19 ms·

IPv6 is not insecure because it lacks a NAT

• emmelaich 9mo ago
  Security is not a binary. NAT is (slightly?) more secure.
  • mrsssnake 9mo ago
    Carriers dropping legacy IP network and providing only direct connection to few popular CDNs would be natural next step for this security strategy.
• ggm 9mo ago
  Not wishing to undermine the central point, NAT for v6 is a thing. The point of the article is that it's not "NAT by default" the way home IPv4 is because so few places worldwide get more than a single IP per customer: The NAT is not there in v4 for security, it's to provide for multiple devices inside the home. Or, in the case of Carrier-Grade NAT, to manage multiple customers, behind a small pool of v4. NAT doesn't exist to be secure. If it is, (and that is debatable because NAT busting is a thing) then, it's a side-effect. NAT for v6 is not common. If you use ULA, you'd possibly use NAT for v6 in some circumstances. https://datatracker.ietf.org/doc/html/rfc6296 https://datatracker.ietf.org/doc/html/rfc6296
  • ghshephard 9mo ago
    Just to nitpick a bit. What people typically mean when they say "IPV4 NAT" is Network and Port translation. My 192.168.0.1 internally becomes 172.217.12.100 and my port gets converted to something that is tracked so that the return packet can find it's target. In IPv6, Prefix-Translation is similar, in that the /64 prefix is translated 1:1 - but the /64 Host address is (in my experience) left alone - so that renumber a network becomes trivial when you change ISPs - you just just change the prefix. I don't actually know if "IPv4 NAT" behavior even exists in the IPv6 world, except in the form of a lab experiment.
    • endmon 9mo ago
      From my understanding, the "IPv4 NAT" equivalent for IPv6 is generally referred to as NAT66 (NPTv6 for Prefix-Translation). For example, Fortinet offers this on their firewalls, and I believe most firewall vendors have this option.
      • zamadatix 9mo ago
        What they're saying is NAT66 on Fortigates is 1:1 NAT, i.e. prefix translation, not n:1 NAPT, i.e. address+port translation. I can't imagine why one would ever intend to use NAPT over NAT when the addresses were available though (e.g. on IPv4 where having a minimum of 2^64 public addresses per connection is not assumed), which is the only reason I wouldn't expect anyone to have bothered implementing it. So sure, it's what people refer to on IPv4, but it's not materially different from 1:1 NAT or necessarily adding any additional value.
    • reincarnate0x14 9mo ago
      You can do the many-to-few (or one) NAT behavior with port rewrites in IPv6 if you want to, there are just few circumstances it makes any sense. FWIW the broad IPv6 network-prefix NAT behavior ALSO EXISTS in IPv4, it's just less applicable.
  • silon42 9mo ago
    Why would you not use ULA if you have a network with multiple machines?
    • direwolf20 9mo ago
      [dead]
• Dagger2 9mo ago
  > The consequence of this is that when receiving inbound traffic, the router needs needs to be configured with where to send the traffic on the local network. As a result, it will drop any traffic that doesn’t appear in the “port forwarding” table for the NAT. As I keep trying to explain each time this comes up: no, it doesn't and it won't. When your router receives incoming traffic that isn't matched by a NAT state table entry or static port forward, it doesn't drop it. Instead, it processes that traffic in _exactly_ the same way it would have done if there was no NAT going on: it reads the dst IP header and (in the absence of a firewall) routes the packet to whatever IP is written there. Routers don't drop packets by default, so neither will routers that also do NAT. Of course, this just strengthens your point that NAT isn't security.
  • radlad 9mo ago
    That's a great point - the packet is not dropped by the firewall as a result of NAT - but it still won't route anywhere because the IP in the packet is that of the router itself. I've updated the article as a result of your comment, thanks.
    • Dagger2 9mo ago
      It might be the IP of the router, in which case the router itself will accept the connection if something is listening (like the web interface perhaps). But whoever sent you the L2 frame has full control over the contents of the IP in the packet, so it could be anything. NAT doesn't protect you from either of these.
      • mystraline 9mo ago
        Repeating the same wrong points doesnt make you right. Every NAT based product will have a firewall built in also by default. And it'll be deny-all except for conn-tracked. And that L2 attack is a martian packet. Why are you allowing reserved IPs talk on public network interfaces (hello, spoofing and obvious at that)? These are always blocked due to the reasons you describe. https://en.wikipedia.org/wiki/Martian_packet https://en.wikipedia.org/wiki/Martian_packet
• Sohcahtoa82 9mo ago
  This is going to depend on the router and on IP distribution. My ISP does not give me an IPv6 address, only a single IPv6 which all my network devices have to NAT through. NAT is not intended to be a security feature, for sure, but it creates security as a side effect. If I start up a web server on one of my devices, I know that it is unreachable from the Internet unless I go out of my way to set a port forward on my router. But...if my ISP decides to start handing out IPv6, that can change. If each of my devices gets an Internet routable IPv6 address, at that point, that security-as-a-side-effect is not guaranteed unless my router has a default-deny firewall. I would hope that any routers would ship with that. But if my ISP still gives me only a single IPv6 address and I'm still needing to use NAT, then I'm guaranteed to still effectively have a "default deny" inbound firewall policy.
