5 ms·

> NAT provides security as a side-effect. sigh NAT provides a false sense of security as a side-effect. There is nothing in NAT what couldn't be done with DE

> NAT provides security as a side-effect. sigh NAT provides a false sense of security as a side-effect. There is nothing in NAT what couldn't be done with DENY rule in the firewall.

TheLoafOfBread 3y ago
Misconfigured NAT is not working on either side. Misconfigured firewall is a gaping hole into the local network.
- yesco 3y ago
  A misconfigured firewall is a gaping hole in your network regardless of whether NAT is involved. This means someone could brute force access into the configuration interface of your router and configure your network however they like. NAT security is a dangerous illusion that people just can't seem to stop falling for.
  - LegionMammal978 3y ago
    Are you saying that every firewall misconfiguration that exposes any one host to the public Internet necessarily exposes control over the router configuration to the public Internet? I don't see how that follows.
    - yesco 3y ago
      No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever internal host they want. If you mean to imply that what I'm saying here is ridiculous because a "firewall misconfiguration that exposes any one (non-router) host to the public Internet" is only possible with a IPv6 or a NAT-less IPv4 network then you would be wrong (unless you were just being pedantic that I excluded such an example). A misconfigured firewall that exposes an internal host to the Internet would just look slightly different with NAT, since hosts are usually exposed via the firewall's port forwarding rules instead of the full featured allow/deny rules. There are technically going to be more firewall configuration options in NAT-less networks, but the risk of a misconfiguration accidentally exposing a host is not going to be any greater here. If anything port forwarding actually encourages "accidental" exposure. They are usually kept in a separate interface from the other firewall rules, which indirectly encourages configurations that do blanket exposure to the Internet. Ideally internal networks should be configured to only allow inbound connections to specific host:ports from trusted external IPs/IP-ranges, but NAT makes this more complicated to do, so people get complacent with just exposing all inbound connections to specific host:ports because that is what port forwarding is usually going to default to absent of any other configuration.
      - burnerthrow008 3y ago
        > If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever internal host they want. Why are these objections always "What if I configure my IPv6 network in worst way possible?" Your router's configuration interface should be hosted on either a ULA or a link-local address, neither of which are routable. Security isn't the only reason you want to do that. If you host the config interface on a globally-routable address, that address will change every time your ISP delegates your network a new prefix (which happens about as often as you would get a new external IPv4 address via DHCP). A router is the one of the few things on your network you should be able to access even without working DNS, so why do you want the config interface to be on an address than can change unexpectedly? ULA and link-local addresses can be static: The network prefix will be static. In IPv4, this is like asking "But what if I host my router's interface on the public assigned-by-DHCP IP?" My response would be "Why the hell would you host the config interface on an address that can change at any time?"
        yesco 3y ago
        I've given up explaining things this way, it's too jargon heavy and skips over the fact that most people objecting to this are fundamentally misunderstanding critical details about how their networks operate. I suspect there is a degree of self-awareness regarding this which is why the concern can often be reduced down to: "I'm scared of fucking up my configuration, I have confidence in the levers I'm familiar with, but fear the levers I don't understand, so I hate them" My hope is that by walking through it with simplified examples, this fear is mitigated.
      - LegionMammal978 3y ago
