3 ms·

Why won't it? Seriously, it looks like the default state for me: If you have an external, globally visible IP address and a port is open on it, everyone in the

Why won't it? Seriously, it looks like the default state for me: If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. With NAT, there's no obvious way to connect from the outside to the inside, because the inside cannot be addressed from the outside.

yjftsjthsd-h 3y ago
> Why won't it? Seriously, it looks like the default state for me: If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. Well... yeah, if you open a port then the port is open. Since every firewall I've seen - including the ones in cheap garbage home routers - defaults to deny all inbound / allow all outbound, that's not the "default state", that's something you have to specifically add. (And again, same applies to NAT; you can add a port-forward rule, but if you care about security maybe don't.) > With NAT, there's no obvious way to connect from the outside to the inside, because the inside cannot be addressed from the outside. I am precisely concerned with the non-obvious ways. If we're talking about a server environment where every single device on the private subnet is trusted and doesn't get compromised, no ports are forwarded, there is no DMZ, and UPnP is absent or disabled, then it might work, but I would still trust it less than a firewall. In a home or office environment those constraints go out the window (UPnP was quite popular once, IoT ensures there's an endless supply of untrusted devices, and, y'know, Cross-Site Scripting attacks making every device with a browser a potential threat), which is probably why I have the cached heuristic of "don't trust NAT for security".
orangeboats 3y ago
>If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. As someone who have been running IPv6-only services and before that, IPv4-only services, I find this premise to be untrue more or less. Indeed, my topology is exposed to the internet. But no one has ever exploited that, because IPv6 networks are huge, super huge. At best a random attacker will be able to tell which network one of your servers is located in, but they cannot find the other networked equipments inside this network. No one in their right mind will bother with your 2^64-sized network like how they did with IPv4.
- thriftwy 3y ago
  A random attacker will buy a "6 billion real IPv6 addresses" database dump for $15 and then will spam your specific IPs as soon as they will produce any outgoing packets at all. Only a matter of time.
  - orangeboats 3y ago
    This assumes that they have a database on my IPv6 addresses though (one which would be easily invalidated because SLAAC is just awesome), and furthermore assumes that I don't have a firewall to block off unwanted incoming connections -- you know, just like how NAT is basically a firewall with packet-modifying capabilities.

yjftsjthsd-h 3y ago

> Why won't it? Seriously, it looks like the default state for me: If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. Well... yeah, if you open a port then the port is open. Since every firewall I've seen - including the ones in cheap garbage home routers - defaults to deny all inbound / allow all outbound, that's not the "default state", that's something you have to specifically add. (And again, same applies to NAT; you can add a port-forward rule, but if you care about security maybe don't.) > With NAT, there's no obvious way to connect from the outside to the inside, because the inside cannot be addressed from the outside. I am precisely concerned with the non-obvious ways. If we're talking about a server environment where every single device on the private subnet is trusted and doesn't get compromised, no ports are forwarded, there is no DMZ, and UPnP is absent or disabled, then it might work, but I would still trust it less than a firewall. In a home or office environment those constraints go out the window (UPnP was quite popular once, IoT ensures there's an endless supply of untrusted devices, and, y'know, Cross-Site Scripting attacks making every device with a browser a potential threat), which is probably why I have the cached heuristic of "don't trust NAT for security".

orangeboats 3y ago

>If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. As someone who have been running IPv6-only services and before that, IPv4-only services, I find this premise to be untrue more or less. Indeed, my topology is exposed to the internet. But no one has ever exploited that, because IPv6 networks are huge, super huge. At best a random attacker will be able to tell which network one of your servers is located in, but they cannot find the other networked equipments inside this network. No one in their right mind will bother with your 2^64-sized network like how they did with IPv4.

thriftwy 3y ago
A random attacker will buy a "6 billion real IPv6 addresses" database dump for $15 and then will spam your specific IPs as soon as they will produce any outgoing packets at all. Only a matter of time.
- orangeboats 3y ago
  This assumes that they have a database on my IPv6 addresses though (one which would be easily invalidated because SLAAC is just awesome), and furthermore assumes that I don't have a firewall to block off unwanted incoming connections -- you know, just like how NAT is basically a firewall with packet-modifying capabilities.