  • betaby 9mo ago
    > My ISP does not give me an IPv6 address, only a single IPv6 which all my network devices have to NAT through. Interesting how that works in your case. Is your router gives your devices IPv6 from fc00::/7 and then NAT them? It would be a rather rare case.
    • jcalvinowens 9mo ago
      I'm really curious too. It's probably fd00::/8 though right? fc00::/8 is technically still reserved, although everyone seems to ignore that...
  • tadfisher 9mo ago
    > If each of my devices gets an Internet routable IPv6 address, at that point, that security-as-a-side-effect is not guaranteed unless my router has a default-deny firewall. I would hope that any routers would ship with that. They usually do, and they also ship with the most wonderful technology ever specified within a 67 MB compressed archive [0]: UPnP! Now your attacker's job is to convince you to initiate an outgoing connection, which automatically forwards an incoming port to your device behind the NAT and bypassing the router's default-deny firewall! Nothing has ever gone wrong with a zero-configuration port-forwarding protocol from the 1990s rammed through the ISO! [0]: https://openconnectivity.org/developer/specifications/upnp-resources/upnp/ https://openconnectivity.org/developer/specifications/upnp-r...
• denkmoon 9mo ago
  Invoking NAT "security" as a reason against IPv6 is a surefire indicator the person invoking it has absolutely no idea what they're talking about and should not be allowed within typing distance of any network infrastructure
  • tptacek 9mo ago
    As a reason not to IPv6? I guess. As a thing, not scare-quoted, but really security? No. Be careful with things like "absolutely no idea what they're talking about".
    • deleted 9mo ago
      [deleted]
    • cyberax 9mo ago
      I don't think that the inherent security of NATs is a _good_ reason to not do IPv6. But it _is_ a reason, and it _is_ true.
  • cyberax 9mo ago
    Please. _I_ invoked that argument, and I bet I know more about IPv6 than you do. All my services and networks have IPv6. And my first operational issues with IPv6 were in 2008, when my Asterisk SIP server started failing after ~12 hours. Culprit? Privacy addresses kept accumulating until they overflowed the SIP UDP packet size because it listed all the combinations of supported codecs/endpoints. Oh, btw, do try to answer this message: https://www.reddit.com/r/VOIP/comments/131ex1x/ipv6_sip_trunks/ https://www.reddit.com/r/VOIP/comments/131ex1x/ipv6_sip_trun... - it's still relevant to this day.
    • denkmoon 9mo ago
      Having read and considered your position I see no reason to update my opinion.
    • rnhmjoj 9mo ago
      You should have just disabled temporary addresses, they don't make a lot of sense on a server.
• omgJustTest 9mo ago
  NAT is not inherently a security feature, however where NAT happens is somewhat important. A local router that I can control deals with how to map from my public IP to my private IPs. This is not security but is obfuscation of the traffic. Obfuscation becomes almost impossible in the IPV6 context where NAT isn't necessary, it becomes optional, and given the likely trajectory that option will be exercised by sophisticated enterprise customers only.
  • kibwen 9mo ago
    As the article mentions, if you want to use NAT with IPv6, you can. The fact that it's optional doesn't mean that address obfuscation is suddenly impossible.
    • omgJustTest 9mo ago
      It means it is not by default, which as we know, is a powerful choice these days. ie enterprise customers will enable it, consumers will do it if they are tech savvy and your mom/dad/granddaughter/grandson/nephew/niece will have the default option. when you are at home you will have nat and when you are not you will be uniquely identified.
      • Dagger2 9mo ago
        If you can be uniquely identified without NAT then you can be uniquely identified with it too, because IPs don't contain your identity. You get them from a combination of the network prefix and a random number generator. There's generally no reason to be enabling NAT when you have enough address space to not need it. It can be a useful tool in your toolbox sometimes, but it's not something to be enabling by default.