        > No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. I still don't understand. Even if we assume that the configuration interface has no internal security (e.g., a strong password), how would a router with a NAT but with a totally busted firewall allow access to its configuration interface from arbitrary external hosts (short of having a forwarding rule for itself, which I suspect wouldn't even work on many routers)? What would such an inbound connection from an adversary look like? > If anything port forwarding actually encourages "accidental" exposure. They are usually kept in a separate interface from the other firewall rules, which indirectly encourages configurations that do blanket exposure to the Internet. It would seem to me like host-specific IPv6 firewall rules have their own challenges. Under IPv4 NATs, special internal hosts (that need their own rules) can be trivially assigned persistent labels through DHCP. With IPv6, if each host chooses its own address and rotates it regularly, then how are hosts persistently identified in the firewall rules? By MAC address? Or are there other systems for this?
  - drtgh 3y ago
    The anonymous IPV4 network behind a NAT, which by default is inaccessible from the Internet and which, if it fails, just leaves the local network isolated, with IPv6 turns it a part of internet, accessible by default & design from internet with unique IPv6 for each computer and device, with the firewall as the only one separation. The dangerous illusion is to think this is a coincidence.
    - yesco 3y ago
      > The anonymous IPV4 network behind a NAT, which by default is inaccessible from the Internet and which, if it fails, just leaves the local network isolated, with IPv6 turns it a part of internet, accessible by default False, the default behavior is the same as IPv4/NAT. While the address scheme is technically "global", the firewall will still by default be blocking inbound connections to those addresses. It is not unlike a random uuid or even a mac address in that the address is simply globally unique in nature, but not necessarily accessible unless you deliberately configure it to be, not unlike how one deliberately configures port forwarding in a local NAT based network firewall. With IPv6 your ISP is giving your router an address "prefix" instead of just a single address as they usually do. The process of generating these addresses is therefore entirely local and anonymous from everything else on the Internet, obviously excluding hosts that are deliberately connected to who can then see the source address, but even in these cases your global address changes constantly so remote hosts still can't figure out your internal network topology. The reason these addresses are globally unique despite this is thanks to the ISP provided "prefix", which is essentially just a unique namespace. > With the firewall as the only one separation. As is the case with a NAT based network.
      - drtgh 3y ago
        >False, the default behavior is the same as IPv4/NAT. The default behavior it is not the same as IPv4 with NAT, where the internet and local are different networks. >It is not unlike a random uuid or even a mac address in that the address is simply globally unique in nature, but not necessarily accessible unless you deliberately configure it to be, not unlike how one deliberately configures port forwarding in a local NAT based network firewall. The prefix the ISP gives to the router for to assign the IPv6 addresses to computers and devices it is the prefix of the unique uuid each one will get assigned. An unique IPv6 address is assigned to each one of these computers and devices, case contrary they would not be accessible from internet. If the firewall fails or if it's shut down, all get exposed to internet, because IPv6 it is designed to make every computer and device part of the internet network by default & design.
- drtgh 3y ago
  In addition, the routers installed by ISPs are rarely updated and these firewalls will be very vulnerable. Until I get a router with NAT for IPv6, I'm not going to do anything with IPv6, I will even to change ISP if necessary.
  - jiggawatts 3y ago
    You trust them with complex packet processing, but not with simple packet blocking!?
    - drtgh 3y ago
      What simple packets, the ones than can be easily charged without the interference of NAT!?
cyberax 3y ago
> NAT provides a false sense of security as a side-effect. Why? > There is nothing in NAT what couldn't be done with DENY rule in the firewall. DENY doesn't provide you stateful tracking. I.e. you want to let traffic between two hosts flow, but only if an internal host on your network initiated it. And once you do that, you basically have 80% of NAT.
- yesco 3y ago
  If you just want an address that isn't routable on the Internet then why don't you just use a local/wan ipv6 address? You can even have a local/wan address in addition to an Internet routable address at the same time, all without a hacky network address translation layer in your router. Alternatively, if you mean local to external host connections, why would an inbound deny rule not work here?
  - LegionMammal978 3y ago
