4 ms·

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, that goes along with non-global addresses: * https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_... Your end-user device knows its address and the address of the other connection point, and can tell the firewall to open a rule between only those two IPs: * https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol * http://www.upnp.org/resources/documents/AnnexA-IPv6_000.pdf http://www.upnp.org/resources/documents/AnnexA-IPv6_000.pdf Further, because you don't have only one external IP, you don't have to futz around with non-default ports if you want multiple instances of the same service (e.g., Minecraft), because each instance can have its own IP. Further, if you want certain devices to not able to get outside: (a) give them static assignments and block them at the firewall, (b) don't give them a default route so they are subnet-local, or (c) give them site-local addresses via ULA and do not set up NTPv6 translation.

gxt 4y ago
How does that protect privacy of the private network? I don't want to divulge any information about internal topology.
- adgjlsfhk1 4y ago
  what do you mean by topology? the only information leaked would be the number of computers making requests.
  - Faark 4y ago
    And what computer is making what requests. Now that i think about it, this cloud be the reason why youtube started making recommendations based on stuff i just watched in private browser tabs...
    - CaliforniaKarl 4y ago
      That's a very strong claim to make. I'd appreciate if you could provide a source to that statement!
      - ipaddr 4y ago
        Your chrome build id is available in both areas. Not really a secret.
        CaliforniaKarl 4y ago
        I'd be really surprised if I've got a chrome build ID on my browser.
    - throitallaway 4y ago
      Look at what Android does with MAC address randomization on wireless networks. We will probably see something similar with IPv6.
      - CaliforniaKarl 4y ago
        > We will probably see something similar with IPv6. It's been available for some time: https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ https://www.internetsociety.org/resources/deploy360/2014/pri... On my macOS system, I currently have four IPv6 IPs (excluding the link-local IP), all of which are random.
      - gerdesj 4y ago
        Not just Android. My laptop does it too (NetworkManager). That's just IPv4 on devices designed to travel so it seems a fair thing to do. Bloody pain to diagnose why a static DHCP lease isn't working the first time, after that you find the mechanisms to turn it off. Nearly everything does it for IPv6, for a given value of everything! For decades we have generally allowed all outbound and worried and fretted about and filtered inbound. I think it is time for us all to get a grip and do the job properly. However, with the delights of DNS over http and the like, the horse has not only bolted but has a new paint job, far better shoes than you can afford, eats grass that was prepared by a Michelin starred chef and belongs to someone else now. We all need to be far more sophisticated about how traffic (knowledge/ideas/data) flows in and out of our networks/lives. Packet filtering is just one tool in the box and worrying about an addressing scheme being global (IPv6) instead of a weird hybrid (IPv4) is completely missing the real issue stabbing you in the nadgers.
  - lloeki 4y ago
    that's not even true with slaac temporary (a.k.a privacy) or secured addresses. the only thing you'd "leak" is the prefix, which is no different than a IPv4 WAN address that you'd get with a v4 NAT.
  - gxt 4y ago
    That is information about the topology.
    - CaliforniaKarl 4y ago
      It's fairly limited, without a lot of time and effort, or information from inside the network. I assume you're not acting as an AS, doing BGP, etc; and that you're just getting an IP allocation from a single ISP. In that case, you're probably getting an entire IPv6 subnet (like a /48) allocated to you. Ideally, you make the entire subnet available to your systems. Assuming you block unsolicited packets (that is, packets not related to existing connections/streams) at your border (the connection to your ISP), then outsiders won't be able to use tools like traceroute to learn anything. All that an outsider has is an IPv6 IP, and since you're not doing BGP with anything, all they'll know to do is to send the traffic to your ISP.
- throw0101c 4y ago
