5 ms·

That's what a firewall is for, NAT does nothing here.

by ArchOversight 4y ago

IshKebab 4y ago
In theory, sure. In practice firewalls can be misconfigured. NAT doesn't have that problem.
- deleted 4y ago
  [deleted]
- justeleblanc 4y ago
  NAT cannot be misconfigured? Really?
  - lxgr 4y ago
    Unconfigured/not activated firewalls usually fail reachable; without explicit port forwarding or exposed hosts, NATs fail unreachable.
    - wolrah 4y ago
      > Unconfigured/not activated firewalls usually fail reachable Local firewalls on devices, maybe, but network firewalls generally are default-deny on untrusted interfaces, and between 0 and 1 interfaces are trusted by default. Back in 2007 Apple's Airport Extreme Base Station shipped with a firmware that defaulted to allowing all IPv6 traffic, which was quickly pointed out in the tech media and fixed in a patch a few months later. A few of the garbage pile combo modem/router devices distributed by ISPs have had similar issues over the years as well. That's not normal behavior though, when it's observed it's rightfully considered a security flaw and tends to get the kind of attention vendors don't want. If you know of a mainstream device that would "fail reachable" as you claim here, name and shame please. > without explicit port forwarding or exposed hosts, NATs fail unreachable. I work in VoIP and can say from plenty of direct experience this is not true. In the modern work from home era I've had to deal with a lot of the aforementioned garbage pile consumer devices and a recurring issue with some of our clients who had older phones is that their users' home routers did the laziest NAT possible and literally just opened a two way hole on port 5060 (SIP) so as long as the phone was communicating with our server and keeping the pinhole open *ANY* other traffic that hit port 5060 was also sent to the phone, which meant they got all kinds of "phantom calls" from bots looking for unprotected SIP relays. Newer phones generally have an option to only accept SIP messages from trusted servers, but older ones sometimes don't so when combined with badly implemented NAT that happens. And yea, obviously that's a consequence of a particularly bad NAT implementation, but your complaint is about an issue that would only occur in a particularly bad IPv6 implementation.
      - hot_gril 4y ago
        It takes effort to make NAT that bad. Something jank like UPnP has to map the port, and even that requires action on the device's part. I don't quite understand your SIP example; how does the router know which IP is the phone's? Bad IPv6 is as simple as not having a firewall or default-allowing it like AirPort did. If Apple can make that mistake, a lot of random manufacturers can too. I can see the whole NATless firewall setup but wouldn't use it for a very long time, to let things settle.
  - joshspankit 4y ago
    Not without being entirely broken. I think you might be bringing in uPnP, DNZ, and other such features. NAT itself is more basic.
    - buzer 4y ago
      One could argue that if e.g. FTP is not working behind the NAT then the NAT is misconfigured. NAT needs to aware of certain protocols so that it can modify the application layer data. Of course, if the protocol added workaround for NAT and NAT is modifying that application layer data then it can cause another set of issues.
      - bert64 4y ago
