You can also set up an MDNS reflector on your router if your IoT devices use that (e.g. HomeKit) to send data proactively back to “normal network” hosts.
  - wyager 4y ago
screamingninja 4y ago
It's worth noting that NAT is not a security feature in itself, but rather a way of conserving public IP addresses and hiding the internal network structure. The best way is to use a stateful firewall that is built into nearly every router. Another option is to use IPv6 Unique Local Addresses (ULA), which are similar to private IPv4 addresses and can only be used within a specific site. This approach enables internal connectivity for devices that do not require direct access to the Internet. I use it for several IoT devices that I do not want reaching out to the mothership.
adriancr 4y ago
Although I'm going to get comments saying this is wrong... What I did was: - IPv6 DHPC - private address range within: fc00::/7 - IPv6 NAT, same as for IPv4. - Firewall. Why: - digital ocean only allowed ~16 IPv6 addresses. - I wanted a local IPv6 network exiting through digital ocean. - I see no reason to give public route-able addresses to each device in my home (allows remote websites to determine who is calling it and set up profiles/target each remote device). - Sure, privacy extensions which cycle unique addresses, but it still allows profiling based on source address, even if a bit of work is needed for each new addresses.
- Xelynega 4y ago
  Why would your firewall allow your ipv6 IoT devices to receive inbound connections from the internet? Whats the difference between "ipv6 Nat" and a firewall when theres not likely to be any address overlap.
  - adriancr 4y ago
    > Why would your firewall allow your ipv6 IoT devices to receive inbound connections from the internet? It does not, problem is with outbound connections. > Whats the difference between "ipv6 Nat" and a firewall when theres not likely to be any address overlap. Outbound connections can be profiled by remote websites. With NAT (Well... Port-address-translation to be fair, so single outgoing address), traffic can't as easily be profiled. Imagine ISPs/Ad providers having easier time identifying you, your spouse, your kids, etc. (and device, and so on just by observing addresses) With initial SLAAC it is even nicer as MAC address is included in the address... Can look up device much easier just cross reference manufacturer database...
- xnyanta 4y ago
  Digital Ocean has horrible IPv6 support, I would just move to another provider. Most VPS providers will, at the very least, provide you with a /64.
gnramires 4y ago
I think NAT is a bit of an unfortunate "janky" solution of addressing protocols (giving some security and some address expansion, and sacrificing interoperability and connectivity). I think the security part should be fixed by proper firewalls and/or authentication -- in fact some kind of security mechanism should be default for home routers and such. I think ideally we should also think of new interoperable defenses that fill the NAT gap. Perhaps each device should have an authentication key apart from its IP, which it could pass onto trusted devices like local network routers, which would only allow authenticated incoming data. Maybe even better would be a global scheme including this authentication and also more private addressed (than IP), although that would probably require a redesign of IP and might be a project for the far future.

nickstinemates 4y ago

Network segmentation, i.e use of vlans is the traditional way to solve this.

Godel_unicode 4y ago
Not sure why you’re being downvoted, this is a very good answer. Maybe because you left out the implied “and then firewall off that vlan”?
- soebbing 4y ago
  Yeah, it seems to be the common consensus to just block everything going in and just make exceptions, where you really want to offer a service to the internet. Makes total sense, thinking about it. I guess, all those years of just sitting behind a NAT makes one forget all these networking basics if you're not using them regularly. Moving closed-source IoT devices into a special vlan, with some even more rigid rules (something like: only allow http/https traffic into the internal network) might be an additional level of security. Thank all of you for your replies!

nijave 4y ago

>cannot be reached from the internet directly Stateful firewall that allows outgoing connections and blocks incoming (or maybe blocks both) In general, you probably don't want to allow unsolicited incoming connections to any devices, regardless of IoT.

