4 ms·

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. G

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

szszrk 2y ago
I'm wondering what are you referring to when you mention NAT in the context of IPv6. I thought there is no widely adopted implementation.
- adriancr 2y ago
  You can easily enable IPv6 masquerading on openwrt and linux in general: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 This has been available for a long time. You can also do static NAT and anything that you were used to on IPv4.
- craftkiller 2y ago
  Nothing is preventing you from doing NAT in IPv6. There is the Unique Local Address[0] range which is analogous to the RFC-1918 addresses from IPv4. That being said, there are very few reasons to do this in IPv6 (the only that comes to my mind is running virtual machines on a laptop connected via wifi). [0] https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address
kstrauser 2y ago
Going further still, forget all the NAT breakage and require all devices to actually use the privacy extensions described in RFC 4941 17 years ago. A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers. There are reasons you might want your desktop to have the same address for a long time. I can't think of any reason why I'd want that for a light bulb.
- bb88 2y ago
  NAT is broken by design. And CG-NAT can't do any kind of port forwarding on the routers. And adding more NAT is just breaking more networks. RFC 4941 is currently old enough to be taking it's SAT's and preparing itself for college... :)
  - kstrauser 2y ago
    I’m thrilled to have good end-to-end connectivity to the degree I’m willing to configure my firewall for it. When I hear people in other threads talking about the “security advantages” of NAT, I imagine someone filling their car’s engine with walnuts and talking about how it protects them from speeding tickets.
    - adriancr 2y ago
      That's the thing, you don't have good end-to-end connectivity if you configure the firewall as you should and block everything similar to what NAT does. After which, you have a question, how can you configure end-to-end connectivity securely?, which host(s) do you open up ports towards?
      - bb88 2y ago
        You don't have good end-to-end connectivity with NAT, right? With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet.
        adriancr 2y ago
        > You don't have good end-to-end connectivity with NAT, right? I do, I have a public IPv4 that I manage as I wish. Open ports on firewall and forward where needed. No issues so far. > With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet. Where are you from and what provider are you using? That is just a crappy provider, you should switch to competition and get a separate IP with no CG-NAT. (never had CG-NAT on home connection, although I avoided providers that did that) If you're a student in a uni campus/dorms you won't really have an option and it is what it is, it used to be CG-NAT 15-20 years ago too. Even with IPv6 they'd likely firewall everything off and the range would have bad reputation.
dmitrygr 2y ago
> Going even further, NAT Yup, and having lost any and all reasons to use IPv6, go back to what has already been working just fine: IPv4
- bb88 2y ago
  CG-NAT really isn't great.
JohnFen 2y ago
> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use cases are legit. I just don't share them and want the most restrictive network setup that I can tolerate.
- noinsight 2y ago
  > I don't want any random machines behind my router to be able to open ports to the internet at large. The solution to this is a firewall, not NAT. As has always been. NAT is not a security feature and never has been. The fact that it blocks uninitiated inbound connectivity is an implementation detail, not its purpose.
  - JohnFen 2y ago
    > NAT is not a security feature and never has been. True, and I don't think of it as such -- after all, NAT or not, it's my firewall doing the protecting. What NAT would buy me here is convenience, not security. I could have the same level of security without NAT, but managing it properly is easier and less error-prone with it.
    - kstrauser 2y ago
      Having managed both, it is absolutely, 100%, not easier to manage NAT than a firewall. For example, here's a valid OpenBSD pf configuration: pass out on $ext_if from any to any That's it. That's the entire stateful firewall config: Don't allow anything inbound at all, except directly in response to an outbound connection. If your firewall has a GUI, it'll be as easy to configure that as it is the NAT. If your firewall has a CLI, I guarantee there's no NAT in the world that's easier to configure than the above stateful firewall.
      - 2y ago
drdaeman 2y ago
I think the real question is "what the hell IoT is doing on a globally-routable network?" Put it on an isolated VLAN with no Internet connectivity. Or a minimal connectivity only to what's absolutely necessary (e.g. I haven't seen IoT devices that need inbound connections, so drop any inbound packets unless conntrack says otherwise). There there will be probably no need for weird NAT66 contraptions or anything like that - just old good plain drop-by-default firewall. But then, the article is about consumer tech, and most consumers aren't gonna set up any VLANs, firewalls or complex NAT systems, they don't know anything about those. They got one single flat WiFi network and that's about it. So, I guess, all the technical suggestions here are not really relevant.
- toast0 2y ago
  > Put it on an isolated VLAN with no Internet connectivity. It's hardly an Internet of Things if your Things aren't connected to the Internet :p
  - chipdart 2y ago
    From the very first paragraph of Wikipedia's article on IoT: > "Internet of things" has been considered a misnomer because devices do not need to be connected to the public internet; they only need to be connected to a network[6] and be individually addressable.[7][8]
somerandomqaguy 2y ago
>Quick solution would be DHCPv6 so they don't have a choice in what address they use. Android doesn't support DHCPv6. https://issuetracker.google.com/issues/36949085 https://issuetracker.google.com/issues/36949085
m463 2y ago
I just use ipv4 in my network. it's my personal network (and my personal opinion/solution). I turn off ipv6. I don't want to maintain two sets of firewall rules, or have some weird routing problem that lets packets in or out. I add this to my linux kernel command line: ipv6.disable=1 ipv6.ipv6_disable=1 sometimes in /etc/sysctl.d/00-nov6.conf: net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 in macos I do: networksetup -setv6off 'Ethernet 1' (or whatever network interface) helps me be more organized.

