4 ms·

>> The biggest one is people seem to equate NAT = router/firewall. This is absolutely not the case, I dont think anyone equate that, but IPv6 proponents refus

>> The biggest one is people seem to equate NAT = router/firewall. This is absolutely not the case, I dont think anyone equate that, but IPv6 proponents refuse to recognize that decades and decades, especially in home users, and SMB space, NAT was a layer of the security model, often times one of the biggest Right or wrong is irrelevant, that is/was the reality Just tossing IPv6 as a replacement for ipv4 with out factoring that in while simply screaming into the void "NAT IS NOT A FIREWALL" will be of little comfort to the elderly retiree that has their home computer ransomwared, or the small business that is put under due to a cyber attack because the ipv6 address was strait on the public internet

bluepizza 3y ago
Home router NAT "layer of security" is equivalent to closing all ports. If an IPv6 home router closes all ports by default, then the same level of security is achieved.
- hot_gril 3y ago
  That's a big "if." > Randomized, temporary IPv6 public addresses are a nice feature, and mostly turned on by default I really do not want this.
  - devman0 3y ago
    It isn't a big if, it is literally the same connection tracking stack except without the address and port mapping. If you take away the mapping the tracking doesn't go away. Inbound traffic still needs to match to to a session created by outbound traffic.
    - hot_gril 3y ago
      Yes, and every router has to do it properly by default, which so far they haven't really been. NAT is a lot harder to do wrong, cause the local IPs aren't even addressible.
      - icehawk 3y ago
        Its not harder to do wrong, its just less noticeable when done wrong, it's been a security consideration since NAT was created, and a persistent issue since then: https://datatracker.ietf.org/doc/html/rfc2993#page-22 https://datatracker.ietf.org/doc/html/rfc2993#page-22 https://threatpost.com/remote-attackers-internal-network-devices-nat-slipstreaming/163400/ https://threatpost.com/remote-attackers-internal-network-dev... https://www.anvilsecure.com/blog/dhcp-games-with-smart-router-devices.html https://www.anvilsecure.com/blog/dhcp-games-with-smart-route...
        hot_gril 3y ago
        It's defense in depth. I don't understand if and how this exploit allows an attacker to hit port 80 on my PC for instance, but either way it looks like a pretty sophisticated attack only discovered in 2021, and I still don't see panic over it.
      - devman0 3y ago
        If they haven't really been, then NAT wouldn't be working either, that's the point I'm making. NAT requires connection tracking to function, because NAT is actually an extra step on top of a basic stateful firewall, and the mapping part isn't the part that provides security, it is the connection tracking part.
  - saltminer 3y ago
    > I really do not want this. Then disable it. IPv6 SLAAC privacy extensions are device-controlled, meaning neither your ISP nor your router can force you to use/not use them (unless they're so incompetent that they do things like hand out /128s). I disable privacy extensions on my server so that I can give it a static IP within the prefix, so I can vouch that (at least on Linux) the process is quite simple.
    - hot_gril 3y ago
      Well, what I do is disable ipv6. I don't want the possibility that this is misconfigured, especially if the defaults tend to be wrong. Maybe my router doesn't even respect my firewall settings, like this: https://community.verizon.com/t5/Fios-Internet-and-High-Speed/IPv6-firewall-on-Fios-router-is-allowing-inbound-connections/td-p/1573464 https://community.verizon.com/t5/Fios-Internet-and-High-Spee... Maybe the customer is wrong, but this shouldn't even be a question. The rare times I want something publicly accessible, I use DMZ or port forwarding.
  - bluepizza 3y ago
    > That's a big "if." Not really. Many home routers used to assign all ports to the first device to connect to the router, and you'd need to setup NAT just for your second computer. Eventually the default settings wised up. It is much more probable that security defaults will be much tighter today than they were when ADSL initially took off.
jjjjmoney 3y ago
> Just tossing IPv6 as a replacement for ipv4 with out factoring that in while simply screaming into the void "NAT IS NOT A FIREWALL" will be of little comfort to the elderly retiree that has their home computer ransomwared, or the small business that is put under due to a cyber attack because the ipv6 address was strait on the public internet This is definitely what I'm seeing. IPv4 is really engrained in us - I actually had a really hard time conceptualizing how things worked until I forced myself to learn by deploying dual-stack and ipv6-only networks. The major downside I see right now is that "addresses are harder to memorize," but there are solutions to that as well.
- lxgr 3y ago
  > The major downside I see right now is that "addresses are harder to memorize," but there are solutions to that as well. Definitely. That DNS thing sounds promising!
bigstrat2003 3y ago
So we're supposed to do things wrong forever because some router vendors are too incompetent to set a firewall as well as NAT? That doesn't seem like a good approach to me.
- phpisthebest 3y ago
  Right and wrong in this context is subjective there are many things in IPv6 that I find to be wrong convoluted and overly complex When IPv6 was created they had the opportunity to just make it an expansion of the IPv4 space they chose not to do that and instead they added in a bunch of wish list items that were not needed to accomplish the goal that they were seeking to do which was prevent the exhaustion of IPv4 addresses Absent address space exhaustion I massively prefer working with IPv4 than I do IPv6

bluepizza 3y ago

Home router NAT "layer of security" is equivalent to closing all ports. If an IPv6 home router closes all ports by default, then the same level of security is achieved.