        IP networking was designed with separate layers, NAT breaks this by having to span multiple layers. Generally NAT gateways only support TCP/UDP, other protocols are simply not supported, which has basically stifled protocol innovation (eg look at SCTP, it has some neat features but is hardly ever used because of NAT). It gets even worse with higher level protocols like FTP. There is such a thing as FTPS (FTP over SSL) but it's rarely used because if you encrypt the traffic then the NAT gateway can't inspect and rewrite the traffic. The same is true of IPSEC/ESP, if you have an encrypted TCP packet encapsulated with ESP the NAT gateway can't keep track of which internal host to forward it to because it can't see the source and destination ports. A normal router does not need to care about anything further up the stack than IP. A firewall does, but even when a firewall doesn't explicitly support a particular protocol you could write a rule allowing any traffic with a particular protocol number between specific hosts is allowed, and anything else denied.
- Arnavion 4y ago
  The amount of firewall config I have to write to let an incoming connection cross from WAN to LAN is the same regardless of whether it goes to a NAT'd IPv4 address or to an IPv6 address.
  - deleted 4y ago
    [deleted]
- op00to 4y ago
  Consumer NAT firewalls have uPnP enabled, right?
  - bonsaibilly 4y ago
    Sometimes. Sometimes it even works, too.
  - IshKebab 4y ago
    Yeah often, but it only responds to requests from the local network.
thesuitonym 4y ago
I know, did you read my whole post?
- dale_glass 4y ago
  It just makes little sense. With IPv6 instead of NAT deciding that port 2000 maps to 192.168.1.3 port 22, you have a firewall that may or not choose to route to xx:yy:zz or not, and to allow an incoming connection over port 22 to that host or not. If you don't want to accept incoming connections to a given machine or network on IPv6 without NAT that's very easy to have.
  - AnonymousPlanet 4y ago
    Maybe people don't want to disclose the number and purposes of interior machines?
    - silon42 4y ago
      Yeah, I had an idea to have an IP for each container (which means almost every "containerized" application soon, possibly even every browser window).
    - deleted 4y ago
      [deleted]
    - petertodd 4y ago
      IPv6 has so many addresses that the default is for /64 subnets to be the minimum network size, allowing devices to choose their addresses randomly within that range. If they do that, 2^64 is big enough that it's not practical to enumerate all devices on a given network. Attempting to do so would be a bandwidth DoS attack: attempting to ping 2^64 devices requires 2^64 * 64 bytes = 1024EiB, roughly equal to total global internet traffic per year. Now, sometimes NAT is needed anyway: QubesOS supports IPv6 using NAT because it splits things up into many different VMs on one computer. But that's a pretty rare case.
      - 4y ago
hot_gril 4y ago
NAT does nothing? The NAT setup is the reason incoming connections don't reach devices on the LAN. I get that you can phrase this as NAT actually being the thing forwarding the packets, and on a home ipv4 router without NAT the incoming packets would just go nowhere, but everyone is talking about the realistic options of NAT vs device having own public IP addr. I get that an ipv6 router can have a firewall with good defaults blocking incoming connections, emulating that aspect of a NAT.
- Dagger2 4y ago
  Indeed, it does nothing. NAT won't stop an inbound connection to your network. You already needed to use a firewall for that in v4. The type of NAT we're talking about here *only* applies to outbound connections. It doesn't do anything at all to inbound connections.

