3 ms·

Proper security is when everything is closed off and inaccessible by default. I have met a lot of infrastructure engineers who do that... then never give the p

Proper security is when everything is closed off and inaccessible by default. I have met a lot of infrastructure engineers who do that... then never give the people who need access access. So the system just sits and collects dust. You have users. Acknowledge them. The network shouldn't even be the primary security boundary to begin with. One bad firewall rule or insecure port open Firewall !== routing. Nobody said you can't run a border firewall on your home network.

thriftwy 3y ago
I don't want to run a border firewall on my home network, because I am not devops, neither is my mother, who also has a home network, etc. The former sound like a management problem. One call from up above and access will appear.
- lxgr 3y ago
  > I don't want to run a border firewall on my home network If you're running a NAT, you're already running something much more complex than that. It's not rocket science for CPE manufacturers to make "outbound connections only" the default. My home router does just that.
  - djha-skin 3y ago
    More of the same with this situation. A bunch of client developers telling me how to do my job. It's such a huge risk to show people what is in my network. It's such a huge risk to the business. It makes no sense to It makes no sense to reveal that. But I suppose telling you is not worth anyone's time, you're just going to say you like it better because you're a mobile developer.
    - lxgr 3y ago
      I'm responding to GP, not you, who mentioned their home network, not your business network. > you're just going to say you like it better because you're a mobile developer. Not sure what issues you have with mobile developers, but I'm not one, not that it should matter if the argument is sound.
- yjftsjthsd-h 3y ago
  > I don't want to run a border firewall on my home network, because I am not devops, Well... too bad? Do you want security or not? > neither is my mother, who also has a home network, etc. If your hypothetical non-technical mother just buys a normal off-the-shelf router (+AP+switch+...) then it'll already have a firewall by default. It's not like end-users are expected to design/implement these things themselves.
- simoncion 3y ago
  > I don't want to run a border firewall on my home network... NAT is provided by a stateful border firewall. Are you using NAT on your border device? Gratz, you're running a border firewall on your home network.
- NewJazz 3y ago
  One call from up above and access will appear. In my case, that worked... Sometimes. It really doesn't scale. At all.
djha-skin 3y ago
Acknowledging users is important, of course. I'd switch to IPv6 if clients really needed it. But the Glass House argument still applies. I'm still locking my doors by running a firewall, but I still don't want to show you what's all in my house and available to steal. Locks are not perfect. I'd much rather do dual stack or something similar so that I could keep my NAT.
- NewJazz 3y ago
  Glass house... Of random numbers, assigned randomly? All of which are largely inaccessible unless they connect out first? Which is the same with NAT... Are IP addresses really such sensitive secrets from your POV?
  - djha-skin 3y ago
    Especially since it contains Mac addresses, which are very much not random, encoding such info as the manufacturer of the device. Yes, these can be randomized, but you don't generally want to do this with servers. You want to know the Mac of your box. You certainly don't want to leak it or show bad actors what subnet it's in. Again, the non-mac part of the numbers leak information; they are very much not random.
    - greyface- 3y ago
      This has not been the case since RFC8064 (2017). Modern systems use stable, non-MAC-based IIDs. https://datatracker.ietf.org/doc/html/rfc8064 https://datatracker.ietf.org/doc/html/rfc8064
      - throw0101c 3y ago
        Actually 2001: * https://datatracker.ietf.org/doc/html/rfc3041 https://datatracker.ietf.org/doc/html/rfc3041 Updated in 2007: * https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941
    - throw0101c 3y ago
deathanatos 3y ago
We actually gave up on wrong-layer firewalling where I work, as it was just too much upkeep. We had enough engineers (… like two dozen, so not a lot in absolute terms) and ISPs rotate public IP address assignments way too often. And every time it happens it takes a while, as that person has to debug with usually terrible diagnostics. (Since the network is just dropping their packets.) The thing about v6 is … you can just firewall permit like the entire North America block to whatever ports absolutely must be exposed … and just not get any attacking traffic?, at least if the address isn't somehow otherwise discoverable. This isn't possible on v4 (there is no such block, due to the space's fragmentation), and opening up v4 otherwise does expose you to a cesspool of incoming maliciousness. (Though … there are tools for this.) If there was decent tooling available to me for "here are the IP addresses of the userbase" (e.g., some sort of phone-home system) that could keep the firewalls in sync with reality, I'd be more enthusiastic about it. But the status quo is largely "security teams want IP firewalling, but don't want to figure out how to actually implement that in a manner that it will realistically work and not waste engineers time filing dozens of security requests".
- Arnavion 3y ago
  >The thing about v6 is … you can just firewall permit like the entire North America block to whatever ports absolutely must be exposed … and just not get any attacking traffic?, at least if the address isn't somehow otherwise discoverable. I have a live feed of packets dropped by my firewall's "deny incoming on WAN by default" rule for fun, and I do occasionally see v6 packets being dropped. They're random addresses under the /48 that was delegated to me but which don't actually belong to any devices. So it doesn't seem to be because someone is actually harvesting IPs from my outgoing traffic, just guesswork. There was also one time where someone was very methodically testing every /64 by incrementing one at a time, with random bytes in the lower half, ie 2001:db8:abcd::$random, 2001:db8:abcd:1::$random, ... The vast majority of dropped packets are v4 though.

