4 ms·

> If I used IPv6 everywhere in my server room outsiders could see the topology of my internal Network. NAT isn't an annoyance on the server side, it's a require

> If I used IPv6 everywhere in my server room outsiders could see the topology of my internal Network. NAT isn't an annoyance on the server side, it's a requirement for security. You can NAT IPv6, but it really sounds like you're doing security-by-obscurity, which is less than rigorous. If your servers are properly secured you should be able to publish a complete list of your servers and their IPs on your website and not impact your security at all. > I have yet to meet an infrastructure engineer or even hear of one who switched to IPv6 on purpose because they thought it was better. I have. His designs were often... aspirational.

djha-skin 3y ago
Of course we should do more than security by obscurity, but sometimes obscurity is the only thing we have. We need to do everything in our power to secure the servers. Of course we're going to lock the doors, but if we can also obscure what's there, we should.
- eqvinox 3y ago
  If obscurity is the only thing you have, you have nothing. (And I say this not in jest or to be patronizing, I say this as a warning re. your security.) Whether this applies to NAT is a different question.
thriftwy 3y ago
That's not security by obscurity. Security by obscurity if these servers could be reached if you knew their "real names". In case of NAT, no amount of information will let you access these machines, so it is proper security. It is almost as good as airgap. With IPv6, knowing addresses of these machines will let you spam them with packets and possibly breach them the second firewall goes down for any reason.
- yjftsjthsd-h 3y ago
  > Security by obscurity if these servers could be reached if you knew their "real names". In case of NAT, no amount of information will let you access these machines, so it is proper security. It is almost as good as airgap. If you have a firewall, then no amount of information will give you access either. > the second firewall goes down for any reason Is this like... a thing that you've actually seen happen? Because it really sounds like something that at best happened 20 years ago in a freak accident that will never happen again. If we're allowing equipment to just randomly break to that degree then I get to assume that your NAT will just forward incoming traffic directly to servers.
  - thriftwy 3y ago
    Why won't it? Seriously, it looks like the default state for me: If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. With NAT, there's no obvious way to connect from the outside to the inside, because the inside cannot be addressed from the outside.
    - yjftsjthsd-h 3y ago
      > Why won't it? Seriously, it looks like the default state for me: If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. Well... yeah, if you open a port then the port is open. Since every firewall I've seen - including the ones in cheap garbage home routers - defaults to deny all inbound / allow all outbound, that's not the "default state", that's something you have to specifically add. (And again, same applies to NAT; you can add a port-forward rule, but if you care about security maybe don't.) > With NAT, there's no obvious way to connect from the outside to the inside, because the inside cannot be addressed from the outside. I am precisely concerned with the non-obvious ways. If we're talking about a server environment where every single device on the private subnet is trusted and doesn't get compromised, no ports are forwarded, there is no DMZ, and UPnP is absent or disabled, then it might work, but I would still trust it less than a firewall. In a home or office environment those constraints go out the window (UPnP was quite popular once, IoT ensures there's an endless supply of untrusted devices, and, y'know, Cross-Site Scripting attacks making every device with a browser a potential threat), which is probably why I have the cached heuristic of "don't trust NAT for security".
    - orangeboats 3y ago
      >If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. As someone who have been running IPv6-only services and before that, IPv4-only services, I find this premise to be untrue more or less. Indeed, my topology is exposed to the internet. But no one has ever exploited that, because IPv6 networks are huge, super huge. At best a random attacker will be able to tell which network one of your servers is located in, but they cannot find the other networked equipments inside this network. No one in their right mind will bother with your 2^64-sized network like how they did with IPv4.

djha-skin 3y ago

Of course we should do more than security by obscurity, but sometimes obscurity is the only thing we have. We need to do everything in our power to secure the servers. Of course we're going to lock the doors, but if we can also obscure what's there, we should.

eqvinox 3y ago
If obscurity is the only thing you have, you have nothing. (And I say this not in jest or to be patronizing, I say this as a warning re. your security.) Whether this applies to NAT is a different question.

thriftwy 3y ago

That's not security by obscurity. Security by obscurity if these servers could be reached if you knew their "real names". In case of NAT, no amount of information will let you access these machines, so it is proper security. It is almost as good as airgap. With IPv6, knowing addresses of these machines will let you spam them with packets and possibly breach them the second firewall goes down for any reason.

yjftsjthsd-h 3y ago
> Security by obscurity if these servers could be reached if you knew their "real names". In case of NAT, no amount of information will let you access these machines, so it is proper security. It is almost as good as airgap. If you have a firewall, then no amount of information will give you access either. > the second firewall goes down for any reason Is this like... a thing that you've actually seen happen? Because it really sounds like something that at best happened 20 years ago in a freak accident that will never happen again. If we're allowing equipment to just randomly break to that degree then I get to assume that your NAT will just forward incoming traffic directly to servers.
- thriftwy 3y ago
  Why won't it? Seriously, it looks like the default state for me: If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. With NAT, there's no obvious way to connect from the outside to the inside, because the inside cannot be addressed from the outside.
  - yjftsjthsd-h 3y ago
    > Why won't it? Seriously, it looks like the default state for me: If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. Well... yeah, if you open a port then the port is open. Since every firewall I've seen - including the ones in cheap garbage home routers - defaults to deny all inbound / allow all outbound, that's not the "default state", that's something you have to specifically add. (And again, same applies to NAT; you can add a port-forward rule, but if you care about security maybe don't.) > With NAT, there's no obvious way to connect from the outside to the inside, because the inside cannot be addressed from the outside. I am precisely concerned with the non-obvious ways. If we're talking about a server environment where every single device on the private subnet is trusted and doesn't get compromised, no ports are forwarded, there is no DMZ, and UPnP is absent or disabled, then it might work, but I would still trust it less than a firewall. In a home or office environment those constraints go out the window (UPnP was quite popular once, IoT ensures there's an endless supply of untrusted devices, and, y'know, Cross-Site Scripting attacks making every device with a browser a potential threat), which is probably why I have the cached heuristic of "don't trust NAT for security".
  - orangeboats 3y ago
    >If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. As someone who have been running IPv6-only services and before that, IPv4-only services, I find this premise to be untrue more or less. Indeed, my topology is exposed to the internet. But no one has ever exploited that, because IPv6 networks are huge, super huge. At best a random attacker will be able to tell which network one of your servers is located in, but they cannot find the other networked equipments inside this network. No one in their right mind will bother with your 2^64-sized network like how they did with IPv4.