6 ms·

> The main factor that prevents even more stuff being exposed to the internet than now (and there's a lot exposed already) is the prevalence of IPv4 NAT devices

> The main factor that prevents even more stuff being exposed to the internet than now (and there's a lot exposed already) is the prevalence of IPv4 NAT devices. All of this is blocked by default-deny firewall rules. I have IPv6 at home from my residential ISP, and I get a globally routable a 2000::/3 IPv6 address on my systems (via SLAAC), but they are not accessible from the public Internet by default. The idea of publicly routable = publicaly accessible needs to die.

iforgotpassword 3y ago
The thing is, you can turn that off. So if the user can turn it off, they will eventually turn it off, because that's just what people do if they have some problem somewhere: toggle random settings they have no clue what they mean, or asked their 14yo "computer wizard" nephew for advice, you name it. With NAT it is impossible to disable the firewall. The worst you can do is put one machine into the DMZ, and people did do that of course because of what I just said, but at least it isn't the entire network at once with every shitty iot fridge smart bulb vibrator toaster the average Joe has today.
- Arnavion 3y ago
  >With NAT it is impossible to disable the firewall. Nonsense. If we suppose a switch to turn the firewall off, we can suppose a switch to turn NAT off and convert the router into a bridge that connects LAN and WAN. Then a LAN device can speak DHCP to your ISP and get its own public address. It doesn't have to be limited to one LAN device either; my ISP allows two IPs per customer connection to make it easier for people power-cycling their routers / ONTs during troubleshooting.
  - iforgotpassword 3y ago
    That's an outlier. Almost every ISP hands out 0 to 1 ipv4 addresses. And even if it's two, the user will quickly realize that "internet is broken" on some of their devices, as two random ones picked up the addresses and the rest don't get any, and reverse the config change.
    - Arnavion 3y ago
      My argument is about LAN devices ending up with publicly reachable IPs. It's not contingent on the ISP allowing more than one IP address per customer connection. BTW, since you think you can turn your router's firewall off and rely on just the NAT to protect you, please tell me what you think will happen when a packet with destination IP 192.168.1.2 appears on your router's WAN interface. What component of the router do you think prevented those packets from crossing to LAN? Hint: its name starts with "f" and ends with "irewall".
      - ozim 3y ago
        Sorry but your argument is moot. Yes NAT is not firewall. No my devices are not receiving random packets with internal IP addresses often enough for me to worry about it. Even better not single of my devices living behind only nat in 20+ years was taken over or ransomed. If it would be real problem I would hear about it daily and - if it would be so easy - all kinds of APT groups would take over devices behind NAT en mass. I don’t believe that any residential router has firewall enabled by default and only devices that are taken over are ones really having public IP. Anyone can prove me wrong sharing links to articles and instances where there was occurrence of mass takeovers using NAT traversals.
        Arnavion 3y ago
        >Even better not single of my devices living behind only nat in 20+ years was taken over or ransomed. Yeah, because you didn't turn off the firewall. And/or because your ISP was being nice / competent and not routing packets to you that didn't make sense for your assigned route.
        ozim 3y ago
        Still my point is right, NAT traversal hacking is not an issue and is complicated enough to not be practical. Residential off the shelf routers don’t have firewall for incoming traffic. For business use you always put hardware firewall behind ISP router, I don’t have firewall at home.
  - theamk 3y ago
    That breaks, however, once there is more than 1 customer device on the network. Since "multiple devices" case is super common, I don't think this is something to be concerned about for general public.. "hey, you broke by ipad, whatever checkbox you unchecked, check it back"
  - 112233 3y ago
