4 ms·

Proper security is when everything is closed off and inaccessible by default. IPv6 where your home network or backend infrastructure is a transparent glass hou

Proper security is when everything is closed off and inaccessible by default. IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design. I hope I never get to be a DevOps and support that. Or have IPv6 in my home network. One bad firewall rule or insecure port open, and you get ransomware in your face.

NewJazz 3y ago
Proper security is when everything is closed off and inaccessible by default. I have met a lot of infrastructure engineers who do that... then never give the people who need access access. So the system just sits and collects dust. You have users. Acknowledge them. The network shouldn't even be the primary security boundary to begin with. One bad firewall rule or insecure port open Firewall !== routing. Nobody said you can't run a border firewall on your home network.
- thriftwy 3y ago
  I don't want to run a border firewall on my home network, because I am not devops, neither is my mother, who also has a home network, etc. The former sound like a management problem. One call from up above and access will appear.
  - lxgr 3y ago
    > I don't want to run a border firewall on my home network If you're running a NAT, you're already running something much more complex than that. It's not rocket science for CPE manufacturers to make "outbound connections only" the default. My home router does just that.
    - djha-skin 3y ago
      More of the same with this situation. A bunch of client developers telling me how to do my job. It's such a huge risk to show people what is in my network. It's such a huge risk to the business. It makes no sense to It makes no sense to reveal that. But I suppose telling you is not worth anyone's time, you're just going to say you like it better because you're a mobile developer.
      - lxgr 3y ago
        I'm responding to GP, not you, who mentioned their home network, not your business network. > you're just going to say you like it better because you're a mobile developer. Not sure what issues you have with mobile developers, but I'm not one, not that it should matter if the argument is sound.
  - yjftsjthsd-h 3y ago
    > I don't want to run a border firewall on my home network, because I am not devops, Well... too bad? Do you want security or not? > neither is my mother, who also has a home network, etc. If your hypothetical non-technical mother just buys a normal off-the-shelf router (+AP+switch+...) then it'll already have a firewall by default. It's not like end-users are expected to design/implement these things themselves.
  - simoncion 3y ago
    > I don't want to run a border firewall on my home network... NAT is provided by a stateful border firewall. Are you using NAT on your border device? Gratz, you're running a border firewall on your home network.
  - NewJazz 3y ago
    One call from up above and access will appear. In my case, that worked... Sometimes. It really doesn't scale. At all.
- djha-skin 3y ago
  Acknowledging users is important, of course. I'd switch to IPv6 if clients really needed it. But the Glass House argument still applies. I'm still locking my doors by running a firewall, but I still don't want to show you what's all in my house and available to steal. Locks are not perfect. I'd much rather do dual stack or something similar so that I could keep my NAT.
  - NewJazz 3y ago
    Glass house... Of random numbers, assigned randomly? All of which are largely inaccessible unless they connect out first? Which is the same with NAT... Are IP addresses really such sensitive secrets from your POV?
    - djha-skin 3y ago
      Especially since it contains Mac addresses, which are very much not random, encoding such info as the manufacturer of the device. Yes, these can be randomized, but you don't generally want to do this with servers. You want to know the Mac of your box. You certainly don't want to leak it or show bad actors what subnet it's in. Again, the non-mac part of the numbers leak information; they are very much not random.
      - greyface- 3y ago
        This has not been the case since RFC8064 (2017). Modern systems use stable, non-MAC-based IIDs. https://datatracker.ietf.org/doc/html/rfc8064 https://datatracker.ietf.org/doc/html/rfc8064
        throw0101c 3y ago
        Actually 2001: * https://datatracker.ietf.org/doc/html/rfc3041 https://datatracker.ietf.org/doc/html/rfc3041 Updated in 2007: * https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941
      - throw0101c 3y ago
- deathanatos 3y ago
  We actually gave up on wrong-layer firewalling where I work, as it was just too much upkeep. We had enough engineers (… like two dozen, so not a lot in absolute terms) and ISPs rotate public IP address assignments way too often. And every time it happens it takes a while, as that person has to debug with usually terrible diagnostics. (Since the network is just dropping their packets.) The thing about v6 is … you can just firewall permit like the entire North America block to whatever ports absolutely must be exposed … and just not get any attacking traffic?, at least if the address isn't somehow otherwise discoverable. This isn't possible on v4 (there is no such block, due to the space's fragmentation), and opening up v4 otherwise does expose you to a cesspool of incoming maliciousness. (Though … there are tools for this.) If there was decent tooling available to me for "here are the IP addresses of the userbase" (e.g., some sort of phone-home system) that could keep the firewalls in sync with reality, I'd be more enthusiastic about it. But the status quo is largely "security teams want IP firewalling, but don't want to figure out how to actually implement that in a manner that it will realistically work and not waste engineers time filing dozens of security requests".