szszrk 2y ago

I'm wondering what are you referring to when you mention NAT in the context of IPv6. I thought there is no widely adopted implementation.

adriancr 2y ago
You can easily enable IPv6 masquerading on openwrt and linux in general: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 This has been available for a long time. You can also do static NAT and anything that you were used to on IPv4.
craftkiller 2y ago
Nothing is preventing you from doing NAT in IPv6. There is the Unique Local Address[0] range which is analogous to the RFC-1918 addresses from IPv4. That being said, there are very few reasons to do this in IPv6 (the only that comes to my mind is running virtual machines on a laptop connected via wifi). [0] https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address

kstrauser 2y ago

Going further still, forget all the NAT breakage and require all devices to actually use the privacy extensions described in RFC 4941 17 years ago. A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers. There are reasons you might want your desktop to have the same address for a long time. I can't think of any reason why I'd want that for a light bulb.

bb88 2y ago
NAT is broken by design. And CG-NAT can't do any kind of port forwarding on the routers. And adding more NAT is just breaking more networks. RFC 4941 is currently old enough to be taking it's SAT's and preparing itself for college... :)
- kstrauser 2y ago
  I’m thrilled to have good end-to-end connectivity to the degree I’m willing to configure my firewall for it. When I hear people in other threads talking about the “security advantages” of NAT, I imagine someone filling their car’s engine with walnuts and talking about how it protects them from speeding tickets.
  - adriancr 2y ago
    That's the thing, you don't have good end-to-end connectivity if you configure the firewall as you should and block everything similar to what NAT does. After which, you have a question, how can you configure end-to-end connectivity securely?, which host(s) do you open up ports towards?
    - bb88 2y ago
      You don't have good end-to-end connectivity with NAT, right? With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet.
      - adriancr 2y ago
        > You don't have good end-to-end connectivity with NAT, right? I do, I have a public IPv4 that I manage as I wish. Open ports on firewall and forward where needed. No issues so far. > With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet. Where are you from and what provider are you using? That is just a crappy provider, you should switch to competition and get a separate IP with no CG-NAT. (never had CG-NAT on home connection, although I avoided providers that did that) If you're a student in a uni campus/dorms you won't really have an option and it is what it is, it used to be CG-NAT 15-20 years ago too. Even with IPv6 they'd likely firewall everything off and the range would have bad reputation.

dmitrygr 2y ago

> Going even further, NAT Yup, and having lost any and all reasons to use IPv6, go back to what has already been working just fine: IPv4

bb88 2y ago
CG-NAT really isn't great.

JohnFen 2y ago

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use cases are legit. I just don't share them and want the most restrictive network setup that I can tolerate.

noinsight 2y ago
> I don't want any random machines behind my router to be able to open ports to the internet at large. The solution to this is a firewall, not NAT. As has always been. NAT is not a security feature and never has been. The fact that it blocks uninitiated inbound connectivity is an implementation detail, not its purpose.
- JohnFen 2y ago
  > NAT is not a security feature and never has been. True, and I don't think of it as such -- after all, NAT or not, it's my firewall doing the protecting. What NAT would buy me here is convenience, not security. I could have the same level of security without NAT, but managing it properly is easier and less error-prone with it.
  - kstrauser 2y ago
    Having managed both, it is absolutely, 100%, not easier to manage NAT than a firewall. For example, here's a valid OpenBSD pf configuration: pass out on $ext_if from any to any That's it. That's the entire stateful firewall config: Don't allow anything inbound at all, except directly in response to an outbound connection. If your firewall has a GUI, it'll be as easy to configure that as it is the NAT. If your firewall has a CLI, I guarantee there's no NAT in the world that's easier to configure than the above stateful firewall.
    - 2y ago

drdaeman 2y ago

I think the real question is "what the hell IoT is doing on a globally-routable network?" Put it on an isolated VLAN with no Internet connectivity. Or a minimal connectivity only to what's absolutely necessary (e.g. I haven't seen IoT devices that need inbound connections, so drop any inbound packets unless conntrack says otherwise). There there will be probably no need for weird NAT66 contraptions or anything like that - just old good plain drop-by-default firewall. But then, the article is about consumer tech, and most consumers aren't gonna set up any VLANs, firewalls or complex NAT systems, they don't know anything about those. They got one single flat WiFi network and that's about it. So, I guess, all the technical suggestions here are not really relevant.

toast0 2y ago
> Put it on an isolated VLAN with no Internet connectivity. It's hardly an Internet of Things if your Things aren't connected to the Internet :p
- chipdart 2y ago
  From the very first paragraph of Wikipedia's article on IoT: > "Internet of things" has been considered a misnomer because devices do not need to be connected to the public internet; they only need to be connected to a network[6] and be individually addressable.[7][8]

somerandomqaguy 2y ago

>Quick solution would be DHCPv6 so they don't have a choice in what address they use. Android doesn't support DHCPv6. https://issuetracker.google.com/issues/36949085 https://issuetracker.google.com/issues/36949085

m463 2y ago

I just use ipv4 in my network. it's my personal network (and my personal opinion/solution). I turn off ipv6. I don't want to maintain two sets of firewall rules, or have some weird routing problem that lets packets in or out. I add this to my linux kernel command line: ipv6.disable=1 ipv6.ipv6_disable=1 sometimes in /etc/sysctl.d/00-nov6.conf: net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 in macos I do: networksetup -setv6off 'Ethernet 1' (or whatever network interface) helps me be more organized.