  > How does that protect privacy of the private network? I don't want to divulge any information about internal topology. I'm curious to know: what (attack) do you hope to protect against? I would think that most attacks come in two fashions: the first being that you run a service of some kind and that there's some JSP/PHP/whatever exploit for a public facing service, and someone does a 'magic' PUT/GET that has the application server execute some code, which downloads a larger malware attack package. After which point the black hats start scanning from the inside. The second being that someone clicks on a link in a phishing e-mail or executes some attachment, after which malware code starts scanning from the inside and phones home. (A third being an insider attack, who presumably know about internal topology.) What attack are you thinking to protect against by hiding subnet and VLAN topology?
  - gxt 4y ago
    This isn't about an attack scenario from this vector, it's about preventing reconnaissance that might yield helpful results to an adversary that can exploit it via any other vector.
    - throw0101c 4y ago
      > […] that can exploit it via any other vector. And what are those vector(s)? Besides compromising a machine that is already inside per the above (which can then do scanning / lateral moves), or perhaps physically getting inside the premises (in which case a scanner can be physically installed to examine the network), what attack are you protecting against? Can you give me a link about an attack that knowing the topology of the network ahead of time would allow, but that not knowing would prevent?
      - Retric 4y ago
        An example of security being sidestepped is Network intrusion detection. An adversary who knows your network architecture can avoid poking around your network which looks really suspicious.
      - deleted 4y ago
        [deleted]
- yrro 4y ago
  See RFC 8981 (and that which it made obsolete, RFC 4941).
jbverschoor 4y ago
Let’s say the firewall isn’t yours. Or the firewall needs to be replaced and is more open by default until you secure it. It’s also easier to map which kind of devices and how many you have..
- stephen_g 4y ago
  In any case, your endpoints really do need to be reasonably secure in themselves - especially if the firewall isn’t yours as then you are probably sharing the network with other devices on the inside of the network that can attack you directly, and even if not, it just takes one device being compromised and somebody has full inside access to the network, with the firewall not being able to do much…
  - jbverschoor 4y ago
    Good luck with your home automation, printer, and tv
    - BenjiWiebe 4y ago
      NAT doesn't protect you from things inside your LAN either. Where you have NAT+firewall with IPv4 now, you'll need a firewall with IPv6.
- viraptor 4y ago
  The same comment applies to ipv4. Port bindings accessible from outside by accident, misconfigured upnp, SIP-ALG with vulnerabilities, various other router issues. "What if my firewall is broken" is not a new ipv6 consideration.
  - jbverschoor 4y ago
    It’s not, but the “beauty” of NAT is that you have an extra line of defense because of its limitations. Port bindings and upnp are far less impactful and less common.
kaetemi 4y ago
My ISP's modem doesn't do prefix delegation so I don't even get IPv6 with my own router in-between. And I need that thing in-between to at least have some control over the IPv4 LAN. No idea what security that modem provides, since there are zero controls, so no IPv6 it is.
- sgtnoodle 4y ago
  You could still route within the /64, couldn't you? With a smaller subnet SLAAC wouldn't work, but you could DHCPv6 addresses still. There is also an RFC somewhere for sharing a single /64, intended for mobile hotspots.
  - kaetemi 4y ago
    No idea. I've tried every setting combination on this consumer grade D-Link router which is supposed to support IPv6. Nothing results in a functioning network. Forum posts I find from other customers of this ISP report the same behaviour on other routers. The modem gets a /56 at least, and hands out addresses from a /64 range under that I assume, the router gets a /128 from the modem, and then gives up entirely on doing anything with IPv6.
    - sgtnoodle 4y ago
      It sounds like your ISP is delegating a prefix, then? Weird, that all sounds reasonable to me. What do you mean the router gives up entirely, though? Computers in the LAN don't get an IP address? Packets go out but nothing comes back?