• ghshephard 9mo ago
  This is the first thing that as a Network Engineer I was taught - and every formal security class I've taken (typically from Cisco - they have awesome course) - repeats the same thing. I believe the common knowledge is somewhat more nuanced than people would have you believe I present to you two separate high-value targets whose IP address has leaked: IPv4 Target: 192.168.0.1 IPv6 Target: 2001:1868:209:FFFD:0013:50FF:FE12:3456 Target #1 has an additional level of security in that you need to figure out how to route to that IP address, and heck - who it even belongs to. Target #2 gives aways 90% of the game at attacking it (we even leak some device specific information, so you know precisely where it's weak points are) Also - while IPv6 lacks NAT, it certainly has a very effective Prefix-translation mechanism which is the best of both worlds: Here is a real world target: FDC2:1045:3216:0001:0013:50FF:FE12:3456 You are going to have a tough time routing to it - but it can transparently access anything on the internet - either natively or through a Prefix-translation target should you wish to go that direction.
  • tptacek 9mo ago
    Deeply ironic that Cisco would teach this, because it's the opposite of what they said when they introduced NAT.
    • ghshephard 9mo ago
      Well - I can't say they have always said this - but at least for Circa 1998 CCNP onwards that's been their position. The instructors were very adamant - to the point that I'm recalling this 27+ years later.
      • tptacek 9mo ago
        This probably has more to do with network engineers (and CCNP instructors) not being security engineers (or even conversant with Cisco's security SBU).
        • zxcvasd 9mo ago
          [dead]
• minaguib 9mo ago
  Agreed with the main message. ... but An incoming message to an IPv4 NAT router will not be forwarded to a LAN device unless it matches a known flow (typically continuation of a conversation, typically initiated by the LAN device, which is expected), or the user set up a DMZ forward to a particular destination. There is actually no reasonable way for non-DMZ LAN devices to be exposed to the noise. For non-NAT IPv6, sure a firewall might be on by default, but it can be turned off - and therein lies the potential exposure to every LAN device to directed traffic. In other words, the risky zone for IPv4 NAT tends to be setting up a DMZ exposing 1 device, while the risky zone for IPv6 non-firewalled tends to be exposing all of the devices behind the router.
  • mrsssnake 9mo ago
    Disabled protection does not protect. This is UI/UX thing, not something in Internet-scale protocols. I can "curl https://somethingshady | bash -" but won't blame RFC1738.
• tptacek 9mo ago
  This has been gospel among snooty network engineers for decades, but NAT was initially introduced to the wider market as a security feature, and it is absolutely a material factor in securing networks. The network engineers are wrong about this. (IPv6 is still good for lots of other reasons, and NAT isn't good security; just material.)
  • zamadatix 9mo ago
    I would never debate NAT was marketed as security (as marketing is often detached from the reality of what's being sold) but I'd be interested why it's a material factor in securing networks independent of the stateful firewall mentioned, which most seem to actually rely on. The "snooty" people probably mean less what may have been marketed to consumers and more what the standards which introduced it say. E.g. https://www.rfc-editor.org/rfc/rfc1631 https://www.rfc-editor.org/rfc/rfc1631 notes address depletion and scaling as drivers in the opening but the only mentions of security are later on in how NAT actually makes security more difficult. I.e. it would seem whatever argument could be made about security from NAT, poor or not, intended to be security or not, would be immaterial in context of stateful session tracking with outbound originate allowed alone w/o doing the NAT on top anyways.
    • tptacek 9mo ago
      It was more than just "marketed" as security. It was brought to market as a security product and used that way for many years, before address depletion was a meaningful problem. People used NAT firewalls back in the eras of routable flat class-B desktop computer networks.
      • zamadatix 9mo ago
        The first commercial NAT box was the PIX in 1994, which featured stateful session firewalling (not just NAT) in agreement with the above 1994 RFC. It was still the era of referring to classful networks, but I'm able to source documents from the time which state the opposite of your claims. Here's an ad for it from Jan 1995 https://www.jma.com/The_History_of_the_PIX_Firewall/NTI_files/DataComm_Jan_1995.pdf https://www.jma.com/The_History_of_the_PIX_Firewall/NTI_file.... Note by the 3rd paragraph it's saying > corporate networkers are free to expand and reconfigure their TCP/IP networks without agonizing over the much publicized IP addressing crunch. It also spares them from having to upgrade all of their host and router software to run IP version 6 It does end with the aforementioned security marketing making it sound like NAT is what provides security on the PIX: > PIX also increases network security. Since there's no way for anyone on the Internet to know which machine on the corporate network is using a Class C address at any given time, it's impossible to establish a telnet or FTP session with any particular device. > And what about hosts that should be recognizable from the Internet, such as mail servers? > These either can be directly attached to the Internet and assigned a public address or can be attached through PIX. In the latter case, the translator is configured to map one of these external addresses to the device not just for the duration of the application session but on a permanent basis. Looking past the marketing line and reading the manual, the reality was the PIX was always acting as a full stateful firewall and did not just rely on NAT itself to provide the inbound filtering. See the "PIX Firewall Adaptive Security" section on page 2 of this 1996 manual I managed to dig up as reference https://mail.employees.org/univercd/Nov-1996/data/doc/netbu/hardware/pix/pix_v2.pdf https://mail.employees.org/univercd/Nov-1996/data/doc/netbu/.... Rule hits that missed a state match were even loggable (what a box for the time!) Whether people saw the marketing and assumed it was NAT that provided security is precisely the bad assumption the article talks to, but at no point in history was NAT prevalent without being paired with a normal stateful firewall to provide the security - since the intent of NAT was not to fill that role, even in the beginning, as sourced by 3 references now vs your personal claims.
