4 ms·

Also, NAT is desirable for security/network isolation reasons, and having no distinction between a local IP and a public IP has a lot of disadvantages. Yes, th

by Gormo 2y ago

Also, NAT is desirable for security/network isolation reasons, and having no distinction between a local IP and a public IP has a lot of disadvantages. Yes, there are ways to configure IPv6 to isolate subnets, separate local traffic from internet traffic, set up firewalls and DMZs, run local DNS, etc., but they're all more complicated to configure and administer than their IPv4 equivalents.

throw0101d 2y ago
> Also, NAT is desirable for security/network isolation reasons […] This is security theatre. People have been saying that NAT is not a security feature for over a decade: * https://blog.ipspace.net/2011/12/is-nat-security-feature/ https://blog.ipspace.net/2011/12/is-nat-security-feature/ but the message still has not sunk in. The "Zero Trust" paper was published by John Kindervag in 2010: * https://media.paloaltonetworks.com/documents/Forrester-No-More-Chewy-Centers.pdf https://media.paloaltonetworks.com/documents/Forrester-No-Mo... Most modern attacks start from a compromised internal host (e.g., from phishing), or through stolen credentials via a remote access method. The above is "castle-and-moat" thinking that tends to have weaker internal controls because it is thought the internal network is "hidden" from the dangerous outside network. Set your firewall to default deny, then add a rule for allow outgoing connections, followed by only allow incoming connections if they are replies. For most machines (and networks), most of the time, this is what's needed: the above is applicable for both IPv6 and IPv4 (with or without NAT). The protection comes from filtering (generally) and stateful packet inspection, not from hiding addresses. > […] and having no distinction between a local IP and a public IP has a lot of disadvantages. Just because something has a global addresses does not mean global reachability (see default deny above). Further you can layout your IPv6 address plan so that you can tell at a glance if hosts are externally accessible. Using a /48 a basis, you break out sixteen /52s, numbered $PREFIX:[0-f]000::/52. To make it easier to remember what is externally accessible, you put all of those hosts in $PREFIX:e000::/52, where e stands for external. That /52 can then be broken down into: * sixteen /56s * 256 /60s * 4096 /64s or any combination thereof. See Figure A-5 for various ways to slice and dice: * https://www.oreilly.com/library/view/ipv6-address-planning/9781491908211/apa.html https://www.oreilly.com/library/view/ipv6-address-planning/9... Everything in $PREFIX:[0-d,f]000::/52 is not externally reachable.
- aboardRat4 2y ago
  >https://blog.ipspace.net/2011/12/is-nat-security-feature/ https://blog.ipspace.net/2011/12/is-nat-security-feature/ >>Basic NAT (as defined in RFC 2663) performs just the IP address translation (one inside host to one IP address in the NAT pool). The moment the inside host starts a session through the NAT, it becomes fully exposed to the outside world. This is a lie. A "session through the NAT" does not really expose the host to the outside world, because in 99% of the cases this is a TCP session, and the NAT machine would drop all "out of order" packets. >Most modern attacks start from a compromised internal host (e.g., from phishing), or through stolen credentials via a remote access method. Your statement is a perfect example of https://en.wikipedia.org/wiki/Survivorship_bias https://en.wikipedia.org/wiki/Survivorship_bias. Most modern attacks start from an internal host exactly because NAT makes external attacks infeasible for the majority of scenarios. >Set your firewall to default deny, then add a rule for allow outgoing connections, followed by only allow incoming connections if they are replies. What about I don't do it, and the system is still _automatically_ secure, because NAT does exactly that while being _required_ for the system to work. >See Figure A-5 LOL. What about I don't see any figures, and the system still works and is secure for the 99% of the cases.
  - alfons_foobar 2y ago
    > This is a lie. A "session through the NAT" does not really expose the host to the outside world, because in 99% of the cases this is a TCP session, and the NAT machine would drop all "out of order" packets. No, it's not. NAT only translates addresses and does not inspect the TCP "internals" (like sequence number etc, which would allow it to block certain packets). What you are describing is a stateful firewall that allows "reply packets" for an established TCP-session.
    - aboardRat4 2y ago
      >No, it's not. NAT only translates addresses and does not inspect the TCP "internals" (like sequence number etc, which would allow it to block certain packets). Yes it is. How would it forward response packets back if it doesn't track connections? In real life I haven't seen "stateless NAT" for about 20 years. But cgnat machines usually go beyond that and even verify sequence numbers.
eqvinox 2y ago
> NAT is desirable for security/network isolation reasons For the love of expletive this mistaken belief needs to have died yesterday. NAT boxes help primarily because they also contain a firewall. But most of 2024's network security problems originate from the devices behind your firewall getting exploited through their on requests, not some random shit connecting from the outside. (Yes, that does still happen, so you keep your firewall.) > no distinction between a local IP and a public IP https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address
- BonoboIO 2y ago
  Amen! In the 2000s I had a newly setup windows xp with the modem on the internet. After 30 minutes it was toast. Riddled with viruses.
  - nurettin 2y ago
    I had the same, except I was not running it as admin, so nothing could touch system32 or the boot sector.
- aboardRat4 2y ago
  >But most of 2024's network security problems originate from the devices behind your firewall getting exploited through their on requests, not some random shit connecting from the outside. That is Survivor Bias at its best. The originate _inside_ because NAT effectively blocks all _external_ requests.
  - eqvinox 2y ago
    > The originate _inside_ because NAT effectively blocks all _external_ requests. You mean the firewall effectively blocks all external requests.
    - noduerme 2y ago
      Regardless, it's a fair point. Most of the attack surface on client / end user boxes these days is through social engineering and end user stupidity. Vanishingly little of it on modern OSes comes from external sources like a scan revealing a mistakenly open port. It's just that the threat profile has shifted toward making users make mistakes to the point where so much resource is thrown at fooling users now that, by the numbers and the ransomware profits, it's more effective than trying to penetrate software remotely.
zbentley 2y ago
> Yes, there are ways to configure IPv6 to isolate subnets, separate local traffic from internet traffic, set up firewalls and DMZs, run local DNS, etc., but they're all more complicated to configure and administer than their IPv4 equivalents. Eh, I think that has hindsight bias. Setting up NAT manually, or customizing how things are NATed beyond the typical "one or two subnets/IP ranges behind a NAT gateway and maybe a DMZ" you see in businesses and residences is quite complicated! It's just that our control planes are really optimized to make that common case very easy. From router web UIs to pf presets to Windows'/NetworkManager's "share network" functionality to what articles/how-tos are available, that complexity is very effectively hidden but not removed. As IPv6 becomes more entrenched (and more sites move to IPv6-only or public-IPv6-only deployments), the same thing that happened for the IPv4 world will happen for network segmentation configuration in the IPv6 world: it will get a lot easier and common defaults/conventions will emerge. I don't think the inherent complexity differences between IPv4 and IPv6 are that relevant here.
belorn 2y ago
Modern ransomware attacks has demonstrated beyond doubt the very harmful belief that private network behind nat is an acceptable alternative to keeping systems secured and patched. The only thing nat does in a security sense is to provide false sense of security until the day a single machine inside get compromised and then the whole hospital or company comes to a standstill while rushing to restore from backup, praying that they do keep backups. Its a mistake, and the only reason it felt like a good idea was because Microsoft with windows 98/2k/xp got hit en-mass with worms targeting vulnerable windows machines that never got updates.