    Yes and you do this accidentally by plugging WAN cable into LAN port of the router, effectively bridging your interal devices with ISP, and if DHCP from ISP wins the race against your router, then your PC is on global address with no firewall. True story! Things like Homenet that tried to fix this did not go anywhere
- throw0101b 3y ago
  > With NAT it is impossible to disable the firewall. My Asus has Advanced Settings > Firewall > Enable Firewall: Yes/No. (Also Enable IPv6 Firewall: Yes/No.) It also has Advanced Settings > WAN > Port Forwarding to expose specific ports and DMZ to completely expose a machine. You can punch holes in IPv4 security just fine.
  - iforgotpassword 3y ago
    That's not what you think but some additional nonsense like turning off ICMP replies on the wan interface. If you only get one public ipv4 assigned by your ISP, there is simply no way to set it up in a way that every device on your network is reachable from the internet on all ports with just one click.
    - throw0101b 3y ago
      I'll go with the IETF position: NAT (particularly NAPT) actually has the potential to lower overall security because it creates the illusion of a security barrier, but does so without the managed intent of a firewall. Appropriate security mechanisms are implemented in the end host, without reliance on assumptions about routing hacks, firewall filters, or missing NAT translations, which may change over time to enable a service to a neighboring host. In general, defined security barriers assume that any threats are external, leading to practices that make internal breaches much easier. * https://datatracker.ietf.org/doc/html/rfc2993#section-9 https://datatracker.ietf.org/doc/html/rfc2993#section-9 The more likely scenario is your system (or phone) gets compromised, it lives behind the supposedly secure NAT "firewall", and since you had a false sense of security from NAT your entire internal network has all sorts of holes. The era of network moats was over long ago, and NAT is simply perpetuating the illusion. I'd rather take the risk of SPI IPv6 firewalls, have the alleged chaos of allegedly exposed IoT systems, and force everyone to up their security game: short-term pain is healthier IMHO.
      - horsawlarway 3y ago
        > The more likely scenario is your system (or phone) gets compromised, it lives behind the supposedly secure NAT "firewall" It's far easier than that - web pages running on your machine are also "calling from inside the house" if you will (https://static.tvtropes.org/pmwiki/pub/images/campfire.png https://static.tvtropes.org/pmwiki/pub/images/campfire.png) You load up some js on any random site and it can do a pretty thorough scan of your network in a few minutes.
- rzzzt 3y ago
  Infrastructure that lets applications open the door for themselves like NAT-PMP and UPnP are also available, but not many people turn them off.
  - iforgotpassword 3y ago
    It is, and I guess many tech savvy people turn that off immediately, but it's still not as bad. You don't suddenly expose every Windows machine, every iot device's telnet port with guessable password etc to the internet.
- denkmoon 3y ago
  As far as I see the only thing you're really suggesting here is that consumer routers should have firewalls that can't be disabled, and that NAT currently fulfills this function. Much "We're from Silicon Valley and we're here to help" vibes.
  - iforgotpassword 3y ago
    For the ISP-provided one, absolutely a sensible move. Just like most ISPs here don't offer bridging mode anymore in their modem+router combos. This still doesn't mean someone who has no clue will end up buying a device that allows them to do this, and ignore a warning message in big bold letters and still do it, but the vast majority of people will be saved from themselves.
  - fullspectrumdev 3y ago
    That’s what my current ISP does - their current router firmware doesn’t have functioning UPnP, nor does it have an option for port forwarding. It’s extremely annoying.
- burnished 3y ago
  I think that problem would be promptly fixed by more informative settings, the kind with context and a recommendation.
  - zbentley 3y ago
    I wish that were true, but people don't read. Not when they're in try-shit-until-something-works problem solving mode.
wg0 3y ago
Can this be allowed by default? If yes, is this configuration with the ISP or the end user?
- Arnavion 3y ago
  Whoever controls the router you use to connect your LAN to your ISP.