cnorthwood 4y ago

You'd probably do it in the same way you'd do it with NAT, by using a stateful firewall blocking inbound connections (it's just that you get this for "free" with NAT)

jhoelzel 4y ago

You can configure your local ipv6 net without SLAAC (Stateless Address Autoconfiguration). Or differently put, you don't need to use the net your isp provides everywhere, ipv6 can still use NAT if you want it to: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6

vel0city 4y ago

> what would be the best way forward to keep it that way in a IPv6-only future? Firewalls. You configure what traffic should be allowed from who to who. Default deny incoming traffic, and its the same behavior as when you had a NAT. Something having a routable IP address doesn't mean it needs to receive all traffic addressed to it.

groestl 4y ago
My ISP does not allow BYOM (bring your own modem) and assigns me a /64 net, so I have a hard time running an (ipv6) router behind it that would do the firewalling.. I guess I'm stuck with ipv4 for the time being...
- throwaway742 4y ago
  https://www.fortinet.com/resources/cyberglossary/transparent-firewall https://www.fortinet.com/resources/cyberglossary/transparent...
- justeleblanc 4y ago
  Does your ISP's router not have a firewall?
  - groestl 4y ago
    A very very inconvenient one.
- aaronax 4y ago
  A firewall can be run "in-line" and not have IP addresses on the interfaces. On a Palo Alto firewall this would be a "virtual wire", and "transparent firewall" or "bridging firewall" would be other common terms. Examples: https://docs.opnsense.org/manual/how-tos/transparent_bridge.html https://docs.opnsense.org/manual/how-tos/transparent_bridge.... https://docs.netgate.com/pfsense/en/latest/bridges/index.html#internal-external-bridges https://docs.netgate.com/pfsense/en/latest/bridges/index.htm... https://www.fortinet.com/resources/cyberglossary/transparent-firewall https://www.fortinet.com/resources/cyberglossary/transparent...

samcat116 4y ago

Most consumer routers will disable inbound connections for the IPv6 prefix by default from what I've seen. If not thats easy to enable.

wolrah 4y ago

> I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The same exact way you do it right now. Think of NAT as an implicit default-deny firewall rule, that's all it's doing. Basically any firewall worth using will do exactly the same thing in IPv6, deny unsolicited inbound traffic unless explicitly allowed. For some reason there's this belief out there that a device having a globally routable IP address inherently means it's globally reachable, and that's just not true. Your firewall still works exactly the same way.

jiggawatts 4y ago
Not to mention that 99.99% of IoT devices connect to the mothership using an outbound connection, which is permitted by default on both IPv6 and IPv4+NAT.
martinald 4y ago
But how does eg a device programmatically tell the firewall to allow traffic in in this case? This is done via UPNP on ipv4 NAT. If you're going to say there isn't a way and you need to add the firewall rules manually, then this is absolutely no improvement for 99%+ of consumer users who have absolutely no chance of understanding how to configure that. Think of for example Xbox users. On ipv4 with NAT it automatically configures it for serving games using upnp. If you had ipv6 only with a default deny rule and no upnp equivalent then the Xbox cannot open itself up to incoming connections. It's actually a downgrade in terms of "P2P" connectivity from NAT.
- zoredache 4y ago
  Lots router have UPNP disabled or blocked, and thing still work. UPNP isn't great. First The firewalls are stateful. Client inside your network attempts to connect to some system outside. The firewall adds an entry to the state table with client ip, destination ip, protocol, ports, and so on. If an incoming packet is received by the firewall, the state table is checked. If there is an matching entry for the ips, proto, ports, etc, then the packet is forwarded. If there is no match the packet is dropped or rejected depending on your config. So it is easy to permit packets based on the interface it was received or transmitted on. Ports can be opened for some incoming traffic pretty much the same with as IPv4 using STUN, TURN, and so on. Past that, you can do manual port forwards the same way you do with IPv4.

wyager 4y ago

Put internet of shit devices on their own VLAN(s). Almost all wifi APs today support multiple SSIDs with separate VLANs. Have your firewall block inbound connections to devices on that VLAN. Every OS firewall has built-in support for this. I spent a lot of time figuring out how to do all this in the most efficient way (in terms of my time and effort) during covid, and I suggest getting any arbitrary box with 2 ethernet ports and putting freebsd on it.