• MobiusHorizons 9mo ago
  Fun fact I have actually had an sbc get hacked because I didn’t change the default password. I thought it would be reasonably safe for a few days because I knew the VLAN it was on had NAT and the associated firewall rules that deny inbound packets without outbound. But it turned out ipv6 was also enabled on that VLAN with no firewall. Left a bad taste in my mouth over a decade later even if it was a misconfigured firewall rather than an inherent issue with ipv6.
  • alanfranz 9mo ago
    …and they did really guess an ipv6 address? Full scans of the ipv6 address space looks infeasible. Or did the sbc reach out to the internet thus having its address exposed? Otherwise just the huge amount of addresses should make ipv6 “more secure” imho.
    • wiredpancake 9mo ago
      There was a report a few years back about people running NTP servers to harvest IPv6 addresses. Security via obscurity will only get you so far.
      • dunder_cat 9mo ago
        In theory, IPv6 Privacy Extensions (https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941) could mitigate this. In practice, I imagine when you bind to `[::]:port`, that also means that the randomized addresses would work for new inbound connections, too. Not sure how long they typically last, but you'd be fighting against the clock at least before a new randomized address. That being said, on a slightly less common note: it is quite possible to have each individual service running on a /128. E.g. on IPv6 k8s clusters, each pod can have a publicly addressable /128, so activities like NTP would require the container to have an NTP client in it to expose in that way. That'd mitigate a good chunk of information exposure -- that being said, I agree with the larger point about security via obscurity being insufficient.
        • 9mo ago
• patrakov 9mo ago
  IPv6 without NAT is not insecure; I can and do have a stateful firewall that denies unwanted inbound connections. But it does not matter if my auditors think otherwise and the whole Internet tells me that arguing with them will end my career.
  • direwolf20 9mo ago
    [dead]
• layman51 9mo ago
  Maybe it’s because I don’t consider myself a super technical person, but I find it so hard to parse the title of this blog post. When I first read it, I thought it was saying something like, “The protocol is not insecure, and the reason is that it lacks a NAT”. However, after reading the blog post, it seems like it is intending a different meaning. The meaning I think is, “the protocol is not insecure just because it lacks NAT”.
  • Gigachad 9mo ago
    The lack of NAT has no bearing on security. Despite an old mistaken belief.
    • iso1631 9mo ago
      Defence in depth is a valid security approach, and NAT provides another defence in depth If you have a vulnerable ipv4 machine on 192.168.0.24 port 2345 which is hidden behind a public IP of 1.2.3.4, and you set your firewall rule to allow any inbound traffic, with no nat rules then it will be exceedingly difficult for a remote attacker to reach that vulnerable port (they have to trick your router's connection table into routing it) If the same machine is on 2100:1234:5678:a::24 then that port is exposed. Now sure your firewall could block the traffic, and that's great. But having multiple layers of active configuration to allow the traffic through is more secure than having a single layer as it means you need to screw up twice. Worse than that with dual stack you may think you have set your firewall to block non-established connections at the ipv4 stage, but your device is sat there on an open ipv6 address you didn't even consider. Dual stack is certainly less secure than single stack as there are two opportunities to screw up.
      • Gigachad 9mo ago
        It’s the same layer. On router admin panels it’s literally the same UI for firewall rules and nat port forwarding. If you went in to your router admin and allowed all ports on v4 it would be exactly the same as allowing all on v6. The router will happily forward all connections to v4 devices the same.
• vachina 9mo ago
  Makes sense. But I’d argue NAT is still more secure because it physically breaks the connection between your internal host and the outside world. Without an existing routing table there’s no destination to route the packet to.
• xl-brain 9mo ago
  The tension here is the difference between theory and reality. In reality, IPv4 NAT is the only thing protecting most users in their homes. If you force IPv6 on this same population, you have to give them an equivalent posture by default. This is kind of like writing an argument that motorcycles are not unsafe because they lack 4 wheels. This is true, but if you put my grandmother on one and ask her to drive across town, she would not survive it.
  • mrsssnake 9mo ago
    France with >85% IPv6 adoption mostly made of grandmothers driving a motorcycles across the town manually delivering packets like in their youth.