  - Arnavion 3y ago
    >The thing about v6 is … you can just firewall permit like the entire North America block to whatever ports absolutely must be exposed … and just not get any attacking traffic?, at least if the address isn't somehow otherwise discoverable. I have a live feed of packets dropped by my firewall's "deny incoming on WAN by default" rule for fun, and I do occasionally see v6 packets being dropped. They're random addresses under the /48 that was delegated to me but which don't actually belong to any devices. So it doesn't seem to be because someone is actually harvesting IPs from my outgoing traffic, just guesswork. There was also one time where someone was very methodically testing every /64 by incrementing one at a time, with random bytes in the lower half, ie 2001:db8:abcd::$random, 2001:db8:abcd:1::$random, ... The vast majority of dropped packets are v4 though.
Arnavion 3y ago
What component on your router prevents a packet with destination IP 192.168.1.2 appearing on WAN from crossing over to the 192.168.1/24 LAN and reaching the device with that IP? Hint: It's the same one that also prevents IPv6 packets from making that same crossing.
- thriftwy 3y ago
  This makes exactly zero sense. So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? How does that work? At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP.
  - Arnavion 3y ago
    >So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Of course. Unless you add rules to allow incoming traffic, say a rule to allow incoming traffic for $LAN_MACHINE1_IP:$PORT/tcp, to cross from WAN to LAN. >At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. The reason the scenario in my previous comment doesn't work has nothing to do with NAT. The reason such a packet would be dropped is because the firewall has a rule to filter bogons on the WAN interface. More generally, your home network firewall will have a default rule to block all incoming traffic on WAN unless explicitly allowed via additional rules, and that applies to both IPv4 and IPv6. >WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP. Well if you trust your ISP so much then I assume you just have your firewall turned off always, right?
  - lxgr 3y ago
    > So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Yes! > How does that work? Stateful firewalling. It's much simpler than NAT masquerading tables. Just imagine a NAT, but with all address and port mappings being the identity function.
lxgr 3y ago
Same for IPv4 and one bad port forwarding rule, no? People also don't seem to have any issues getting hit by ransomware even in a world full of IPv4-only networks and NATs.
- djha-skin 3y ago
  Not really no it's not the same. But this whole argument I feel like it's trying to explain flying to a fish. Most developers are so far removed from this world they have no practical experience keeping the chaos out of the network, it's very frustrating from my end.
  - lxgr 3y ago
    Well, what's the difference? Also my network (dual stack) is quite orderly as far as I can tell, thank you very much. I promise I won't ask you for help if that ever changes, if it helps :)
  - labcomputer 3y ago
    > Not really no it's not the same. But this whole argument I feel like it's trying to explain flying to a fish. No, it's like you're a fish trying to explain flying to birds. You don't understand the fundamentals of IPv6 (among other things, in other comments you have revealed that you think IPv6 addresses are MAC-based, think Comcast is a wireless ISP, and aren't aware of stateful firewalls). You have so many misconceptions about IPv6 it's no wonder you hate it.
eqvinox 3y ago
> IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design. Please refer to RFC6092 "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service" (Jan 2011) (Despite the 'recommended' in the title, this is made mandatory by other specifications.) It does exactly what you ask for: "Proper security is when everything is closed off and inaccessible by default."
patrakov 3y ago
> Proper security is when everything is closed off and inaccessible by default. Not only that. PCI DSS explicitly requires hiding the network topology from outsiders - even though they cannot connect. So it is either NAT or very short-lived IPv6 addresses, and guess what - for internal audits of who did what, NAT works better.
justsomehnguy 3y ago
> IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design only if you chose it be. It doesn't differ from a public routable IPv4 block at all: or you explicitly allow anything being routed to addresses in that block - or not

