11 ms·

NAT and a Firewall are two different concepts. What's wrong with a firewall that blocks everything by default, yet all your devices have a public IP?

by mavhc 4y ago

waych 4y ago
Maybe you don't want to reveal your internal infrastructure to the world? Seems like basic opsec.
- RealStickman_ 4y ago
  There's no chance of anybody guessing your infrastructure just by looking at your subnet. (Minimum is /64, which is HUGE!)
  - waych 4y ago
    Every packet leaving an IPv6 network that isn't NATed has an effective node ID in the packet. No need to guess just look at the packets.
    - bityard 4y ago
      Most devices support privacy extensions (temporary v6 addresses) for this exact reason. https://www.rfc-editor.org/rfc/rfc4941 https://www.rfc-editor.org/rfc/rfc4941
      - waych 4y ago
        This helps mitigate correlations over time but doesn't do anything to mask the identity of the node within a given refresh interval (default one day).
      - jlokier 4y ago
        Those IPv6 privacy extensions still reveal when the same node connects to a sequence of destinations within the address change interval, though. E.g. observers can see a single device connects to Facebook, OnlyFans, Pornhub and PayPal in that order. Behind a NAT, observers can only make that connection (using only addresses) for the network as a whole, instead of an individual device on the network. So the privacy extensions are weaker than NAT (If the IPv6 privacy extensions used a different address for each connection, they would be more like NAT in this regard.) That said, other observable clues still allow connections from a single device to be associated, NAT or not. There's TCP OS fingerprinting for example, and the close timing of related connections.
        bert64 4y ago
        That requires someone who has the ability to monitor all your traffic - ie the government, your ISP, or a hacker who has infiltrated one of those two. In this scenario it's a lot more work trying to map out your infrastructure than to try performing a MITM connection against some of your outbound traffic.
    - justeleblanc 4y ago
      Your machines could change their IPs for every second of every day and you wouldn't come close to exhausting your /64 subnet for the next billion years.
      - waych 4y ago
        The limit of changing addresses once every N seconds as N approaches 0 is equal to offline. With any usable N, a clever observer would still easily work out what you were doing and still map out your infrastructure.
        ianburrell 4y ago
        Why would changing N seconds break network? It would presumably keep active addresses until connections finish. IPv6 requires supporting multiple addresses per interface. More reasonable is to use new address for each connection. Then nobody can tell if 10 addresses and 10 connections are one device or ten.
        waych 4y ago
        This looks like NAT pushed down to the endpoint itself. You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. What are valid values in the scenario you are proposing? The defaults are 1 week / 1 day, so 7X. If you chose to rotate each second, and say allowed addresses to only be valid for say 20 minutes, this still appears to be a ~1200X blowup in routing overheads.
        kazen44 4y ago
        > You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. They have not? The global routing table size for ipv6 at max is a /32 (if i remember correctly) every customer gets a /56 prefix to use in their network, so the routing table entry would still be the same, no matter how many addresses you use to cycle through in your /64. ARP caches do not exist in IPv6, and Neighbour discovery does not have the same "cache" mechanism as ARP does, it uses an entirely different mechanism for neighbour discovery. (which is also far more lightweight considering it is using multicast, compared to the broadcast of ARP).
- deleted 4y ago
  [deleted]
- mavhc 4y ago
  The whole world? How would that happen?
  - waych 4y ago
    Not the whole world. Just the world is sufficient.
- wjholden 4y ago
  For HTTP/HTTPS, proxy servers (forward and reverse) offer an equivalent ability to hide addresses and a lot more features for security and performance.
r3trohack3r 4y ago
> NAT and a Firewall are two different concepts. They are, but in practice they are muddled together and I suspect people are going to create subnets with IPv6 in the name of security. In IPv4 NAT is used to make sure your laptop isn't exposed to random script kiddies trying to scan for vulnerable services behind your router. A fun exercise is to plug a RaspberryPi up directly to a public facing IP address and log every packet it receives. Then give those scripts a few services to detect (HTTP server, SSH server, etc.) and look at how the traffic shifts from scanning for ports to scanning for vulnerabilities. Being connected directly to the public internet is a real eye opening experience. I do believe future IPv6 networks will have gateway machines and/or bastions that are connected to the public internet with public IPv6 addresses. And then they'll have an interior network that they use NAT for. Individual machines will not be routable or discoverable without going through a bastion/gateway that explicitly controls the flow of traffic into a network. Not because this is the ideal way to structure an IPv6 network, but because this pattern is going to carry over from the IPv4 world and there is a lot of momentum in tribal knowledge using NAT as a form of firewall.
- Arnavion 4y ago
  >In IPv4 NAT is used to make sure your laptop isn't exposed to random script kiddies trying to scan for vulnerable services behind your router. NAT does nothing for that. Those incoming connections are dropped on the WAN interface before NAT would even be involved. Which is why it works exactly the same way regardless of whether the destination IP for that traffic was IPv4 or IPv6.
- CircleSpokes 4y ago
  >In IPv4 NAT is used to make sure your laptop isn't exposed to random script kiddies trying to scan for vulnerable services behind your router. A fun exercise is to plug a RaspberryPi up directly to a public facing IP address and log every packet it receives. Then give those scripts a few services to detect (HTTP server, SSH server, etc.) and look at how the traffic shifts from scanning for ports to scanning for vulnerabilities. Being connected directly to the public internet is a real eye opening experience. That isn't really feasible with IPV6 though is it? The smallest IPV6 subnet is 18,446,744,073,709,551,616 addresses, so even if you setup a Pi fully open to the world with default passwords the chance of someone scanning it is basically zero. That type of scanning only works because the IPV4 range is so small (& you can efficiently ignore large parts of it like the US DOD space, private addresses, etc).
op00to 4y ago
Someone might know your IP, and somehow that information is delicious and irresistible to evil .. uh .. spammers?
- CaliforniaKarl 4y ago
  In that case, have your system use a random IP. Right now, my macOS system has four publicly-routable IPv6 IPs, all random. New ones are generated, and old ones removed, regularly. https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ https://www.internetsociety.org/resources/deploy360/2014/pri...