    • xl-brain 9mo ago
      https://arxiv.org/abs/2509.04792 https://arxiv.org/abs/2509.04792? "Collectively, our results show that NAT has indeed acted as the de facto firewall of the Internet, and the v4-to-v6 transition of residential networks is opening up new devices to attack."
      • mrsssnake 9mo ago
        ISP hosting a virtual machine you remote desktop into from internal network as the only way to access the external internet can also work as a "de facto firewall". But the best de facto firewall is a proper firewall.
        • xl-brain 9mo ago
          I don't disagree with your comment that the best de facto firewall is a proper firewall. I think you are reacting against the idea that I am saying IPv6 is less secure than IPv4. I am not saying that. The point of my original post is that the author's take is controversial because people are skeptical about whether networks ARE being secured when NAPT is not present. They are right to be skeptical, in my opinion, because the rollout of IPv6 has been bungled over and over again. That is not a problem with IPv6, its a problem with the adoption of IPv6.
• mrsssnake 9mo ago
  Discussions about NAT very often forget that it works by messing up with the transport layer. The fuzz is about hiding IP address and exposing services, but the worst thing about NAT is that technically it should not count as a connection to "the Internet". It exploits TCP/UDP properties to fake endpoints into thinking they have a proper connection. To visualize this, imagine we somehow are out of available email addresses. Email providers have an idea, they would make one inbox for multiple people and have an SMTP proxy that will read the message content, look at "Dear ..." heading and proxy content as new message to "internal" network. All clients would see the same internal addresses from private space (picture 192.168.1.1), but upon sending the provider proxy replaces it adding "King regards, <shared address>". What if someone format the text differently? What if they use new format unknown to the proxy? It just won't work: https://en.wikipedia.org/wiki/Protocol_ossification https://en.wikipedia.org/wiki/Protocol_ossification Someone would then argue it is good as it hides your real address from spam and theft, but we can clearly see the massive disadvantages in this design.
• vbezhenar 9mo ago
  If IPv6 is behind firewall, apps can't use it for P2P connections, so the major point of IPv6 network becomes moot. And IPv4 NAT is actually possible to penetrate sometimes. So for some networks, IPv4 provides better P2P connectivity, than IPv6.
  • mrsssnake 9mo ago
    Not really, look at a great post on Tailscale blog how such P2P connection can be established: https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works With IPv6 you might have to use a hack to make firewall allow incoming packets (like sending a dummy UDP packet to the peer first). The firewall only read, allow or deny these packets. While NAT must mess with the message IP//TCP//UDP headers to work.
  • direwolf20 9mo ago
    [dead]
• mzajc 9mo ago
  I have yet to see a "NAT is not security" rebuttal that does not make either one or both of these points: - NAT is not a security feature because it wasn't designed as one (this post), and/or - NAT is not a security feature because it does not, without a firewall, protect against an attacker on the WAN subnet, or another difficult-to-exploit scenario. And yet making LAN devices unroutable from the Internet does on its own makes exploitation much more difficult. It's admittedly not a perfect measure, but it's one that IPv6 deployments with routable addresses for LAN devices lack. I would wager this does make a difference in the proliferation of botnets, especially given the lackluster standards of consumer network equipment security.
  • Dagger2 9mo ago
    You should read my other comments on this post. I've attempted, multiple times (but apparently without much success) to make the point that NAT is not a security feature because it does not, without a firewall, protect against an attacker. You don't need a qualifier like "on the WAN subnet". It just doesn't do anything to protect you from inbound connections at all.
    • ahefner 9mo ago
      I think you're not technically wrong, but you're defining NAT differently than the majority of people you're arguing with (those who assume NAT also implies a firewall blocking inbound connections), and the remaining minority (the "on the WAN subnet" crowd) are dismissing outright the idea as a reasonable attack vector that an attacker close enough to be able to send packets destined for non-internet routable addresses to your router. Is the latter something that was/is actively exploited?
      • bandrami 9mo ago
        There's an implicit trust of ISPs in the comments that I find concerning
• lq9AJ8yrfs 9mo ago
  NAT causes security issues too. Reflection attacks are much harder to stop if the endpoint and its network address are decoupled. You can provoke loops and tangles of many sorts, some at the same protocol level and others going up and down. My memory is fading but I vaguely recall a time when all of AOL shared something like a dozen egress addresses for certain traffic -- might have been proxies as opposed to NAT/"PAT" as we know it today. Iow, you couldn't block one without blocking 1/12 of AOL users. Stronger memories of a time when your IP address (some were nat, some were not, varied by ISP) depended on which modem bank you dialed into, which was strongly influenced by what phone number you dialed. Which diluted the identity value of a given IP for a computer or user.