by Gormo 2y ago

throw0101d 2y ago

> Also, NAT is desirable for security/network isolation reasons […] This is security theatre. People have been saying that NAT is not a security feature for over a decade: * https://blog.ipspace.net/2011/12/is-nat-security-feature/ https://blog.ipspace.net/2011/12/is-nat-security-feature/ but the message still has not sunk in. The "Zero Trust" paper was published by John Kindervag in 2010: * https://media.paloaltonetworks.com/documents/Forrester-No-More-Chewy-Centers.pdf https://media.paloaltonetworks.com/documents/Forrester-No-Mo... Most modern attacks start from a compromised internal host (e.g., from phishing), or through stolen credentials via a remote access method. The above is "castle-and-moat" thinking that tends to have weaker internal controls because it is thought the internal network is "hidden" from the dangerous outside network. Set your firewall to default deny, then add a rule for allow outgoing connections, followed by only allow incoming connections if they are replies. For most machines (and networks), most of the time, this is what's needed: the above is applicable for both IPv6 and IPv4 (with or without NAT). The protection comes from filtering (generally) and stateful packet inspection, not from hiding addresses. > […] and having no distinction between a local IP and a public IP has a lot of disadvantages. Just because something has a global addresses does not mean global reachability (see default deny above). Further you can layout your IPv6 address plan so that you can tell at a glance if hosts are externally accessible. Using a /48 a basis, you break out sixteen /52s, numbered $PREFIX:[0-f]000::/52. To make it easier to remember what is externally accessible, you put all of those hosts in $PREFIX:e000::/52, where e stands for external. That /52 can then be broken down into: * sixteen /56s * 256 /60s * 4096 /64s or any combination thereof. See Figure A-5 for various ways to slice and dice: * https://www.oreilly.com/library/view/ipv6-address-planning/9781491908211/apa.html https://www.oreilly.com/library/view/ipv6-address-planning/9... Everything in $PREFIX:[0-d,f]000::/52 is not externally reachable.