    > You can even have a local/wan address in addition to an Internet routable address at the same time, all without a hacky network address translation layer in your router. Suppose that a host wants to open outbound connections to other hosts on the same network, as well as across the Internet, without regard to which kind of destination it is. By what mechanism does the host decide which source address to use? And how portable is this mechanism across different systems?
    - yesco 3y ago
      Let's suppose the following network configuration: Host A Address1 "Global:Address:A" Address2 "Local:Address:A" Host B Address1 "Global:Address:B" Address2 "Local:Address:B" If you are Host A and want to connect to Host B, while simultaneously ensuring that your connection to host B is done over your local network; Then you would initiate this connection using "Local:Address:B"; and since it's prefix ("Local") matches the prefix of one of your addresses:"Local:Address:A", then your OS would automatically use that as it's source address. Now if Host A connected to Host B via it's global address "Global:Address:B", then it would also work, but then Host A's connection would look like any other Internet address (and would still technically be routed over the internal network since it's the shortest path). The router/firewall, which would sit in front of these two hosts, would still see this all as local traffic though, and in the vast majority of cases be configured by default to block all incoming traffic from outside the network. This means unless the firewall is configured to allow some kind of external connection into Host B, and Host B does not initiate the connection itself, then it would never actually see any global addresses from anything other than Host A. > And how portable is this mechanism across different systems? It's all about what address you use, so I could say portability would be limited to IPv6 support, but broadly speaking everything I've described here also applies to NAT-less IPv4 too, which is how most cloud VM networks are usually configured. Having both Local and Global addresses can be convenient in cases where you have multiple environments (ie: dev,stage,prod), since you can reuse most configurations referenceing internal system IP addresses.
chrisandchris 3y ago
> There is nothing in NAT what couldn't be done with DENY rule in the firewall. I don't get the "false-security" issue with NAT. I still need NAT if I can't allocate 1 IP per host, so if I create a NAT rule, why would I also need a firewall rule covering the same port (assuming default is DENY)? Where does the false-security come into play?
- justsomehnguy 3y ago
  You are talking about outbound NAT. "NAT is a security boundary" sits on using RFC1918 addresses and "nobody can enter my network because there is no DNAT rules for it!". If you know how the routing actually works on Ethernet networks then it should be pretty obviously, but if not: there is no magic there. If you know what the packet is addressed to some network not in your routing list, then you just throw it the default router with dstaddr of the recipient and MAC address of the default gateway. There is no security or anything. And the same applies to the traffic you receive on the external interface. Anything what would be received on the external interface would be forwarded to your local networks if dstaddr of the packet is in your local network range. And there is two ways to throw some packets with dstaddr in RFC1918 to your external interface: a) be on the wire of your external interface - you can't forward those packets over Internet, obviously b) have DNAT what would rewrite the IP of your external interface in dstaddr to some internal IP So having internal addressing according to RFC1918 on the LAN and therefore using NAT to access anything else - doesn't make your network secure. Usually this is not a problem, but if you are thinking what NAT do makes your network secure then you have two problems: possibly an unsecure network and feeling what your network is secure. > why would I also need a firewall rule covering the same port (assuming default is DENY)? Assuming. There are people out there who can't even configure their firewall properly: https://news.ycombinator.com/item?id=38879470 https://news.ycombinator.com/item?id=38879470 EDIT: Oh, how quaint, just downvoting without responding. Remember, downvotes are not for your opinion on the comment. But while we are at it, two more options on having an external packet traverse to your local network: c) have a host on the LAN initiate a connection to the Internet, which opens up a port on the external interface of the router. Sure, in 99.9999% you can't use that, because the statefull firewall would discard the incoming packets not from the host which a client communicates... Until the attacker is that host in the first place, ie malware or even a deliberate operation d) UPnP. 'Nuff said.