  • paulddraper 9mo ago
    The RFC introducing NAT -- RFC 1631 -- says: > Unfortunately, NAT reduces the number of options for providing security [1] Somehow, everyone forgot that, and it morphed into a cargo-culting security practice, even going so far as to propagate 1990s network limitations into the cloud(!) [1] https://www.rfc-editor.org/rfc/rfc1631.html https://www.rfc-editor.org/rfc/rfc1631.html
    • 7bit 9mo ago
      Thanks for that quote. Finally something to slap into the faces of those who just refuse to acknowledge that NAT is not a security feature.
    • lq9AJ8yrfs 9mo ago
      Real world CSRF attacks into hxxp://192.168.0.1 home routers and polluting DNS and DHCP settings you could argue is caused or at least facilitated by NAT, or NAT misconceptions especially. Though IPv6 has a similar situation with well defined unicast and multicast addresses. True story, popular browsers won't let you load a webpage via various IPv6 local address literals for this reason. Hxxp://[ff02::] addresses won't work. / You can have your cake by "tying a knot" with yourself and port forwarding from 127.0.0.1 to the IPv6 literal. An ssh port forward will do this with aplomb. Then load hxxp://localhost:port and it works again. // Browser logic
• deleted 9mo ago
  [deleted]
• amarant 9mo ago
  It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT
  • stackghost 9mo ago
    I think the confusion stems from the fact that my mom's laptop with its 192.168.0.43/24 v4 address is not routable except via NAT, and people believe (rightly or wrongly) that that confers a degree of security.
    • onionisafruit 9mo ago
      rightly
    • reincarnate0x14 9mo ago
      UPNP and a dozen other NAT defeating tactics exist and have since the early 2000s. NAT translates addresses. Thinking a non-routable range is safe because it's behind NAT is at this point grossly ignorant of how modern network equipment works. It's kind of like port-knocking; yes it makes the attack slightly harder, but doesn't prevent it. e.g. symmetric NAT exists and often doesn't come with a stateful firewall. Just because the linux box with iptables is protecting your network uses NAT doesn't mean NAT is doing the heavy lifting here. I can see the OMG MY PRIVACY crew is out in force here apparently misunderstanding that NAT does not do that either. I mean, we can explain things to you, but we can't understand it for you.
      • stackghost 9mo ago
        >UPNP and a dozen other NAT defeating tactics exist and have since the early 2000s. I know that, and you know that, but squillions of people think that turning the UPnP setting off (if they even know what that is) is sufficient, which is why the myth persists.
• nialv7 9mo ago
  nitpick on the title, the way it's worded makes it sound like "IPv6 is not insecure because it lacks a NAT, (but it's insecure because of other reasons)". would be better if it was "Lacking a NAT doesn't make IPv6 insecure".
• cyberax 9mo ago
  I wrote that comment, and you can write to yourself how many times you want that NAT is not a firewall. The truth of the matter is that NAT absolutely _is_ a firewall in _practice_. Not in theory "because it doesn't drop packets" or "because it was not meant to be a security feature". But in the actual real-world practice. It effectively protects most networks from most attackers without ANY additional configuration, making it inherently foolproof. Here, I put a private key for a wallet with 0.01 bitcoin at this address: http://192.168.80.26/ http://192.168.80.26/ Go on and take it. It's not protected by anything else I disabled everything but NAT. Heck, here's my real IPv4 even: 172.56.107.111 Is this a _good_ reason to not do IPv6? No. But it absolutely _is_ a reason and needs to be acknowledged.
  • iso1631 9mo ago
    If you don't have RPF enabled on your router in theory your upstream peer can send traffic to 192.168.80.26 and it would pass through. Reply traffic may or may not be natted depending on how it's entered in the connection tracking table. There may be situations where your router can be tricked too, I can't think of one off the top of my head which wouldn't also apply to a stateful firewall sitting on a routed network segment with no nat, and it would typically be a vulnerability to patch But your principal is right -- it's far harder to exploit than just connecting to an ip of say 2001:172:56:107:111::192.168.80.25 on port 80
    • dist-epoch 9mo ago
      For 99%+ of residential users, the upstream peer is the router owner/operator, so they can just direct the router to hack you if they wished. So this NAT "vulnerability" is not useful in practice, since it can only be used by your upstream which already "owns" you.
    • cyberax 9mo ago
      Yes, the upstream can hack my private wallet. But it's a CGNAT device somewhere in the TMobile network, and hacking it is not at all trivial. And it's true for most NAT users. Even with the cheapest possible devices. Of course, in practice most NAT devices _are_ firewalls because they do block incoming packets that are not a part of an established connection. After all, it adds only an insignificant overhead because a NAT device has to track connections anyway. With IPv6 this is not the case. A router with misconfigured connection tracking will still work. And I actually have seen this in practice on a device that had a missing IPv6 conntrack kernel module.