      - kaetemi 4y ago
        Yup, computers on the LAN don't get any address. From what I understand, the modem would be supposed to delegate a prefix to the router so it can hand out addresses, but this part isn't happening.
chillfox 4y ago
Minecraft is a bad example here as it supports advertising the port in DNS.
drtgh 4y ago
> Globally routable ≠ globally connectible Tell us with the next 0 day, because that big problem exist, and unfortunately happens every days. IPv6 == All your devices are globally ROUTABLE and CONNECTIBLE from Internet, your home network is part of internet. It is an additional rule in the router's firewall what temporarily avoids it. Remark in temporarily, as one day the gifted packet will arrive to the router. This is not cool. So much so -the home network is part of internet- that if you want to create a simple Video NAS or whatever, one have to use external DNS services, as no one have control over its own local IPs... what are served by the ISP. This is not cool. Even if it was not designed for it, NAT has been helping to secure and giving flexibility to our local networks along decades, but someones decided to reject it from the specification. Bad decision.
- sgtnoodle 4y ago
  I don't even necessarily disagree with you, but your examples don't seem accurate. Regarding firewalls bring prone to accepting by default, either way the packet has to go through the CPU to be routed. I don't believe there's any inherent bias in the design. You could argue that routers that use a single switch and vlan isolate the wan port are inherently biased, though. Regarding local hostname resolution, there are several options that don't require your ISP. There's mDNS, DHCPv6 and DNS on your router, ULA prefixes, or you can continue using IPv4 for local traffic.
  - drtgh 4y ago
    The words "local" or "home" network with IPv6 are an illusion, this is what I wanted to show with my examples, Firstly one ceases to have control of its own home network, what now have to rely on the ISP for to receive the "local" IPs, what are part of internet. And in addition each machine leaves a trace of its "local" ip on the Internet. This if one want internet access in the device, due the absence of NAT in the router's protocol. Secondly one have to rely on a buggy piece of code called firewall for to make "local" those IPs, due the absence of NAT in the router's protocol. https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=firewall https://nvd.nist.gov/vuln/search/results?form_type=Basic&res... https://www.cvedetails.com/google-search-results.php?q=firewall https://www.cvedetails.com/google-search-results.php?q=firew... We are talking about millions of routers provided by the ISPs in each country, barely maintained and updated, what little by little will become exposed. And this without taking in account the unpublished firewall bugs that each artist keeps for themselves and takes 3 to 5 years become detected and fixed by the mainstream. I do not know how to express the negligence is going on, but I can see that Crackers, Advertisers (privacy) and "others" are in good time because things are getting more easier for them than it should be. Why people keep down-voting the message is a mystery for me. If it is due the local hostname resolution, mDNS, ULA prefixes, etc, all are workarounds due it is a network one does not control, what is one of the main points I exposed (it also needs filters/rules what needs be manually added in the firewall, each user has to make efforts to try to protect the supposed "from internet" separation). One could create another network as you said, but the main problem keep existing without NAT.
KronisLV 4y ago
> Further, because you don't have only one external IP, you don't have to futz around with non-default ports if you want multiple instances of the same service (e.g., Minecraft), because each instance can have its own IP. This is an interesting point though personally I love how easy container technologies made exposing arbitrary ports, without trying to configure the software itself, or checking whether it even supports customizing the port. For example, I could have 3 database instances, each using 3306, but expose them on 30000, 30001 and 30002 or whatever I want.
- yrro 4y ago
  But the things connecting to them need to know which non-default ports to use! The Gods intended for each database service to have its own IP address and I curse the market forces that have trapped so many of us in the quagmire of NAPT!

