4 ms·
I am the last person to be defending NAT, but the benefit of NAT is that it sets up a really good default: incoming connections are not routable by default, and
by pclmulqdq 2y ago
I am the last person to be defending NAT, but the benefit of NAT is that it sets up a really good default: incoming connections are not routable by default, and it's very hard to accidentally change this. There are many good ways to have "not routable by default" with IPv6, but you have to do that at the software level, while NAT forces it at a protocol level.
- vel0city 2y ago> incoming connections are not routable by default Tons of firewalls ship with this as a default logic, it doesn't require NAT in the slightest.
- kiririn 2y agoParent poster is making the (good and underrated) point that NAT makes this logic failsafe: Turn an IPv6 firewall off and you’ve got all incoming connections allowed. Turn IPv4 NAT off and you’ve got no connectivity at all
- vel0city 2y agoSo gate it behind a "here be dragons" option or hide it in the GUI entirely for the basic home version.
- pferde 2y agoOr make the "turned off" state block all traffic, just like closing a water valve, or a road gate. I never understood why network firewalls did not default to this.
- kiririn 2y agoTurning off the firewall could just as easily be a unnoticed configuration error that causes it to die on startup
- ninkendo 2y ago> incoming connections are not routable by default, and it's very hard to accidentally change this Not just difficult, but impossible, even in principle, because there are more than one device sharing the same IP so at most one host would be vulnerable. Not the same as with IPv6, where screwing up the defaults leaves your entire network vulnerable.
- Hikikomori 2y agoYou can forward all ports to a device, pretty common feature.
- ninkendo 2y agoRight but that only leaves that device vulnerable. The other devices are not.
- lanstin 2y agoIn practice, that makes the entire network vulnerable.
- pclmulqdq 2y agoYeah, server-side NAT + use of a reverse proxy makes hosting many websites from one IPv4 a possibility, albeit a relatively difficult one. You are only really in trouble if two consumers want raw TCP/UDP on one port.
- deleted 2y ago[deleted]
- klabb3 2y agoHow are you gonna get the IPv6s of your targets? Can’t scan a /64, and with ephemeral ”security” addresses used for outbound conns, an adversary won’t be able to guess the address anyway. At least that’s my understanding. So I guess my question is: is this a real threat?
- icehawk 2y agoOnly if you trust your ISP: https://www.anvilsecure.com/blog/dhcp-games-with-smart-router-devices.html https://www.anvilsecure.com/blog/dhcp-games-with-smart-route...
- Helmut10001 2y agoThis reminds me of a company where the admin used public routable IPs for the internal subnet. The gap is always the human in the loop.
- Symbiote 2y agoThere's nothing wrong with this, and it's common at universities that have large IPv4 allocations.
- Helmut10001 2y agoThe subnet that he used internally was "officially" used and owned by oracle and our printers regularly send traffic falsely to Silicon Valley.
- icedchai 2y agoThis was the norm for most of the 90's and earlier. NAT was supposed to be the exception, but it became the rule. Now we have an entire generation that doesn't understand that the Internet was always supposed to support end-to-end connectivity.
- WorldMaker 2y agoPlus too many of that generation see NAT as a "security feature" not an "IP bug" and can't seem to (re-)imagine traditional firewall/router design from the time before NAT. "end-to-end connectivity" is not the same thing as "open and unsecured connectivity", we have the security tools to deal with that and they are not and have never been named "NAT".
- icedchai 2y agoTo say NAT has nothing to do with "security" is a lie. The most common NAT (PAT) configurations are basically acting as stateful firewalls with a default deny policy for all unsolicited inbound traffic to a private, non-routeable network.