thriftwy 3y ago

I don't want to run a border firewall on my home network, because I am not devops, neither is my mother, who also has a home network, etc. The former sound like a management problem. One call from up above and access will appear.

lxgr 3y ago
> I don't want to run a border firewall on my home network If you're running a NAT, you're already running something much more complex than that. It's not rocket science for CPE manufacturers to make "outbound connections only" the default. My home router does just that.
- djha-skin 3y ago
  More of the same with this situation. A bunch of client developers telling me how to do my job. It's such a huge risk to show people what is in my network. It's such a huge risk to the business. It makes no sense to It makes no sense to reveal that. But I suppose telling you is not worth anyone's time, you're just going to say you like it better because you're a mobile developer.
  - lxgr 3y ago
    I'm responding to GP, not you, who mentioned their home network, not your business network. > you're just going to say you like it better because you're a mobile developer. Not sure what issues you have with mobile developers, but I'm not one, not that it should matter if the argument is sound.
yjftsjthsd-h 3y ago
> I don't want to run a border firewall on my home network, because I am not devops, Well... too bad? Do you want security or not? > neither is my mother, who also has a home network, etc. If your hypothetical non-technical mother just buys a normal off-the-shelf router (+AP+switch+...) then it'll already have a firewall by default. It's not like end-users are expected to design/implement these things themselves.
simoncion 3y ago
> I don't want to run a border firewall on my home network... NAT is provided by a stateful border firewall. Are you using NAT on your border device? Gratz, you're running a border firewall on your home network.
NewJazz 3y ago
One call from up above and access will appear. In my case, that worked... Sometimes. It really doesn't scale. At all.

djha-skin 3y ago

Acknowledging users is important, of course. I'd switch to IPv6 if clients really needed it. But the Glass House argument still applies. I'm still locking my doors by running a firewall, but I still don't want to show you what's all in my house and available to steal. Locks are not perfect. I'd much rather do dual stack or something similar so that I could keep my NAT.

NewJazz 3y ago
Glass house... Of random numbers, assigned randomly? All of which are largely inaccessible unless they connect out first? Which is the same with NAT... Are IP addresses really such sensitive secrets from your POV?
- djha-skin 3y ago
  Especially since it contains Mac addresses, which are very much not random, encoding such info as the manufacturer of the device. Yes, these can be randomized, but you don't generally want to do this with servers. You want to know the Mac of your box. You certainly don't want to leak it or show bad actors what subnet it's in. Again, the non-mac part of the numbers leak information; they are very much not random.
  - greyface- 3y ago
    This has not been the case since RFC8064 (2017). Modern systems use stable, non-MAC-based IIDs. https://datatracker.ietf.org/doc/html/rfc8064 https://datatracker.ietf.org/doc/html/rfc8064
    - throw0101c 3y ago
      Actually 2001: * https://datatracker.ietf.org/doc/html/rfc3041 https://datatracker.ietf.org/doc/html/rfc3041 Updated in 2007: * https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941
  - throw0101c 3y ago

deathanatos 3y ago

We actually gave up on wrong-layer firewalling where I work, as it was just too much upkeep. We had enough engineers (… like two dozen, so not a lot in absolute terms) and ISPs rotate public IP address assignments way too often. And every time it happens it takes a while, as that person has to debug with usually terrible diagnostics. (Since the network is just dropping their packets.) The thing about v6 is … you can just firewall permit like the entire North America block to whatever ports absolutely must be exposed … and just not get any attacking traffic?, at least if the address isn't somehow otherwise discoverable. This isn't possible on v4 (there is no such block, due to the space's fragmentation), and opening up v4 otherwise does expose you to a cesspool of incoming maliciousness. (Though … there are tools for this.) If there was decent tooling available to me for "here are the IP addresses of the userbase" (e.g., some sort of phone-home system) that could keep the firewalls in sync with reality, I'd be more enthusiastic about it. But the status quo is largely "security teams want IP firewalling, but don't want to figure out how to actually implement that in a manner that it will realistically work and not waste engineers time filing dozens of security requests".

Arnavion 3y ago
>The thing about v6 is … you can just firewall permit like the entire North America block to whatever ports absolutely must be exposed … and just not get any attacking traffic?, at least if the address isn't somehow otherwise discoverable. I have a live feed of packets dropped by my firewall's "deny incoming on WAN by default" rule for fun, and I do occasionally see v6 packets being dropped. They're random addresses under the /48 that was delegated to me but which don't actually belong to any devices. So it doesn't seem to be because someone is actually harvesting IPs from my outgoing traffic, just guesswork. There was also one time where someone was very methodically testing every /64 by incrementing one at a time, with random bytes in the lower half, ie 2001:db8:abcd::$random, 2001:db8:abcd:1::$random, ... The vast majority of dropped packets are v4 though.