4 ms·

> the NAT-by-default of IPv4 IPv4 is not NAT-by-default. The reality of the world we live in today is that most home networks have a NAT, because you need mult

by radlad 9mo ago

> the NAT-by-default of IPv4 IPv4 is not NAT-by-default. The reality of the world we live in today is that most home networks have a NAT, because you need multiple devices behind a single IP. That said, I agree: it's quite unknowable how many services I've turned on on local machines with the expectation that a router firewall sat between me and potential clients. But that doesn't go away with IPv6 - the NAT does, the router doesn't, and the firewall shouldn't either. For example, the default UniFi firewall rules for IPv6 are: 1. Allow Established/Related Traffic (outbound return traffic), 2. Block Invalid Traffic, 3. Block All Other Traffic You must explicitly open a firewall rule for inbound IPv6 traffic. NAT is not the firewall.

cyberax 9mo ago
> NAT is not the firewall. NAT _is_ a firewall. And a much safer one than IPv6 firewalls, because NAT will fail safe if misconfigured.
- radlad 9mo ago
  NAT is not a firewall: all it does is rewrite packets, it does not drop them.
  - jonathanlydall 9mo ago
    The article actually remarks on this kind of argument. While you are technically correct about NAT not being a firewall, it is in practice a widely used front-line defense which even if not “perfect”, it has indisputably proven to be quite effective against a lot of malicious activity. Against highly determined malicious actors you will of course want a proper firewall, but for 99% of people, NAT is enough to keep from being bothered by run of the mill malicious actors. Kind of like physical home security, a lot of it is very easy to bypass, but it’s good enough for the common threats.
    - radlad 9mo ago
      > Against highly determined malicious actors you will of course want a proper firewall, but for 99% of people, NAT is enough to keep from being bothered by run of the mill malicious actors. Maybe, maybe not, but regardless 99% of people are not protected by a NAT. They are protected by a "proper firewall," which happens to support NAT (and typically, is enabled for IPv4 networks.) That is to say, while most home routers support NATs, they also ship with a default-deny firewall turned on. Typically, enabling NAT mappings also configures the firewall for users. But they are not the same thing and we need to stop conflating them because it causes a lot of confusion when people think that IPv6 is "open by default" and that IPv4 is "protected by NAT." It's not. They are both protected by your router using the same default-deny firewall.
      - cyberax 9mo ago
        This is BS. "Default deny" or "default accept" makes no practical difference with NAT. You can leave the "default accept" rule with NAT and you'll be perfectly fine except in some weird edge cases. That's because it's exploitable only if you control the next hop from the NAT router, which is typically within the ISP infrastructure. So the attacker will need to either hack your ISP or mess with your NAT router's physical uplink. Both cases require a very dedicated attacker.
        radlad 9mo ago
        A default deny firewall is a good idea to protect services everywhere in your network, including those which run on the router itself (e.g. many routers run a local DNS server.) Without NAT, packets are not dropped, they simply do not have their destination rewritten to another device on the network. The traffic is still destined for the router and will be processed by it. This is why routers ship with a default-deny firewall rule. NAT is not a firewall. It is address translation. It will not drop packets.
        cyberax 9mo ago
        Sure, a default deny is a good idea. However, it's not _critical_. If you forget to enforce it on your NAT router, you'll be fine. And if you are behind a CGNAT, it's even safer. In IPv6 it becomes absolutely essential. If you forget to include it, your network becomes wide open. And you don't have an easy way to detect this because you need an external service to probe your network. > NAT is not a firewall. It is address translation. It will not drop packets. Yes, it is a firewall because it enables the address space isolation.
  - tyingq 9mo ago
    You have to squint a little and see they mean that most consumer routers don't map inbound unsolicited packets to anything internal unless the user specifically configured it to. Which is basically a firewall.
    - jcalvinowens 9mo ago
      That's not true in my experience, consumer grade routers will often happily route packets with rfc1918 destination addresses from the WAN to the LAN interface all day. The "firewall" is only that nobody can get packets with those destination addresses to the home router's WAN interface through the internet.
    - radlad 9mo ago
      This is because most consumer routers have a firewall, which is separate from the NAT. Creating NAT mappings also creates firewall entries. Otherwise, the router would happily pass the packet along to any IP address it finds in a packet it receives. That's the job of a router, after all.
  - dlcarrier 9mo ago
    A NAT will drop all packets, until something upstream opens a port. Dropping packets is the default behavior of a NAT.
    - radlad 9mo ago
      Nope, it's the default behavior of a typical firewall. NAT rewrites packets but it never drops packets. An un-rewritten packet may fail to route (i.e. "destination unknown".) But that depends on the destination in the packet.

