3 ms·

No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. If you misconfigured it so

by yesco 3y ago

No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever internal host they want. If you mean to imply that what I'm saying here is ridiculous because a "firewall misconfiguration that exposes any one (non-router) host to the public Internet" is only possible with a IPv6 or a NAT-less IPv4 network then you would be wrong (unless you were just being pedantic that I excluded such an example). A misconfigured firewall that exposes an internal host to the Internet would just look slightly different with NAT, since hosts are usually exposed via the firewall's port forwarding rules instead of the full featured allow/deny rules. There are technically going to be more firewall configuration options in NAT-less networks, but the risk of a misconfiguration accidentally exposing a host is not going to be any greater here. If anything port forwarding actually encourages "accidental" exposure. They are usually kept in a separate interface from the other firewall rules, which indirectly encourages configurations that do blanket exposure to the Internet. Ideally internal networks should be configured to only allow inbound connections to specific host:ports from trusted external IPs/IP-ranges, but NAT makes this more complicated to do, so people get complacent with just exposing all inbound connections to specific host:ports because that is what port forwarding is usually going to default to absent of any other configuration.

burnerthrow008 3y ago
> If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever internal host they want. Why are these objections always "What if I configure my IPv6 network in worst way possible?" Your router's configuration interface should be hosted on either a ULA or a link-local address, neither of which are routable. Security isn't the only reason you want to do that. If you host the config interface on a globally-routable address, that address will change every time your ISP delegates your network a new prefix (which happens about as often as you would get a new external IPv4 address via DHCP). A router is the one of the few things on your network you should be able to access even without working DNS, so why do you want the config interface to be on an address than can change unexpectedly? ULA and link-local addresses can be static: The network prefix will be static. In IPv4, this is like asking "But what if I host my router's interface on the public assigned-by-DHCP IP?" My response would be "Why the hell would you host the config interface on an address that can change at any time?"
- yesco 3y ago
  I've given up explaining things this way, it's too jargon heavy and skips over the fact that most people objecting to this are fundamentally misunderstanding critical details about how their networks operate. I suspect there is a degree of self-awareness regarding this which is why the concern can often be reduced down to: "I'm scared of fucking up my configuration, I have confidence in the levers I'm familiar with, but fear the levers I don't understand, so I hate them" My hope is that by walking through it with simplified examples, this fear is mitigated.
LegionMammal978 3y ago
> No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. I still don't understand. Even if we assume that the configuration interface has no internal security (e.g., a strong password), how would a router with a NAT but with a totally busted firewall allow access to its configuration interface from arbitrary external hosts (short of having a forwarding rule for itself, which I suspect wouldn't even work on many routers)? What would such an inbound connection from an adversary look like? > If anything port forwarding actually encourages "accidental" exposure. They are usually kept in a separate interface from the other firewall rules, which indirectly encourages configurations that do blanket exposure to the Internet. It would seem to me like host-specific IPv6 firewall rules have their own challenges. Under IPv4 NATs, special internal hosts (that need their own rules) can be trivially assigned persistent labels through DHCP. With IPv6, if each host chooses its own address and rotates it regularly, then how are hosts persistently identified in the firewall rules? By MAC address? Or are there other systems for this?

by yesco 3y ago

burnerthrow008 3y ago

> If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever internal host they want. Why are these objections always "What if I configure my IPv6 network in worst way possible?" Your router's configuration interface should be hosted on either a ULA or a link-local address, neither of which are routable. Security isn't the only reason you want to do that. If you host the config interface on a globally-routable address, that address will change every time your ISP delegates your network a new prefix (which happens about as often as you would get a new external IPv4 address via DHCP). A router is the one of the few things on your network you should be able to access even without working DNS, so why do you want the config interface to be on an address than can change unexpectedly? ULA and link-local addresses can be static: The network prefix will be static. In IPv4, this is like asking "But what if I host my router's interface on the public assigned-by-DHCP IP?" My response would be "Why the hell would you host the config interface on an address that can change at any time?"

yesco 3y ago
I've given up explaining things this way, it's too jargon heavy and skips over the fact that most people objecting to this are fundamentally misunderstanding critical details about how their networks operate. I suspect there is a degree of self-awareness regarding this which is why the concern can often be reduced down to: "I'm scared of fucking up my configuration, I have confidence in the levers I'm familiar with, but fear the levers I don't understand, so I hate them" My hope is that by walking through it with simplified examples, this fear is mitigated.

LegionMammal978 3y ago

> No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. I still don't understand. Even if we assume that the configuration interface has no internal security (e.g., a strong password), how would a router with a NAT but with a totally busted firewall allow access to its configuration interface from arbitrary external hosts (short of having a forwarding rule for itself, which I suspect wouldn't even work on many routers)? What would such an inbound connection from an adversary look like? > If anything port forwarding actually encourages "accidental" exposure. They are usually kept in a separate interface from the other firewall rules, which indirectly encourages configurations that do blanket exposure to the Internet. It would seem to me like host-specific IPv6 firewall rules have their own challenges. Under IPv4 NATs, special internal hosts (that need their own rules) can be trivially assigned persistent labels through DHCP. With IPv6, if each host chooses its own address and rotates it regularly, then how are hosts persistently identified in the firewall rules? By MAC address? Or are there other systems for this?