• notepad0x90 9mo ago
  I disagree with this strongly. The intended use case of NAT or the existence of inbound connections being blocked by routers is irrelevant. For NAT, of course it isn't meant for security, but it has a side-effect of creating a network boundary, and that has positive security implications. If your router doesn't have a firewall blocking any connections, NAT still has security implications as it is deployed typically on consumer networks, which is a one-way port-address-translation for outbound traffic. The important bit here is not NAT or firewalls, but layer 3 network segments!!! An RFC1918 private addrerss space is not internet routable. Furthermore, routers shouldn't "default route" traffic from arbitrary connected networks by default. But "should" aside, the typical default consumer router behavior is that they don't NAT translate inbound traffic, they can't! If a random internet IP wanted to connect to port 80 on a device at 192.168.1.200 in your home network, it doesn't know how to tell your router what IP to translate it's request to the router's public IP to. That is the essential positive security implication. In commercial grade routers, the same applies except even if the external IP knew to direct the router to the right internal IP, or if the route knew to direct the traffic to the right external IP for outbound connections, unless you configure a default route, or a more explicit route, it won't forward such traffic. With IPv6, end devices in your network get a globally routed address, someone can try to connect to that same internal device as my earlier example and succeed with the same exact default behavior in place. IPv6 is thus, by relative metrics, insecure by default. It does not mean it cannot be secured, but it is less secure than IPv4 in typical deployments where extra care isn't taken to secure it properly. If your answer to this is "well that's just because people who deploy networks are dumb" then save your self the effort or arguing that, it is irrelevant. That is how networks are deployed in the real world, period. People make mistakes in the real world. People don't know best practices in the real world. So out of the box, things need to consider real world hazards, and IPv6 does not do that. You can support the adaption of IPv6 nonetheless and I would have no disagreement there.
  • nemothekid 9mo ago
    The problem is, as I understand it, is this hypothetical network where there is a NAT but no firewall just does not exist. >In commercial grade routers, the same applies except even if the external IP knew to direct the router to the right internal IP, or if the route knew to direct the traffic to the right external IP for outbound connections, unless you configure a default route, or a more explicit route, it won't forward such traffic. This is typically handled by the firewall, not the NAT. You can easily come up with scenarios that without the firewall, the NAT could be trivially defeated, e.g. by port scanning.
• freetime2 9mo ago
  I think two things can be true here: the article's assertion that "IPv6 is not insecure because it lacks NAT" is correct, and other peoples' assertions that NAT provides an extra layer of security are also correct. A correctly configured IPv6 firewall provides equivalent protection to a correctly configured IPv4 firewall and NAT. Either way, connections that do not originate from within the local network are going to be rejected. But if the firewall is misconfigured, then NAT will make it more difficult for an attacker on the internet to discover and exploit vulnerabilities on the local network. "Defense in depth" is a valid security principle. But NAT also creates real-world problems that IPv6 solves. As with all things, there are tradeoffs, and whether or not you should enable IPv6 on your local network depends on your use case.
  • iso1631 9mo ago
    Ipv6 also creates real world problems that NAT solves -- multi upstream WAN with path selection for example Dual stack introduces security problems (you now have two things to secure). There are still devices which will fail to run on an ipv6 network -- even with a 64 gateway (software which communicates to a specific IP address for example - e.g. a device which "checks internet connectivity" by pinging 1.1.1.1 and 8.8.8.8, yes it's terrible, and yes it happens)
• BatteryMountain 9mo ago
  I basically disable all ipv6 on my routers & firewalls completely. Waiting for the day we can disable ipv4 completely instead and use only ipv6 without NAT. But then each device will need its own firewall. NAT basically forces you to use some kind of firewall, which applies to all devices behind the NAT. But if we go all-in on IPv6, the firewall-by-default becomes much harder to implement in practice. Then we will need some kind of distributed/federated firewall config to constantly keep devices usable but safe, but then that will introduce a new set attack vectors. So we are kinda screwed for now. We need that new internet, maybe one where you unify static ipv6, dhcp6, dns, firewalls, nat and a few other friends into a single thing. Or perhaps we can use ipv6 only to get a static ip address for each home/building, which then has a small vlan/vpn to group all your devices together using ipv4 internally for ease of use.. which is close to what we currently have with cgnat+ipv4+wireguard+vlans. All round we have a big mess but it works well, if you know what you are doing that is. This is all to say we can even keep net-neutrality for a while longer, we are okay for now but the american/uk/china/india govs plus entities like cloudflare will actually destroy net-neutrality in the long run. Much like email delivery has already been ruined & captured. Sorry for the rant.
  • vaylian 9mo ago
    The article says: > Modern routers ship with firewall policies that deny inbound traffic by default, even when a NAT is not being used. So no, not every device needs its own firewall. You can have a single firewall at the entrance of your network.