NAT and a Firewall are two different concepts. What's wrong with a firewall that blocks everything by default, yet all your devices have a public IP?

by mavhc 4y ago

NAT and a Firewall are two different concepts. What's wrong with a firewall that blocks everything by default, yet all your devices have a public IP?

waych 4y ago

Maybe you don't want to reveal your internal infrastructure to the world? Seems like basic opsec.

RealStickman_ 4y ago
There's no chance of anybody guessing your infrastructure just by looking at your subnet. (Minimum is /64, which is HUGE!)
- waych 4y ago
  Every packet leaving an IPv6 network that isn't NATed has an effective node ID in the packet. No need to guess just look at the packets.
  - bityard 4y ago
    Most devices support privacy extensions (temporary v6 addresses) for this exact reason. https://www.rfc-editor.org/rfc/rfc4941 https://www.rfc-editor.org/rfc/rfc4941
    - waych 4y ago
      This helps mitigate correlations over time but doesn't do anything to mask the identity of the node within a given refresh interval (default one day).
    - jlokier 4y ago
      Those IPv6 privacy extensions still reveal when the same node connects to a sequence of destinations within the address change interval, though. E.g. observers can see a single device connects to Facebook, OnlyFans, Pornhub and PayPal in that order. Behind a NAT, observers can only make that connection (using only addresses) for the network as a whole, instead of an individual device on the network. So the privacy extensions are weaker than NAT (If the IPv6 privacy extensions used a different address for each connection, they would be more like NAT in this regard.) That said, other observable clues still allow connections from a single device to be associated, NAT or not. There's TCP OS fingerprinting for example, and the close timing of related connections.
      - bert64 4y ago
        That requires someone who has the ability to monitor all your traffic - ie the government, your ISP, or a hacker who has infiltrated one of those two. In this scenario it's a lot more work trying to map out your infrastructure than to try performing a MITM connection against some of your outbound traffic.
  - justeleblanc 4y ago
    Your machines could change their IPs for every second of every day and you wouldn't come close to exhausting your /64 subnet for the next billion years.
    - waych 4y ago
      The limit of changing addresses once every N seconds as N approaches 0 is equal to offline. With any usable N, a clever observer would still easily work out what you were doing and still map out your infrastructure.
      - ianburrell 4y ago
        Why would changing N seconds break network? It would presumably keep active addresses until connections finish. IPv6 requires supporting multiple addresses per interface. More reasonable is to use new address for each connection. Then nobody can tell if 10 addresses and 10 connections are one device or ten.
        waych 4y ago
        This looks like NAT pushed down to the endpoint itself. You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. What are valid values in the scenario you are proposing? The defaults are 1 week / 1 day, so 7X. If you chose to rotate each second, and say allowed addresses to only be valid for say 20 minutes, this still appears to be a ~1200X blowup in routing overheads.
        kazen44 4y ago
        > You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. They have not? The global routing table size for ipv6 at max is a /32 (if i remember correctly) every customer gets a /56 prefix to use in their network, so the routing table entry would still be the same, no matter how many addresses you use to cycle through in your /64. ARP caches do not exist in IPv6, and Neighbour discovery does not have the same "cache" mechanism as ARP does, it uses an entirely different mechanism for neighbour discovery. (which is also far more lightweight considering it is using multicast, compared to the broadcast of ARP).
deleted 4y ago
[deleted]
mavhc 4y ago
The whole world? How would that happen?
- waych 4y ago
  Not the whole world. Just the world is sufficient.
wjholden 4y ago
For HTTP/HTTPS, proxy servers (forward and reverse) offer an equivalent ability to hide addresses and a lot more features for security and performance.