> NAT provides security as a side-effect. sigh NAT provides a false sense of security as a side-effect. There is nothing in NAT what couldn't be done with DENY rule in the firewall.

TheLoafOfBread 3y ago

Misconfigured NAT is not working on either side. Misconfigured firewall is a gaping hole into the local network.

yesco 3y ago
A misconfigured firewall is a gaping hole in your network regardless of whether NAT is involved. This means someone could brute force access into the configuration interface of your router and configure your network however they like. NAT security is a dangerous illusion that people just can't seem to stop falling for.
- LegionMammal978 3y ago
  Are you saying that every firewall misconfiguration that exposes any one host to the public Internet necessarily exposes control over the router configuration to the public Internet? I don't see how that follows.
  - yesco 3y ago
    No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever internal host they want. If you mean to imply that what I'm saying here is ridiculous because a "firewall misconfiguration that exposes any one (non-router) host to the public Internet" is only possible with a IPv6 or a NAT-less IPv4 network then you would be wrong (unless you were just being pedantic that I excluded such an example). A misconfigured firewall that exposes an internal host to the Internet would just look slightly different with NAT, since hosts are usually exposed via the firewall's port forwarding rules instead of the full featured allow/deny rules. There are technically going to be more firewall configuration options in NAT-less networks, but the risk of a misconfiguration accidentally exposing a host is not going to be any greater here. If anything port forwarding actually encourages "accidental" exposure. They are usually kept in a separate interface from the other firewall rules, which indirectly encourages configurations that do blanket exposure to the Internet. Ideally internal networks should be configured to only allow inbound connections to specific host:ports from trusted external IPs/IP-ranges, but NAT makes this more complicated to do, so people get complacent with just exposing all inbound connections to specific host:ports because that is what port forwarding is usually going to default to absent of any other configuration.
    - burnerthrow008 3y ago
      > If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever internal host they want. Why are these objections always "What if I configure my IPv6 network in worst way possible?" Your router's configuration interface should be hosted on either a ULA or a link-local address, neither of which are routable. Security isn't the only reason you want to do that. If you host the config interface on a globally-routable address, that address will change every time your ISP delegates your network a new prefix (which happens about as often as you would get a new external IPv4 address via DHCP). A router is the one of the few things on your network you should be able to access even without working DNS, so why do you want the config interface to be on an address than can change unexpectedly? ULA and link-local addresses can be static: The network prefix will be static. In IPv4, this is like asking "But what if I host my router's interface on the public assigned-by-DHCP IP?" My response would be "Why the hell would you host the config interface on an address that can change at any time?"
      - yesco 3y ago
        I've given up explaining things this way, it's too jargon heavy and skips over the fact that most people objecting to this are fundamentally misunderstanding critical details about how their networks operate. I suspect there is a degree of self-awareness regarding this which is why the concern can often be reduced down to: "I'm scared of fucking up my configuration, I have confidence in the levers I'm familiar with, but fear the levers I don't understand, so I hate them" My hope is that by walking through it with simplified examples, this fear is mitigated.
    - LegionMammal978 3y ago
      > No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. I still don't understand. Even if we assume that the configuration interface has no internal security (e.g., a strong password), how would a router with a NAT but with a totally busted firewall allow access to its configuration interface from arbitrary external hosts (short of having a forwarding rule for itself, which I suspect wouldn't even work on many routers)? What would such an inbound connection from an adversary look like? > If anything port forwarding actually encourages "accidental" exposure. They are usually kept in a separate interface from the other firewall rules, which indirectly encourages configurations that do blanket exposure to the Internet. It would seem to me like host-specific IPv6 firewall rules have their own challenges. Under IPv4 NATs, special internal hosts (that need their own rules) can be trivially assigned persistent labels through DHCP. With IPv6, if each host chooses its own address and rotates it regularly, then how are hosts persistently identified in the firewall rules? By MAC address? Or are there other systems for this?
- drtgh 3y ago
  The anonymous IPV4 network behind a NAT, which by default is inaccessible from the Internet and which, if it fails, just leaves the local network isolated, with IPv6 turns it a part of internet, accessible by default & design from internet with unique IPv6 for each computer and device, with the firewall as the only one separation. The dangerous illusion is to think this is a coincidence.
  - yesco 3y ago
    > The anonymous IPV4 network behind a NAT, which by default is inaccessible from the Internet and which, if it fails, just leaves the local network isolated, with IPv6 turns it a part of internet, accessible by default False, the default behavior is the same as IPv4/NAT. While the address scheme is technically "global", the firewall will still by default be blocking inbound connections to those addresses. It is not unlike a random uuid or even a mac address in that the address is simply globally unique in nature, but not necessarily accessible unless you deliberately configure it to be, not unlike how one deliberately configures port forwarding in a local NAT based network firewall. With IPv6 your ISP is giving your router an address "prefix" instead of just a single address as they usually do. The process of generating these addresses is therefore entirely local and anonymous from everything else on the Internet, obviously excluding hosts that are deliberately connected to who can then see the source address, but even in these cases your global address changes constantly so remote hosts still can't figure out your internal network topology. The reason these addresses are globally unique despite this is thanks to the ISP provided "prefix", which is essentially just a unique namespace. > With the firewall as the only one separation. As is the case with a NAT based network.
    - drtgh 3y ago
      >False, the default behavior is the same as IPv4/NAT. The default behavior it is not the same as IPv4 with NAT, where the internet and local are different networks. >It is not unlike a random uuid or even a mac address in that the address is simply globally unique in nature, but not necessarily accessible unless you deliberately configure it to be, not unlike how one deliberately configures port forwarding in a local NAT based network firewall. The prefix the ISP gives to the router for to assign the IPv6 addresses to computers and devices it is the prefix of the unique uuid each one will get assigned. An unique IPv6 address is assigned to each one of these computers and devices, case contrary they would not be accessible from internet. If the firewall fails or if it's shut down, all get exposed to internet, because IPv6 it is designed to make every computer and device part of the internet network by default & design.
drtgh 3y ago
In addition, the routers installed by ISPs are rarely updated and these firewalls will be very vulnerable. Until I get a router with NAT for IPv6, I'm not going to do anything with IPv6, I will even to change ISP if necessary.
- jiggawatts 3y ago
  You trust them with complex packet processing, but not with simple packet blocking!?
  - drtgh 3y ago
    What simple packets, the ones than can be easily charged without the interference of NAT!?