by radlad 9mo ago

cyberax 9mo ago

> NAT is not the firewall. NAT _is_ a firewall. And a much safer one than IPv6 firewalls, because NAT will fail safe if misconfigured.

radlad 9mo ago
NAT is not a firewall: all it does is rewrite packets, it does not drop them.
- jonathanlydall 9mo ago
  The article actually remarks on this kind of argument. While you are technically correct about NAT not being a firewall, it is in practice a widely used front-line defense which even if not “perfect”, it has indisputably proven to be quite effective against a lot of malicious activity. Against highly determined malicious actors you will of course want a proper firewall, but for 99% of people, NAT is enough to keep from being bothered by run of the mill malicious actors. Kind of like physical home security, a lot of it is very easy to bypass, but it’s good enough for the common threats.
  - radlad 9mo ago
    > Against highly determined malicious actors you will of course want a proper firewall, but for 99% of people, NAT is enough to keep from being bothered by run of the mill malicious actors. Maybe, maybe not, but regardless 99% of people are not protected by a NAT. They are protected by a "proper firewall," which happens to support NAT (and typically, is enabled for IPv4 networks.) That is to say, while most home routers support NATs, they also ship with a default-deny firewall turned on. Typically, enabling NAT mappings also configures the firewall for users. But they are not the same thing and we need to stop conflating them because it causes a lot of confusion when people think that IPv6 is "open by default" and that IPv4 is "protected by NAT." It's not. They are both protected by your router using the same default-deny firewall.
    - cyberax 9mo ago
      This is BS. "Default deny" or "default accept" makes no practical difference with NAT. You can leave the "default accept" rule with NAT and you'll be perfectly fine except in some weird edge cases. That's because it's exploitable only if you control the next hop from the NAT router, which is typically within the ISP infrastructure. So the attacker will need to either hack your ISP or mess with your NAT router's physical uplink. Both cases require a very dedicated attacker.
      - radlad 9mo ago
        A default deny firewall is a good idea to protect services everywhere in your network, including those which run on the router itself (e.g. many routers run a local DNS server.) Without NAT, packets are not dropped, they simply do not have their destination rewritten to another device on the network. The traffic is still destined for the router and will be processed by it. This is why routers ship with a default-deny firewall rule. NAT is not a firewall. It is address translation. It will not drop packets.
        cyberax 9mo ago
        Sure, a default deny is a good idea. However, it's not _critical_. If you forget to enforce it on your NAT router, you'll be fine. And if you are behind a CGNAT, it's even safer. In IPv6 it becomes absolutely essential. If you forget to include it, your network becomes wide open. And you don't have an easy way to detect this because you need an external service to probe your network. > NAT is not a firewall. It is address translation. It will not drop packets. Yes, it is a firewall because it enables the address space isolation.
- tyingq 9mo ago
  You have to squint a little and see they mean that most consumer routers don't map inbound unsolicited packets to anything internal unless the user specifically configured it to. Which is basically a firewall.
  - jcalvinowens 9mo ago
    That's not true in my experience, consumer grade routers will often happily route packets with rfc1918 destination addresses from the WAN to the LAN interface all day. The "firewall" is only that nobody can get packets with those destination addresses to the home router's WAN interface through the internet.
  - radlad 9mo ago
    This is because most consumer routers have a firewall, which is separate from the NAT. Creating NAT mappings also creates firewall entries. Otherwise, the router would happily pass the packet along to any IP address it finds in a packet it receives. That's the job of a router, after all.
- dlcarrier 9mo ago
  A NAT will drop all packets, until something upstream opens a port. Dropping packets is the default behavior of a NAT.
  - radlad 9mo ago
    Nope, it's the default behavior of a typical firewall. NAT rewrites packets but it never drops packets. An un-rewritten packet may fail to route (i.e. "destination unknown".) But that depends on the destination in the packet.