gxt 4y ago

How does that protect privacy of the private network? I don't want to divulge any information about internal topology.

adgjlsfhk1 4y ago
what do you mean by topology? the only information leaked would be the number of computers making requests.
- Faark 4y ago
  And what computer is making what requests. Now that i think about it, this cloud be the reason why youtube started making recommendations based on stuff i just watched in private browser tabs...
  - CaliforniaKarl 4y ago
    That's a very strong claim to make. I'd appreciate if you could provide a source to that statement!
    - ipaddr 4y ago
      Your chrome build id is available in both areas. Not really a secret.
      - CaliforniaKarl 4y ago
        I'd be really surprised if I've got a chrome build ID on my browser.
  - throitallaway 4y ago
    Look at what Android does with MAC address randomization on wireless networks. We will probably see something similar with IPv6.
    - CaliforniaKarl 4y ago
      > We will probably see something similar with IPv6. It's been available for some time: https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ https://www.internetsociety.org/resources/deploy360/2014/pri... On my macOS system, I currently have four IPv6 IPs (excluding the link-local IP), all of which are random.
    - gerdesj 4y ago
      Not just Android. My laptop does it too (NetworkManager). That's just IPv4 on devices designed to travel so it seems a fair thing to do. Bloody pain to diagnose why a static DHCP lease isn't working the first time, after that you find the mechanisms to turn it off. Nearly everything does it for IPv6, for a given value of everything! For decades we have generally allowed all outbound and worried and fretted about and filtered inbound. I think it is time for us all to get a grip and do the job properly. However, with the delights of DNS over http and the like, the horse has not only bolted but has a new paint job, far better shoes than you can afford, eats grass that was prepared by a Michelin starred chef and belongs to someone else now. We all need to be far more sophisticated about how traffic (knowledge/ideas/data) flows in and out of our networks/lives. Packet filtering is just one tool in the box and worrying about an addressing scheme being global (IPv6) instead of a weird hybrid (IPv4) is completely missing the real issue stabbing you in the nadgers.
- lloeki 4y ago
  that's not even true with slaac temporary (a.k.a privacy) or secured addresses. the only thing you'd "leak" is the prefix, which is no different than a IPv4 WAN address that you'd get with a v4 NAT.
- gxt 4y ago
  That is information about the topology.
  - CaliforniaKarl 4y ago
    It's fairly limited, without a lot of time and effort, or information from inside the network. I assume you're not acting as an AS, doing BGP, etc; and that you're just getting an IP allocation from a single ISP. In that case, you're probably getting an entire IPv6 subnet (like a /48) allocated to you. Ideally, you make the entire subnet available to your systems. Assuming you block unsolicited packets (that is, packets not related to existing connections/streams) at your border (the connection to your ISP), then outsiders won't be able to use tools like traceroute to learn anything. All that an outsider has is an IPv6 IP, and since you're not doing BGP with anything, all they'll know to do is to send the traffic to your ISP.
throw0101c 4y ago
> How does that protect privacy of the private network? I don't want to divulge any information about internal topology. I'm curious to know: what (attack) do you hope to protect against? I would think that most attacks come in two fashions: the first being that you run a service of some kind and that there's some JSP/PHP/whatever exploit for a public facing service, and someone does a 'magic' PUT/GET that has the application server execute some code, which downloads a larger malware attack package. After which point the black hats start scanning from the inside. The second being that someone clicks on a link in a phishing e-mail or executes some attachment, after which malware code starts scanning from the inside and phones home. (A third being an insider attack, who presumably know about internal topology.) What attack are you thinking to protect against by hiding subnet and VLAN topology?
- gxt 4y ago
  This isn't about an attack scenario from this vector, it's about preventing reconnaissance that might yield helpful results to an adversary that can exploit it via any other vector.
  - throw0101c 4y ago
    > […] that can exploit it via any other vector. And what are those vector(s)? Besides compromising a machine that is already inside per the above (which can then do scanning / lateral moves), or perhaps physically getting inside the premises (in which case a scanner can be physically installed to examine the network), what attack are you protecting against? Can you give me a link about an attack that knowing the topology of the network ahead of time would allow, but that not knowing would prevent?
    - Retric 4y ago
      An example of security being sidestepped is Network intrusion detection. An adversary who knows your network architecture can avoid poking around your network which looks really suspicious.
    - deleted 4y ago
      [deleted]
yrro 4y ago
See RFC 8981 (and that which it made obsolete, RFC 4941).

jbverschoor 4y ago

Let’s say the firewall isn’t yours. Or the firewall needs to be replaced and is more open by default until you secure it. It’s also easier to map which kind of devices and how many you have..

stephen_g 4y ago
In any case, your endpoints really do need to be reasonably secure in themselves - especially if the firewall isn’t yours as then you are probably sharing the network with other devices on the inside of the network that can attack you directly, and even if not, it just takes one device being compromised and somebody has full inside access to the network, with the firewall not being able to do much…
- jbverschoor 4y ago
  Good luck with your home automation, printer, and tv
  - BenjiWiebe 4y ago
    NAT doesn't protect you from things inside your LAN either. Where you have NAT+firewall with IPv4 now, you'll need a firewall with IPv6.
viraptor 4y ago
The same comment applies to ipv4. Port bindings accessible from outside by accident, misconfigured upnp, SIP-ALG with vulnerabilities, various other router issues. "What if my firewall is broken" is not a new ipv6 consideration.
- jbverschoor 4y ago
  It’s not, but the “beauty” of NAT is that you have an extra line of defense because of its limitations. Port bindings and upnp are far less impactful and less common.

kaetemi 4y ago

My ISP's modem doesn't do prefix delegation so I don't even get IPv6 with my own router in-between. And I need that thing in-between to at least have some control over the IPv4 LAN. No idea what security that modem provides, since there are zero controls, so no IPv6 it is.