iforgotpassword 3y ago

The thing is, you can turn that off. So if the user can turn it off, they will eventually turn it off, because that's just what people do if they have some problem somewhere: toggle random settings they have no clue what they mean, or asked their 14yo "computer wizard" nephew for advice, you name it. With NAT it is impossible to disable the firewall. The worst you can do is put one machine into the DMZ, and people did do that of course because of what I just said, but at least it isn't the entire network at once with every shitty iot fridge smart bulb vibrator toaster the average Joe has today.

Arnavion 3y ago
>With NAT it is impossible to disable the firewall. Nonsense. If we suppose a switch to turn the firewall off, we can suppose a switch to turn NAT off and convert the router into a bridge that connects LAN and WAN. Then a LAN device can speak DHCP to your ISP and get its own public address. It doesn't have to be limited to one LAN device either; my ISP allows two IPs per customer connection to make it easier for people power-cycling their routers / ONTs during troubleshooting.
- iforgotpassword 3y ago
  That's an outlier. Almost every ISP hands out 0 to 1 ipv4 addresses. And even if it's two, the user will quickly realize that "internet is broken" on some of their devices, as two random ones picked up the addresses and the rest don't get any, and reverse the config change.
  - Arnavion 3y ago
    My argument is about LAN devices ending up with publicly reachable IPs. It's not contingent on the ISP allowing more than one IP address per customer connection. BTW, since you think you can turn your router's firewall off and rely on just the NAT to protect you, please tell me what you think will happen when a packet with destination IP 192.168.1.2 appears on your router's WAN interface. What component of the router do you think prevented those packets from crossing to LAN? Hint: its name starts with "f" and ends with "irewall".
    - ozim 3y ago
      Sorry but your argument is moot. Yes NAT is not firewall. No my devices are not receiving random packets with internal IP addresses often enough for me to worry about it. Even better not single of my devices living behind only nat in 20+ years was taken over or ransomed. If it would be real problem I would hear about it daily and - if it would be so easy - all kinds of APT groups would take over devices behind NAT en mass. I don’t believe that any residential router has firewall enabled by default and only devices that are taken over are ones really having public IP. Anyone can prove me wrong sharing links to articles and instances where there was occurrence of mass takeovers using NAT traversals.
      - Arnavion 3y ago
        >Even better not single of my devices living behind only nat in 20+ years was taken over or ransomed. Yeah, because you didn't turn off the firewall. And/or because your ISP was being nice / competent and not routing packets to you that didn't make sense for your assigned route.
        ozim 3y ago
        Still my point is right, NAT traversal hacking is not an issue and is complicated enough to not be practical. Residential off the shelf routers don’t have firewall for incoming traffic. For business use you always put hardware firewall behind ISP router, I don’t have firewall at home.
- theamk 3y ago
  That breaks, however, once there is more than 1 customer device on the network. Since "multiple devices" case is super common, I don't think this is something to be concerned about for general public.. "hey, you broke by ipad, whatever checkbox you unchecked, check it back"
- 112233 3y ago
  Yes and you do this accidentally by plugging WAN cable into LAN port of the router, effectively bridging your interal devices with ISP, and if DHCP from ISP wins the race against your router, then your PC is on global address with no firewall. True story! Things like Homenet that tried to fix this did not go anywhere
throw0101b 3y ago
> With NAT it is impossible to disable the firewall. My Asus has Advanced Settings > Firewall > Enable Firewall: Yes/No. (Also Enable IPv6 Firewall: Yes/No.) It also has Advanced Settings > WAN > Port Forwarding to expose specific ports and DMZ to completely expose a machine. You can punch holes in IPv4 security just fine.
- iforgotpassword 3y ago
  That's not what you think but some additional nonsense like turning off ICMP replies on the wan interface. If you only get one public ipv4 assigned by your ISP, there is simply no way to set it up in a way that every device on your network is reachable from the internet on all ports with just one click.
  - throw0101b 3y ago
    I'll go with the IETF position: NAT (particularly NAPT) actually has the potential to lower overall security because it creates the illusion of a security barrier, but does so without the managed intent of a firewall. Appropriate security mechanisms are implemented in the end host, without reliance on assumptions about routing hacks, firewall filters, or missing NAT translations, which may change over time to enable a service to a neighboring host. In general, defined security barriers assume that any threats are external, leading to practices that make internal breaches much easier. * https://datatracker.ietf.org/doc/html/rfc2993#section-9 https://datatracker.ietf.org/doc/html/rfc2993#section-9 The more likely scenario is your system (or phone) gets compromised, it lives behind the supposedly secure NAT "firewall", and since you had a false sense of security from NAT your entire internal network has all sorts of holes. The era of network moats was over long ago, and NAT is simply perpetuating the illusion. I'd rather take the risk of SPI IPv6 firewalls, have the alleged chaos of allegedly exposed IoT systems, and force everyone to up their security game: short-term pain is healthier IMHO.
    - horsawlarway 3y ago
      > The more likely scenario is your system (or phone) gets compromised, it lives behind the supposedly secure NAT "firewall" It's far easier than that - web pages running on your machine are also "calling from inside the house" if you will (https://static.tvtropes.org/pmwiki/pub/images/campfire.png https://static.tvtropes.org/pmwiki/pub/images/campfire.png) You load up some js on any random site and it can do a pretty thorough scan of your network in a few minutes.
rzzzt 3y ago
Infrastructure that lets applications open the door for themselves like NAT-PMP and UPnP are also available, but not many people turn them off.
- iforgotpassword 3y ago
  It is, and I guess many tech savvy people turn that off immediately, but it's still not as bad. You don't suddenly expose every Windows machine, every iot device's telnet port with guessable password etc to the internet.
denkmoon 3y ago
As far as I see the only thing you're really suggesting here is that consumer routers should have firewalls that can't be disabled, and that NAT currently fulfills this function. Much "We're from Silicon Valley and we're here to help" vibes.
- iforgotpassword 3y ago
  For the ISP-provided one, absolutely a sensible move. Just like most ISPs here don't offer bridging mode anymore in their modem+router combos. This still doesn't mean someone who has no clue will end up buying a device that allows them to do this, and ignore a warning message in big bold letters and still do it, but the vast majority of people will be saved from themselves.
- fullspectrumdev 3y ago
  That’s what my current ISP does - their current router firmware doesn’t have functioning UPnP, nor does it have an option for port forwarding. It’s extremely annoying.
burnished 3y ago
I think that problem would be promptly fixed by more informative settings, the kind with context and a recommendation.
- zbentley 3y ago
  I wish that were true, but people don't read. Not when they're in try-shit-until-something-works problem solving mode.

wg0 3y ago

Can this be allowed by default? If yes, is this configuration with the ISP or the end user?

Arnavion 3y ago
Whoever controls the router you use to connect your LAN to your ISP.