hot_gril 3y ago
That's a big "if." > Randomized, temporary IPv6 public addresses are a nice feature, and mostly turned on by default I really do not want this.
- devman0 3y ago
  It isn't a big if, it is literally the same connection tracking stack except without the address and port mapping. If you take away the mapping the tracking doesn't go away. Inbound traffic still needs to match to to a session created by outbound traffic.
  - hot_gril 3y ago
    Yes, and every router has to do it properly by default, which so far they haven't really been. NAT is a lot harder to do wrong, cause the local IPs aren't even addressible.
    - icehawk 3y ago
      Its not harder to do wrong, its just less noticeable when done wrong, it's been a security consideration since NAT was created, and a persistent issue since then: https://datatracker.ietf.org/doc/html/rfc2993#page-22 https://datatracker.ietf.org/doc/html/rfc2993#page-22 https://threatpost.com/remote-attackers-internal-network-devices-nat-slipstreaming/163400/ https://threatpost.com/remote-attackers-internal-network-dev... https://www.anvilsecure.com/blog/dhcp-games-with-smart-router-devices.html https://www.anvilsecure.com/blog/dhcp-games-with-smart-route...
      - hot_gril 3y ago
        It's defense in depth. I don't understand if and how this exploit allows an attacker to hit port 80 on my PC for instance, but either way it looks like a pretty sophisticated attack only discovered in 2021, and I still don't see panic over it.
    - devman0 3y ago
      If they haven't really been, then NAT wouldn't be working either, that's the point I'm making. NAT requires connection tracking to function, because NAT is actually an extra step on top of a basic stateful firewall, and the mapping part isn't the part that provides security, it is the connection tracking part.
- saltminer 3y ago
  > I really do not want this. Then disable it. IPv6 SLAAC privacy extensions are device-controlled, meaning neither your ISP nor your router can force you to use/not use them (unless they're so incompetent that they do things like hand out /128s). I disable privacy extensions on my server so that I can give it a static IP within the prefix, so I can vouch that (at least on Linux) the process is quite simple.
  - hot_gril 3y ago
    Well, what I do is disable ipv6. I don't want the possibility that this is misconfigured, especially if the defaults tend to be wrong. Maybe my router doesn't even respect my firewall settings, like this: https://community.verizon.com/t5/Fios-Internet-and-High-Speed/IPv6-firewall-on-Fios-router-is-allowing-inbound-connections/td-p/1573464 https://community.verizon.com/t5/Fios-Internet-and-High-Spee... Maybe the customer is wrong, but this shouldn't even be a question. The rare times I want something publicly accessible, I use DMZ or port forwarding.
- bluepizza 3y ago
  > That's a big "if." Not really. Many home routers used to assign all ports to the first device to connect to the router, and you'd need to setup NAT just for your second computer. Eventually the default settings wised up. It is much more probable that security defaults will be much tighter today than they were when ADSL initially took off.

jjjjmoney 3y ago

> Just tossing IPv6 as a replacement for ipv4 with out factoring that in while simply screaming into the void "NAT IS NOT A FIREWALL" will be of little comfort to the elderly retiree that has their home computer ransomwared, or the small business that is put under due to a cyber attack because the ipv6 address was strait on the public internet This is definitely what I'm seeing. IPv4 is really engrained in us - I actually had a really hard time conceptualizing how things worked until I forced myself to learn by deploying dual-stack and ipv6-only networks. The major downside I see right now is that "addresses are harder to memorize," but there are solutions to that as well.

lxgr 3y ago
> The major downside I see right now is that "addresses are harder to memorize," but there are solutions to that as well. Definitely. That DNS thing sounds promising!

bigstrat2003 3y ago

So we're supposed to do things wrong forever because some router vendors are too incompetent to set a firewall as well as NAT? That doesn't seem like a good approach to me.

phpisthebest 3y ago
Right and wrong in this context is subjective there are many things in IPv6 that I find to be wrong convoluted and overly complex When IPv6 was created they had the opportunity to just make it an expansion of the IPv4 space they chose not to do that and instead they added in a bunch of wish list items that were not needed to accomplish the goal that they were seeking to do which was prevent the exhaustion of IPv4 addresses Absent address space exhaustion I massively prefer working with IPv4 than I do IPv6