3 ms·

The article seems to perpetuate one of those age old myths that NAT has something to do with protection. Yes, in a very superficial sense, you can't literally

by Arch-TK 11mo ago

The article seems to perpetuate one of those age old myths that NAT has something to do with protection. Yes, in a very superficial sense, you can't literally route a packet over the internet backwards to a host behind NAT without matching a state entry or explicit port forwarding. But implementing NAT on it's own says nothing about the behavior of your router firewall with regards to receiving Martians, or with regards to whether the router firewall itself accepts connections and if the router firewall itself isn't running some service which causes exposure. To actually protect things behind NAT you still need firewall rules and you can keep those rules even when you are not using NAT. Thus those rules, and by extension the protection, are separable from the concept of NAT. This is the kind of weird argument that has caused a lot of people who hadn't ever used IPv6 to avoid trying it.

gldrk 11mo ago
>Yes, in a very superficial sense, you can't literally route a packet over the internet backwards to a host behind NAT without matching a state entry or explicit port forwarding. Don’t forget source routing. That said, depending on your threat model, it’s not entirely unreasonable to just rely on your ISP’s configuration to protect you from stuff like this, specifically behind an IANA private range.
- sedawkgrep 11mo ago
  I don't think source routing is a thing anymore. At least if you're talking about the ability of a source to specify a path to its destination. The last time I heard about source routing actually being a useful feature or a vulnerability used by hackers was the 1990's.
globular-toast 11mo ago
Yeah, I keep meaning to write something about this. I've definitely noticed people wary of IPv6 because their machines get "real" IP addresses rather than the "safe" RFC1918 ones. Of course, having a real IP address is precisely the point of IPv6. It's like we've been collectively trained to think of RFC1918 as "safe" and forgotten what a firewall is. It's one of those "a little knowledge is a dangerous thing" things.
- sshine 11mo ago
  In a world where people think NAT addresses are safe because you don’t need to know anything else about firewalls, IPv6 _is_ fundamentally less secure.
  - zamadatix 11mo ago
    In both cases the only consumer security comes from "the home router defaults to being a stateful firewall". The only difference between the two is whether it also defaults to doing NAT with that state, which is not what was making IPv4 secure for people unaware either.
  - throw0101a 11mo ago
    > In a world where people think NAT addresses are safe because […] The vast, vast majority of people do not know what NAT is: ask your mom, aunt, uncle, grandma, cousin(s), etc. They simply have a 'magic box' (often from the ISP) that "connects to Internet". People connect to it (now mostly via Wifi) and they are "on the Internet". They do not know about IPv4 or IPv6 (or ARP, or DHCP, or SLAAC). As long as the magic box is statefully inspecting traffic, which is done for IPv4-NAT, and for IPv6 firewalls, it makes no practical difference which address family you are using from a security perspective. The rending of garments over having a globally routable IPv6 address (but not globally reachable, because of SPI) on your home is just silliness. If you think NAT addresses are safe because… of any reason whatsoever really… simply shows a lack of network understanding. You might as well be talking to a Flat Earther about orbital mechanics.
    - mqus 11mo ago
      > which is done for IPv4-NAT, and for IPv6 firewalls Are internet routers that do ipv4 NAT usually also doing an IPv6 firewall (meaning they only let incoming connections in if they are explicitly allowed by some configuration)? Maybe thats the point where the insecurity comes from. A Home NAT cannot work any other way(it fails "safely"), a firewall being absent usually means everything just gets through.
mzhaase 11mo ago
If you think about it, NAT offers pretty much the same protection as a default stateful firewall. Only allowing packets from the outside related to a connection initiated from the inside.
- lloeki 11mo ago
  > Only allowing packets from the outside related to a connection initiated from the inside. NAT a.k.a IP masquerading does not do that, it only figures out that some ingress packets whose DST is the gateway actually map to previous packets coming from a LAN endpoint that have been masqueraded before, performs the reverse masquerading, and routes the new packet there. But plop in a route to the network behind and unmatched ingress packets definitely get routed to the internal side. To have that not happen you need to drop those unmatched ingress packets, and that's the firewall doing that. Fun fact: some decade ago an ISP where I lived screwed that up. A neighbour and I figured out the network was something like that: 192.168.1.x --- 192.168.1.1 -- \ 10.0.0.x ----> WAN / 192.168.2.x --- 192.168.2.1 -- 192.168.1 and 192.168.2 would be two ISP subscribers and 10.0.0.x some internal local haul. 192.168.x.1 would perform NAT but not firewall. You'd never see that 10.0.0.x usually as things towards WAN would get NAT'd (twice). But 10.0.0.x would know about both of the 192, so you just had to add respective routes to each other in the 192.168.x.1 and bam you'd be able to have packets fly through both ways, NAT be damned. Network Address Translation is not a firewall and provides no magically imbued protection.
  - grosswait 11mo ago
    I have never seen a NAT implementation that forwarded every packet sent to it. As you stated in your first sentence, NAT forwards packets that match previous packets. Assuming it does that job well, that’s filtering right there.
    - throw0101a 11mo ago
      > I have never seen a NAT implementation that forwarded every packet sent to it. * https://kb.netgear.com/25891/What-is-the-De-Militarized-Zone-DMZ-feature-on-my-NETGEAR-router https://kb.netgear.com/25891/What-is-the-De-Militarized-Zone... * https://support.linksys.com/kb/article/312-en/ https://support.linksys.com/kb/article/312-en/ * https://www.asus.com/ca-en/support/faq/1011723/ https://www.asus.com/ca-en/support/faq/1011723/