soebbing 4y ago
I actually thought about that for a minute when I set up my home network a while ago, but that seems to be a pretty hard (or at least inconvenient) problem. Often I need to access a device from my local network (think: use my phone to control Wi-Fi LED Strips, Sonos speakers, etc.), which makes it impossible (I guess?) to separate these devices into their own network completely (if they aren't controlled by an online service in general). Or is it possible to allow access from my trusted network INTO the restricted network, but not the other way around? Total network noob here, in case you haven't figured that out yet. :)
- throwaway742 4y ago
  >Or is it possible to allow access from my trusted network INTO the restricted network, but not the other way around? Yes
- labcomputer 4y ago
  Each of the VLAN is (or can be) just another network from the router’s and firewall’s perspective. So you just have to set up appropriate firewall rules to allow traffic between the networks that you want to communicate. You could, for example, allow only TCP traffic initiated by hosts in the “normal” VLAN to hosts the IoT VLAN. So IoT stuff can’t initiate outgoing connections to any other network, and can only receive TCP connections from one network. You can also set up an MDNS reflector on your router if your IoT devices use that (e.g. HomeKit) to send data proactively back to “normal network” hosts.
- wyager 4y ago

screamingninja 4y ago

It's worth noting that NAT is not a security feature in itself, but rather a way of conserving public IP addresses and hiding the internal network structure. The best way is to use a stateful firewall that is built into nearly every router. Another option is to use IPv6 Unique Local Addresses (ULA), which are similar to private IPv4 addresses and can only be used within a specific site. This approach enables internal connectivity for devices that do not require direct access to the Internet. I use it for several IoT devices that I do not want reaching out to the mothership.

adriancr 4y ago

Although I'm going to get comments saying this is wrong... What I did was: - IPv6 DHPC - private address range within: fc00::/7 - IPv6 NAT, same as for IPv4. - Firewall. Why: - digital ocean only allowed ~16 IPv6 addresses. - I wanted a local IPv6 network exiting through digital ocean. - I see no reason to give public route-able addresses to each device in my home (allows remote websites to determine who is calling it and set up profiles/target each remote device). - Sure, privacy extensions which cycle unique addresses, but it still allows profiling based on source address, even if a bit of work is needed for each new addresses.

Xelynega 4y ago
Why would your firewall allow your ipv6 IoT devices to receive inbound connections from the internet? Whats the difference between "ipv6 Nat" and a firewall when theres not likely to be any address overlap.
- adriancr 4y ago
  > Why would your firewall allow your ipv6 IoT devices to receive inbound connections from the internet? It does not, problem is with outbound connections. > Whats the difference between "ipv6 Nat" and a firewall when theres not likely to be any address overlap. Outbound connections can be profiled by remote websites. With NAT (Well... Port-address-translation to be fair, so single outgoing address), traffic can't as easily be profiled. Imagine ISPs/Ad providers having easier time identifying you, your spouse, your kids, etc. (and device, and so on just by observing addresses) With initial SLAAC it is even nicer as MAC address is included in the address... Can look up device much easier just cross reference manufacturer database...
xnyanta 4y ago
Digital Ocean has horrible IPv6 support, I would just move to another provider. Most VPS providers will, at the very least, provide you with a /64.

gnramires 4y ago

I think NAT is a bit of an unfortunate "janky" solution of addressing protocols (giving some security and some address expansion, and sacrificing interoperability and connectivity). I think the security part should be fixed by proper firewalls and/or authentication -- in fact some kind of security mechanism should be default for home routers and such. I think ideally we should also think of new interoperable defenses that fill the NAT gap. Perhaps each device should have an authentication key apart from its IP, which it could pass onto trusted devices like local network routers, which would only allow authenticated incoming data. Maybe even better would be a global scheme including this authentication and also more private addressed (than IP), although that would probably require a redesign of IP and might be a project for the far future.