NewJazz 3y ago

Proper security is when everything is closed off and inaccessible by default. I have met a lot of infrastructure engineers who do that... then never give the people who need access access. So the system just sits and collects dust. You have users. Acknowledge them. The network shouldn't even be the primary security boundary to begin with. One bad firewall rule or insecure port open Firewall !== routing. Nobody said you can't run a border firewall on your home network.

thriftwy 3y ago
I don't want to run a border firewall on my home network, because I am not devops, neither is my mother, who also has a home network, etc. The former sound like a management problem. One call from up above and access will appear.
- lxgr 3y ago
  > I don't want to run a border firewall on my home network If you're running a NAT, you're already running something much more complex than that. It's not rocket science for CPE manufacturers to make "outbound connections only" the default. My home router does just that.
  - djha-skin 3y ago
    More of the same with this situation. A bunch of client developers telling me how to do my job. It's such a huge risk to show people what is in my network. It's such a huge risk to the business. It makes no sense to It makes no sense to reveal that. But I suppose telling you is not worth anyone's time, you're just going to say you like it better because you're a mobile developer.
    - lxgr 3y ago
      I'm responding to GP, not you, who mentioned their home network, not your business network. > you're just going to say you like it better because you're a mobile developer. Not sure what issues you have with mobile developers, but I'm not one, not that it should matter if the argument is sound.
- yjftsjthsd-h 3y ago
  > I don't want to run a border firewall on my home network, because I am not devops, Well... too bad? Do you want security or not? > neither is my mother, who also has a home network, etc. If your hypothetical non-technical mother just buys a normal off-the-shelf router (+AP+switch+...) then it'll already have a firewall by default. It's not like end-users are expected to design/implement these things themselves.
- simoncion 3y ago
  > I don't want to run a border firewall on my home network... NAT is provided by a stateful border firewall. Are you using NAT on your border device? Gratz, you're running a border firewall on your home network.
- NewJazz 3y ago
  One call from up above and access will appear. In my case, that worked... Sometimes. It really doesn't scale. At all.
djha-skin 3y ago
Acknowledging users is important, of course. I'd switch to IPv6 if clients really needed it. But the Glass House argument still applies. I'm still locking my doors by running a firewall, but I still don't want to show you what's all in my house and available to steal. Locks are not perfect. I'd much rather do dual stack or something similar so that I could keep my NAT.
- NewJazz 3y ago
  Glass house... Of random numbers, assigned randomly? All of which are largely inaccessible unless they connect out first? Which is the same with NAT... Are IP addresses really such sensitive secrets from your POV?
  - djha-skin 3y ago
    Especially since it contains Mac addresses, which are very much not random, encoding such info as the manufacturer of the device. Yes, these can be randomized, but you don't generally want to do this with servers. You want to know the Mac of your box. You certainly don't want to leak it or show bad actors what subnet it's in. Again, the non-mac part of the numbers leak information; they are very much not random.
    - greyface- 3y ago
      This has not been the case since RFC8064 (2017). Modern systems use stable, non-MAC-based IIDs. https://datatracker.ietf.org/doc/html/rfc8064 https://datatracker.ietf.org/doc/html/rfc8064
      - throw0101c 3y ago
        Actually 2001: * https://datatracker.ietf.org/doc/html/rfc3041 https://datatracker.ietf.org/doc/html/rfc3041 Updated in 2007: * https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941
    - throw0101c 3y ago
deathanatos 3y ago
We actually gave up on wrong-layer firewalling where I work, as it was just too much upkeep. We had enough engineers (… like two dozen, so not a lot in absolute terms) and ISPs rotate public IP address assignments way too often. And every time it happens it takes a while, as that person has to debug with usually terrible diagnostics. (Since the network is just dropping their packets.) The thing about v6 is … you can just firewall permit like the entire North America block to whatever ports absolutely must be exposed … and just not get any attacking traffic?, at least if the address isn't somehow otherwise discoverable. This isn't possible on v4 (there is no such block, due to the space's fragmentation), and opening up v4 otherwise does expose you to a cesspool of incoming maliciousness. (Though … there are tools for this.) If there was decent tooling available to me for "here are the IP addresses of the userbase" (e.g., some sort of phone-home system) that could keep the firewalls in sync with reality, I'd be more enthusiastic about it. But the status quo is largely "security teams want IP firewalling, but don't want to figure out how to actually implement that in a manner that it will realistically work and not waste engineers time filing dozens of security requests".
- Arnavion 3y ago
  >The thing about v6 is … you can just firewall permit like the entire North America block to whatever ports absolutely must be exposed … and just not get any attacking traffic?, at least if the address isn't somehow otherwise discoverable. I have a live feed of packets dropped by my firewall's "deny incoming on WAN by default" rule for fun, and I do occasionally see v6 packets being dropped. They're random addresses under the /48 that was delegated to me but which don't actually belong to any devices. So it doesn't seem to be because someone is actually harvesting IPs from my outgoing traffic, just guesswork. There was also one time where someone was very methodically testing every /64 by incrementing one at a time, with random bytes in the lower half, ie 2001:db8:abcd::$random, 2001:db8:abcd:1::$random, ... The vast majority of dropped packets are v4 though.