by Arch-TK 11mo ago

gldrk 11mo ago

>Yes, in a very superficial sense, you can't literally route a packet over the internet backwards to a host behind NAT without matching a state entry or explicit port forwarding. Don’t forget source routing. That said, depending on your threat model, it’s not entirely unreasonable to just rely on your ISP’s configuration to protect you from stuff like this, specifically behind an IANA private range.

sedawkgrep 11mo ago
I don't think source routing is a thing anymore. At least if you're talking about the ability of a source to specify a path to its destination. The last time I heard about source routing actually being a useful feature or a vulnerability used by hackers was the 1990's.

globular-toast 11mo ago

Yeah, I keep meaning to write something about this. I've definitely noticed people wary of IPv6 because their machines get "real" IP addresses rather than the "safe" RFC1918 ones. Of course, having a real IP address is precisely the point of IPv6. It's like we've been collectively trained to think of RFC1918 as "safe" and forgotten what a firewall is. It's one of those "a little knowledge is a dangerous thing" things.

sshine 11mo ago
In a world where people think NAT addresses are safe because you don’t need to know anything else about firewalls, IPv6 _is_ fundamentally less secure.
- zamadatix 11mo ago
  In both cases the only consumer security comes from "the home router defaults to being a stateful firewall". The only difference between the two is whether it also defaults to doing NAT with that state, which is not what was making IPv4 secure for people unaware either.
- throw0101a 11mo ago
  > In a world where people think NAT addresses are safe because […] The vast, vast majority of people do not know what NAT is: ask your mom, aunt, uncle, grandma, cousin(s), etc. They simply have a 'magic box' (often from the ISP) that "connects to Internet". People connect to it (now mostly via Wifi) and they are "on the Internet". They do not know about IPv4 or IPv6 (or ARP, or DHCP, or SLAAC). As long as the magic box is statefully inspecting traffic, which is done for IPv4-NAT, and for IPv6 firewalls, it makes no practical difference which address family you are using from a security perspective. The rending of garments over having a globally routable IPv6 address (but not globally reachable, because of SPI) on your home is just silliness. If you think NAT addresses are safe because… of any reason whatsoever really… simply shows a lack of network understanding. You might as well be talking to a Flat Earther about orbital mechanics.
  - mqus 11mo ago
    > which is done for IPv4-NAT, and for IPv6 firewalls Are internet routers that do ipv4 NAT usually also doing an IPv6 firewall (meaning they only let incoming connections in if they are explicitly allowed by some configuration)? Maybe thats the point where the insecurity comes from. A Home NAT cannot work any other way(it fails "safely"), a firewall being absent usually means everything just gets through.

mzhaase 11mo ago

If you think about it, NAT offers pretty much the same protection as a default stateful firewall. Only allowing packets from the outside related to a connection initiated from the inside.

lloeki 11mo ago
> Only allowing packets from the outside related to a connection initiated from the inside. NAT a.k.a IP masquerading does not do that, it only figures out that some ingress packets whose DST is the gateway actually map to previous packets coming from a LAN endpoint that have been masqueraded before, performs the reverse masquerading, and routes the new packet there. But plop in a route to the network behind and unmatched ingress packets definitely get routed to the internal side. To have that not happen you need to drop those unmatched ingress packets, and that's the firewall doing that. Fun fact: some decade ago an ISP where I lived screwed that up. A neighbour and I figured out the network was something like that: 192.168.1.x --- 192.168.1.1 -- \ 10.0.0.x ----> WAN / 192.168.2.x --- 192.168.2.1 -- 192.168.1 and 192.168.2 would be two ISP subscribers and 10.0.0.x some internal local haul. 192.168.x.1 would perform NAT but not firewall. You'd never see that 10.0.0.x usually as things towards WAN would get NAT'd (twice). But 10.0.0.x would know about both of the 192, so you just had to add respective routes to each other in the 192.168.x.1 and bam you'd be able to have packets fly through both ways, NAT be damned. Network Address Translation is not a firewall and provides no magically imbued protection.
- grosswait 11mo ago
  I have never seen a NAT implementation that forwarded every packet sent to it. As you stated in your first sentence, NAT forwards packets that match previous packets. Assuming it does that job well, that’s filtering right there.
  - throw0101a 11mo ago
    > I have never seen a NAT implementation that forwarded every packet sent to it. * https://kb.netgear.com/25891/What-is-the-De-Militarized-Zone-DMZ-feature-on-my-NETGEAR-router https://kb.netgear.com/25891/What-is-the-De-Militarized-Zone... * https://support.linksys.com/kb/article/312-en/ https://support.linksys.com/kb/article/312-en/ * https://www.asus.com/ca-en/support/faq/1011723/ https://www.asus.com/ca-en/support/faq/1011723/