aboardRat4 2y ago
>https://blog.ipspace.net/2011/12/is-nat-security-feature/ https://blog.ipspace.net/2011/12/is-nat-security-feature/ >>Basic NAT (as defined in RFC 2663) performs just the IP address translation (one inside host to one IP address in the NAT pool). The moment the inside host starts a session through the NAT, it becomes fully exposed to the outside world. This is a lie. A "session through the NAT" does not really expose the host to the outside world, because in 99% of the cases this is a TCP session, and the NAT machine would drop all "out of order" packets. >Most modern attacks start from a compromised internal host (e.g., from phishing), or through stolen credentials via a remote access method. Your statement is a perfect example of https://en.wikipedia.org/wiki/Survivorship_bias https://en.wikipedia.org/wiki/Survivorship_bias. Most modern attacks start from an internal host exactly because NAT makes external attacks infeasible for the majority of scenarios. >Set your firewall to default deny, then add a rule for allow outgoing connections, followed by only allow incoming connections if they are replies. What about I don't do it, and the system is still _automatically_ secure, because NAT does exactly that while being _required_ for the system to work. >See Figure A-5 LOL. What about I don't see any figures, and the system still works and is secure for the 99% of the cases.
- alfons_foobar 2y ago
  > This is a lie. A "session through the NAT" does not really expose the host to the outside world, because in 99% of the cases this is a TCP session, and the NAT machine would drop all "out of order" packets. No, it's not. NAT only translates addresses and does not inspect the TCP "internals" (like sequence number etc, which would allow it to block certain packets). What you are describing is a stateful firewall that allows "reply packets" for an established TCP-session.
  - aboardRat4 2y ago
    >No, it's not. NAT only translates addresses and does not inspect the TCP "internals" (like sequence number etc, which would allow it to block certain packets). Yes it is. How would it forward response packets back if it doesn't track connections? In real life I haven't seen "stateless NAT" for about 20 years. But cgnat machines usually go beyond that and even verify sequence numbers.

eqvinox 2y ago

> NAT is desirable for security/network isolation reasons For the love of expletive this mistaken belief needs to have died yesterday. NAT boxes help primarily because they also contain a firewall. But most of 2024's network security problems originate from the devices behind your firewall getting exploited through their on requests, not some random shit connecting from the outside. (Yes, that does still happen, so you keep your firewall.) > no distinction between a local IP and a public IP https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address

BonoboIO 2y ago
Amen! In the 2000s I had a newly setup windows xp with the modem on the internet. After 30 minutes it was toast. Riddled with viruses.
- nurettin 2y ago
  I had the same, except I was not running it as admin, so nothing could touch system32 or the boot sector.
aboardRat4 2y ago
>But most of 2024's network security problems originate from the devices behind your firewall getting exploited through their on requests, not some random shit connecting from the outside. That is Survivor Bias at its best. The originate _inside_ because NAT effectively blocks all _external_ requests.
- eqvinox 2y ago
  > The originate _inside_ because NAT effectively blocks all _external_ requests. You mean the firewall effectively blocks all external requests.
  - noduerme 2y ago
    Regardless, it's a fair point. Most of the attack surface on client / end user boxes these days is through social engineering and end user stupidity. Vanishingly little of it on modern OSes comes from external sources like a scan revealing a mistakenly open port. It's just that the threat profile has shifted toward making users make mistakes to the point where so much resource is thrown at fooling users now that, by the numbers and the ransomware profits, it's more effective than trying to penetrate software remotely.

zbentley 2y ago

> Yes, there are ways to configure IPv6 to isolate subnets, separate local traffic from internet traffic, set up firewalls and DMZs, run local DNS, etc., but they're all more complicated to configure and administer than their IPv4 equivalents. Eh, I think that has hindsight bias. Setting up NAT manually, or customizing how things are NATed beyond the typical "one or two subnets/IP ranges behind a NAT gateway and maybe a DMZ" you see in businesses and residences is quite complicated! It's just that our control planes are really optimized to make that common case very easy. From router web UIs to pf presets to Windows'/NetworkManager's "share network" functionality to what articles/how-tos are available, that complexity is very effectively hidden but not removed. As IPv6 becomes more entrenched (and more sites move to IPv6-only or public-IPv6-only deployments), the same thing that happened for the IPv4 world will happen for network segmentation configuration in the IPv6 world: it will get a lot easier and common defaults/conventions will emerge. I don't think the inherent complexity differences between IPv4 and IPv6 are that relevant here.

belorn 2y ago

Modern ransomware attacks has demonstrated beyond doubt the very harmful belief that private network behind nat is an acceptable alternative to keeping systems secured and patched. The only thing nat does in a security sense is to provide false sense of security until the day a single machine inside get compromised and then the whole hospital or company comes to a standstill while rushing to restore from backup, praying that they do keep backups. Its a mistake, and the only reason it felt like a good idea was because Microsoft with windows 98/2k/xp got hit en-mass with worms targeting vulnerable windows machines that never got updates.