cyberax 3y ago

> NAT provides a false sense of security as a side-effect. Why? > There is nothing in NAT what couldn't be done with DENY rule in the firewall. DENY doesn't provide you stateful tracking. I.e. you want to let traffic between two hosts flow, but only if an internal host on your network initiated it. And once you do that, you basically have 80% of NAT.

yesco 3y ago
If you just want an address that isn't routable on the Internet then why don't you just use a local/wan ipv6 address? You can even have a local/wan address in addition to an Internet routable address at the same time, all without a hacky network address translation layer in your router. Alternatively, if you mean local to external host connections, why would an inbound deny rule not work here?
- LegionMammal978 3y ago
  > You can even have a local/wan address in addition to an Internet routable address at the same time, all without a hacky network address translation layer in your router. Suppose that a host wants to open outbound connections to other hosts on the same network, as well as across the Internet, without regard to which kind of destination it is. By what mechanism does the host decide which source address to use? And how portable is this mechanism across different systems?
  - yesco 3y ago
    Let's suppose the following network configuration: Host A Address1 "Global:Address:A" Address2 "Local:Address:A" Host B Address1 "Global:Address:B" Address2 "Local:Address:B" If you are Host A and want to connect to Host B, while simultaneously ensuring that your connection to host B is done over your local network; Then you would initiate this connection using "Local:Address:B"; and since it's prefix ("Local") matches the prefix of one of your addresses:"Local:Address:A", then your OS would automatically use that as it's source address. Now if Host A connected to Host B via it's global address "Global:Address:B", then it would also work, but then Host A's connection would look like any other Internet address (and would still technically be routed over the internal network since it's the shortest path). The router/firewall, which would sit in front of these two hosts, would still see this all as local traffic though, and in the vast majority of cases be configured by default to block all incoming traffic from outside the network. This means unless the firewall is configured to allow some kind of external connection into Host B, and Host B does not initiate the connection itself, then it would never actually see any global addresses from anything other than Host A. > And how portable is this mechanism across different systems? It's all about what address you use, so I could say portability would be limited to IPv6 support, but broadly speaking everything I've described here also applies to NAT-less IPv4 too, which is how most cloud VM networks are usually configured. Having both Local and Global addresses can be convenient in cases where you have multiple environments (ie: dev,stage,prod), since you can reuse most configurations referenceing internal system IP addresses.

chrisandchris 3y ago

> There is nothing in NAT what couldn't be done with DENY rule in the firewall. I don't get the "false-security" issue with NAT. I still need NAT if I can't allocate 1 IP per host, so if I create a NAT rule, why would I also need a firewall rule covering the same port (assuming default is DENY)? Where does the false-security come into play?

justsomehnguy 3y ago
You are talking about outbound NAT. "NAT is a security boundary" sits on using RFC1918 addresses and "nobody can enter my network because there is no DNAT rules for it!". If you know how the routing actually works on Ethernet networks then it should be pretty obviously, but if not: there is no magic there. If you know what the packet is addressed to some network not in your routing list, then you just throw it the default router with dstaddr of the recipient and MAC address of the default gateway. There is no security or anything. And the same applies to the traffic you receive on the external interface. Anything what would be received on the external interface would be forwarded to your local networks if dstaddr of the packet is in your local network range. And there is two ways to throw some packets with dstaddr in RFC1918 to your external interface: a) be on the wire of your external interface - you can't forward those packets over Internet, obviously b) have DNAT what would rewrite the IP of your external interface in dstaddr to some internal IP So having internal addressing according to RFC1918 on the LAN and therefore using NAT to access anything else - doesn't make your network secure. Usually this is not a problem, but if you are thinking what NAT do makes your network secure then you have two problems: possibly an unsecure network and feeling what your network is secure. > why would I also need a firewall rule covering the same port (assuming default is DENY)? Assuming. There are people out there who can't even configure their firewall properly: https://news.ycombinator.com/item?id=38879470 https://news.ycombinator.com/item?id=38879470 EDIT: Oh, how quaint, just downvoting without responding. Remember, downvotes are not for your opinion on the comment. But while we are at it, two more options on having an external packet traverse to your local network: c) have a host on the LAN initiate a connection to the Internet, which opens up a port on the external interface of the router. Sure, in 99.9999% you can't use that, because the statefull firewall would discard the incoming packets not from the host which a client communicates... Until the attacker is that host in the first place, ie malware or even a deliberate operation d) UPnP. 'Nuff said.