sgtnoodle 4y ago
You could still route within the /64, couldn't you? With a smaller subnet SLAAC wouldn't work, but you could DHCPv6 addresses still. There is also an RFC somewhere for sharing a single /64, intended for mobile hotspots.
- kaetemi 4y ago
  No idea. I've tried every setting combination on this consumer grade D-Link router which is supposed to support IPv6. Nothing results in a functioning network. Forum posts I find from other customers of this ISP report the same behaviour on other routers. The modem gets a /56 at least, and hands out addresses from a /64 range under that I assume, the router gets a /128 from the modem, and then gives up entirely on doing anything with IPv6.
  - sgtnoodle 4y ago
    It sounds like your ISP is delegating a prefix, then? Weird, that all sounds reasonable to me. What do you mean the router gives up entirely, though? Computers in the LAN don't get an IP address? Packets go out but nothing comes back?
    - kaetemi 4y ago
      Yup, computers on the LAN don't get any address. From what I understand, the modem would be supposed to delegate a prefix to the router so it can hand out addresses, but this part isn't happening.

chillfox 4y ago

Minecraft is a bad example here as it supports advertising the port in DNS.

drtgh 4y ago

> Globally routable ≠ globally connectible Tell us with the next 0 day, because that big problem exist, and unfortunately happens every days. IPv6 == All your devices are globally ROUTABLE and CONNECTIBLE from Internet, your home network is part of internet. It is an additional rule in the router's firewall what temporarily avoids it. Remark in temporarily, as one day the gifted packet will arrive to the router. This is not cool. So much so -the home network is part of internet- that if you want to create a simple Video NAS or whatever, one have to use external DNS services, as no one have control over its own local IPs... what are served by the ISP. This is not cool. Even if it was not designed for it, NAT has been helping to secure and giving flexibility to our local networks along decades, but someones decided to reject it from the specification. Bad decision.

sgtnoodle 4y ago
I don't even necessarily disagree with you, but your examples don't seem accurate. Regarding firewalls bring prone to accepting by default, either way the packet has to go through the CPU to be routed. I don't believe there's any inherent bias in the design. You could argue that routers that use a single switch and vlan isolate the wan port are inherently biased, though. Regarding local hostname resolution, there are several options that don't require your ISP. There's mDNS, DHCPv6 and DNS on your router, ULA prefixes, or you can continue using IPv4 for local traffic.
- drtgh 4y ago
  The words "local" or "home" network with IPv6 are an illusion, this is what I wanted to show with my examples, Firstly one ceases to have control of its own home network, what now have to rely on the ISP for to receive the "local" IPs, what are part of internet. And in addition each machine leaves a trace of its "local" ip on the Internet. This if one want internet access in the device, due the absence of NAT in the router's protocol. Secondly one have to rely on a buggy piece of code called firewall for to make "local" those IPs, due the absence of NAT in the router's protocol. https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=firewall https://nvd.nist.gov/vuln/search/results?form_type=Basic&res... https://www.cvedetails.com/google-search-results.php?q=firewall https://www.cvedetails.com/google-search-results.php?q=firew... We are talking about millions of routers provided by the ISPs in each country, barely maintained and updated, what little by little will become exposed. And this without taking in account the unpublished firewall bugs that each artist keeps for themselves and takes 3 to 5 years become detected and fixed by the mainstream. I do not know how to express the negligence is going on, but I can see that Crackers, Advertisers (privacy) and "others" are in good time because things are getting more easier for them than it should be. Why people keep down-voting the message is a mystery for me. If it is due the local hostname resolution, mDNS, ULA prefixes, etc, all are workarounds due it is a network one does not control, what is one of the main points I exposed (it also needs filters/rules what needs be manually added in the firewall, each user has to make efforts to try to protect the supposed "from internet" separation). One could create another network as you said, but the main problem keep existing without NAT.

KronisLV 4y ago

> Further, because you don't have only one external IP, you don't have to futz around with non-default ports if you want multiple instances of the same service (e.g., Minecraft), because each instance can have its own IP. This is an interesting point though personally I love how easy container technologies made exposing arbitrary ports, without trying to configure the software itself, or checking whether it even supports customizing the port. For example, I could have 3 database instances, each using 3306, but expose them on 30000, 30001 and 30002 or whatever I want.

yrro 4y ago
But the things connecting to them need to know which non-default ports to use! The Gods intended for each database service to have its own IP address and I curse the market forces that have trapped so many of us in the quagmire of NAPT!