That's what a firewall is for, NAT does nothing here.

IshKebab 4y ago

In theory, sure. In practice firewalls can be misconfigured. NAT doesn't have that problem.

deleted 4y ago
[deleted]
justeleblanc 4y ago
NAT cannot be misconfigured? Really?
- lxgr 4y ago
  Unconfigured/not activated firewalls usually fail reachable; without explicit port forwarding or exposed hosts, NATs fail unreachable.
  - wolrah 4y ago
    > Unconfigured/not activated firewalls usually fail reachable Local firewalls on devices, maybe, but network firewalls generally are default-deny on untrusted interfaces, and between 0 and 1 interfaces are trusted by default. Back in 2007 Apple's Airport Extreme Base Station shipped with a firmware that defaulted to allowing all IPv6 traffic, which was quickly pointed out in the tech media and fixed in a patch a few months later. A few of the garbage pile combo modem/router devices distributed by ISPs have had similar issues over the years as well. That's not normal behavior though, when it's observed it's rightfully considered a security flaw and tends to get the kind of attention vendors don't want. If you know of a mainstream device that would "fail reachable" as you claim here, name and shame please. > without explicit port forwarding or exposed hosts, NATs fail unreachable. I work in VoIP and can say from plenty of direct experience this is not true. In the modern work from home era I've had to deal with a lot of the aforementioned garbage pile consumer devices and a recurring issue with some of our clients who had older phones is that their users' home routers did the laziest NAT possible and literally just opened a two way hole on port 5060 (SIP) so as long as the phone was communicating with our server and keeping the pinhole open *ANY* other traffic that hit port 5060 was also sent to the phone, which meant they got all kinds of "phantom calls" from bots looking for unprotected SIP relays. Newer phones generally have an option to only accept SIP messages from trusted servers, but older ones sometimes don't so when combined with badly implemented NAT that happens. And yea, obviously that's a consequence of a particularly bad NAT implementation, but your complaint is about an issue that would only occur in a particularly bad IPv6 implementation.
    - hot_gril 4y ago
      It takes effort to make NAT that bad. Something jank like UPnP has to map the port, and even that requires action on the device's part. I don't quite understand your SIP example; how does the router know which IP is the phone's? Bad IPv6 is as simple as not having a firewall or default-allowing it like AirPort did. If Apple can make that mistake, a lot of random manufacturers can too. I can see the whole NATless firewall setup but wouldn't use it for a very long time, to let things settle.
- joshspankit 4y ago
  Not without being entirely broken. I think you might be bringing in uPnP, DNZ, and other such features. NAT itself is more basic.
  - buzer 4y ago
    One could argue that if e.g. FTP is not working behind the NAT then the NAT is misconfigured. NAT needs to aware of certain protocols so that it can modify the application layer data. Of course, if the protocol added workaround for NAT and NAT is modifying that application layer data then it can cause another set of issues.
    - bert64 4y ago
      IP networking was designed with separate layers, NAT breaks this by having to span multiple layers. Generally NAT gateways only support TCP/UDP, other protocols are simply not supported, which has basically stifled protocol innovation (eg look at SCTP, it has some neat features but is hardly ever used because of NAT). It gets even worse with higher level protocols like FTP. There is such a thing as FTPS (FTP over SSL) but it's rarely used because if you encrypt the traffic then the NAT gateway can't inspect and rewrite the traffic. The same is true of IPSEC/ESP, if you have an encrypted TCP packet encapsulated with ESP the NAT gateway can't keep track of which internal host to forward it to because it can't see the source and destination ports. A normal router does not need to care about anything further up the stack than IP. A firewall does, but even when a firewall doesn't explicitly support a particular protocol you could write a rule allowing any traffic with a particular protocol number between specific hosts is allowed, and anything else denied.
Arnavion 4y ago
The amount of firewall config I have to write to let an incoming connection cross from WAN to LAN is the same regardless of whether it goes to a NAT'd IPv4 address or to an IPv6 address.
- deleted 4y ago
  [deleted]
op00to 4y ago
Consumer NAT firewalls have uPnP enabled, right?
- bonsaibilly 4y ago
  Sometimes. Sometimes it even works, too.
- IshKebab 4y ago
  Yeah often, but it only responds to requests from the local network.

thesuitonym 4y ago

I know, did you read my whole post?

dale_glass 4y ago
It just makes little sense. With IPv6 instead of NAT deciding that port 2000 maps to 192.168.1.3 port 22, you have a firewall that may or not choose to route to xx:yy:zz or not, and to allow an incoming connection over port 22 to that host or not. If you don't want to accept incoming connections to a given machine or network on IPv6 without NAT that's very easy to have.
- AnonymousPlanet 4y ago
  Maybe people don't want to disclose the number and purposes of interior machines?
  - silon42 4y ago
    Yeah, I had an idea to have an IP for each container (which means almost every "containerized" application soon, possibly even every browser window).
  - deleted 4y ago
    [deleted]
  - petertodd 4y ago
    IPv6 has so many addresses that the default is for /64 subnets to be the minimum network size, allowing devices to choose their addresses randomly within that range. If they do that, 2^64 is big enough that it's not practical to enumerate all devices on a given network. Attempting to do so would be a bandwidth DoS attack: attempting to ping 2^64 devices requires 2^64 * 64 bytes = 1024EiB, roughly equal to total global internet traffic per year. Now, sometimes NAT is needed anyway: QubesOS supports IPv6 using NAT because it splits things up into many different VMs on one computer. But that's a pretty rare case.
    - 4y ago

hot_gril 4y ago

NAT does nothing? The NAT setup is the reason incoming connections don't reach devices on the LAN. I get that you can phrase this as NAT actually being the thing forwarding the packets, and on a home ipv4 router without NAT the incoming packets would just go nowhere, but everyone is talking about the realistic options of NAT vs device having own public IP addr. I get that an ipv6 router can have a firewall with good defaults blocking incoming connections, emulating that aspect of a NAT.

Dagger2 4y ago
Indeed, it does nothing. NAT won't stop an inbound connection to your network. You already needed to use a firewall for that in v4. The type of NAT we're talking about here *only* applies to outbound connections. It doesn't do anything at all to inbound connections.