Arnavion 3y ago

What component on your router prevents a packet with destination IP 192.168.1.2 appearing on WAN from crossing over to the 192.168.1/24 LAN and reaching the device with that IP? Hint: It's the same one that also prevents IPv6 packets from making that same crossing.

thriftwy 3y ago
This makes exactly zero sense. So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? How does that work? At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP.
- Arnavion 3y ago
  >So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Of course. Unless you add rules to allow incoming traffic, say a rule to allow incoming traffic for $LAN_MACHINE1_IP:$PORT/tcp, to cross from WAN to LAN. >At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. The reason the scenario in my previous comment doesn't work has nothing to do with NAT. The reason such a packet would be dropped is because the firewall has a rule to filter bogons on the WAN interface. More generally, your home network firewall will have a default rule to block all incoming traffic on WAN unless explicitly allowed via additional rules, and that applies to both IPv4 and IPv6. >WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP. Well if you trust your ISP so much then I assume you just have your firewall turned off always, right?
- lxgr 3y ago
  > So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Yes! > How does that work? Stateful firewalling. It's much simpler than NAT masquerading tables. Just imagine a NAT, but with all address and port mappings being the identity function.

lxgr 3y ago

Same for IPv4 and one bad port forwarding rule, no? People also don't seem to have any issues getting hit by ransomware even in a world full of IPv4-only networks and NATs.

djha-skin 3y ago
Not really no it's not the same. But this whole argument I feel like it's trying to explain flying to a fish. Most developers are so far removed from this world they have no practical experience keeping the chaos out of the network, it's very frustrating from my end.
- lxgr 3y ago
  Well, what's the difference? Also my network (dual stack) is quite orderly as far as I can tell, thank you very much. I promise I won't ask you for help if that ever changes, if it helps :)
- labcomputer 3y ago
  > Not really no it's not the same. But this whole argument I feel like it's trying to explain flying to a fish. No, it's like you're a fish trying to explain flying to birds. You don't understand the fundamentals of IPv6 (among other things, in other comments you have revealed that you think IPv6 addresses are MAC-based, think Comcast is a wireless ISP, and aren't aware of stateful firewalls). You have so many misconceptions about IPv6 it's no wonder you hate it.

eqvinox 3y ago

> IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design. Please refer to RFC6092 "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service" (Jan 2011) (Despite the 'recommended' in the title, this is made mandatory by other specifications.) It does exactly what you ask for: "Proper security is when everything is closed off and inaccessible by default."

patrakov 3y ago

> Proper security is when everything is closed off and inaccessible by default. Not only that. PCI DSS explicitly requires hiding the network topology from outsiders - even though they cannot connect. So it is either NAT or very short-lived IPv6 addresses, and guess what - for internal audits of who did what, NAT works better.

justsomehnguy 3y ago

> IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design only if you chose it be. It doesn't differ from a public routable IPv4 block at all: or you explicitly allow anything being routed to addresses in that block - or not