r3trohack3r 4y ago

> NAT and a Firewall are two different concepts. They are, but in practice they are muddled together and I suspect people are going to create subnets with IPv6 in the name of security. In IPv4 NAT is used to make sure your laptop isn't exposed to random script kiddies trying to scan for vulnerable services behind your router. A fun exercise is to plug a RaspberryPi up directly to a public facing IP address and log every packet it receives. Then give those scripts a few services to detect (HTTP server, SSH server, etc.) and look at how the traffic shifts from scanning for ports to scanning for vulnerabilities. Being connected directly to the public internet is a real eye opening experience. I do believe future IPv6 networks will have gateway machines and/or bastions that are connected to the public internet with public IPv6 addresses. And then they'll have an interior network that they use NAT for. Individual machines will not be routable or discoverable without going through a bastion/gateway that explicitly controls the flow of traffic into a network. Not because this is the ideal way to structure an IPv6 network, but because this pattern is going to carry over from the IPv4 world and there is a lot of momentum in tribal knowledge using NAT as a form of firewall.

Arnavion 4y ago
>In IPv4 NAT is used to make sure your laptop isn't exposed to random script kiddies trying to scan for vulnerable services behind your router. NAT does nothing for that. Those incoming connections are dropped on the WAN interface before NAT would even be involved. Which is why it works exactly the same way regardless of whether the destination IP for that traffic was IPv4 or IPv6.
CircleSpokes 4y ago
>In IPv4 NAT is used to make sure your laptop isn't exposed to random script kiddies trying to scan for vulnerable services behind your router. A fun exercise is to plug a RaspberryPi up directly to a public facing IP address and log every packet it receives. Then give those scripts a few services to detect (HTTP server, SSH server, etc.) and look at how the traffic shifts from scanning for ports to scanning for vulnerabilities. Being connected directly to the public internet is a real eye opening experience. That isn't really feasible with IPV6 though is it? The smallest IPV6 subnet is 18,446,744,073,709,551,616 addresses, so even if you setup a Pi fully open to the world with default passwords the chance of someone scanning it is basically zero. That type of scanning only works because the IPV4 range is so small (& you can efficiently ignore large parts of it like the US DOD space, private addresses, etc).

op00to 4y ago

Someone might know your IP, and somehow that information is delicious and irresistible to evil .. uh .. spammers?

CaliforniaKarl 4y ago
In that case, have your system use a random IP. Right now, my macOS system has four publicly-routable IPv6 IPs, all random. New ones are generated, and old ones removed, regularly. https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ https://www.internetsociety.org/resources/deploy360/2014/pri...