    • fulafel 9mo ago
      Though just like with IPv4 most of the time you shouldn't build on assumed-secure internal networks.
    • BatteryMountain 9mo ago
      Not always the case and differs by router software.
      • 9mo ago
• ifh-hn 9mo ago
  I find the discussion about whether or not NAT is a security feature or not interesting. To my mind NAT was intended to make ipv4 last longer in a clever way as address space dried up. A happy accident of this solution is a basic security feature. Ipv6 doesn't (currently, will it ever?) have the same address space problem so each device anywhere could be globally routable. But we know that's not really a good thing security-wise. But why couldn't we implement NAT for it as a security mechanism, instead of an address space solution? Admittedly I'm not expert so I might be talking shit.
  • globular-toast 9mo ago
    Why would you do that when a regular default-deny firewall is and has always been the security feature you need, without the complications and problems of NAT?
    • ifh-hn 9mo ago
      Like I said I'm not expert, and was likely talking shit. I was just speculating based on the discussion in this thread. I think the complications and problems of NAT seem to add a default layer of security to the whole thing. I know next to nothing about firewalls though, which might be the point here, but would a default deny present any problems for me that NAT would allow? That is is there a situation where as a layman I might run into problems receiving data for a valid process that wouldn't happen if it was just NAT?
      • globular-toast 9mo ago
        A firewall is the security feature you want. With a default-deny rule, which most will come configured out of the box with, it does exactly what you expect: block all unsolicited incoming traffic. Most people are probably actually running a firewall with NAT anyway, they just don't know it because an appliance with default-deny is pretty much install and forget for most people. So, no, it doesn't cause any additional problems. The only difference with IPv6 is you don't need to NAT any more, but you keep the firewall. It's important to remember NAT is part of the IP routing layer. In its regular form, a router just forwards packets to where they should be going. So it's plugged in to one or more networks, receives packets on one interface and forwards them, unmolested (well, mostly), to another interface. It's almost completely analogous to letters going through the postal system. The postal service just forwards letters around by looking at the address. It doesn't modify them in any way. NAT is a bastardisation and is like your postie scribbles out the "return to sender" address and replaces it with his own. If you were to reply to that address, your postie would remember he did that, and replace the address you wrote with the original address he scribbled out earlier. It's not how IP routing is supposed to work at all and, in fact, a device doing NAT cannot strictly be considered a router at all. Something you can add to any device is a packet filter. A router must not filter packets as it then wouldn't be considered a router (similar to molesting the packets with NAT). But you can insert a packet filter before things get to the router. If you glue those two things together and bundle it in one device then, voila, you have a firewall. A stateful firewall is conceptually like a packet filter and router glued together and working closely together. But you can just think of it like telling your postie "I only want to receive letters from mum" and he just burns all the rest before they get to you front door. (In reality you also want to allow correspondence so it's more like "only allow letters that are replying to letters I sent, which you'll know because you're my postie, or if mum sends a letter first, allow that too"). Writing this up makes me think... why don't we just teach this stuff using the postal system as an analogy? It's an almost perfect analogy and surely even today anyone understands this concept.
• iso1631 9mo ago
  NAT is a trivial feature on top of a connection tracking firewall. It also provides a large number of benefits - the ability to route traffic via different routes with PBR, without having BGP upstream, to keep routing decisions in the router rather than on each device, to not have to renumber internal IP addessing when the ISP changes, to have consistent view of what happens at a network level
• fdr 9mo ago
  For those of you with this handy technology, the mobile phone, in the United States: you have an IPv6 address without NAT. Some of you even exist on a network using 464XLAT to tunnel IPv4 in IPV6, because it's a pure IPV6 network (T-Mobile). These mobile phone providers do not let the gazillion consumer smartphones act as servers for obvious reasons. This is all to underscore the author's point: NAT may necessitate stateful tracking, but firewalls without translation has been deployed at massive scale for one of the most numerous types of device in existence.
  • dannyobrien 9mo ago
    What would be the obvious reasons? (I'm not being flippant here -- I'm genuinely interested in what arguments people have to not allow servers on that network)
    • fc417fc802 9mo ago
      High concentration of technically inept users with hardware that no longer receives security updates and has plenty of well known easily exploitable vulnerabilities. Which naturally is used to run banking apps and travels with users close to 24/7 while tracking their location. From a business perspective you'd want to charge extra. Just because you can, but also because you want to discourage excess bandwidth use. The internet APs the carriers sell get deprioritized relative to phones when necessary and the fine print generally forbids hosting any services (in noticeably stronger language than the wired ISPs I've had).
      • vladvasiliu 9mo ago
        > From a business perspective you'd want to charge extra. Just because you can, but also because you want to discourage excess bandwidth use Isn't that already the case with limited plans? For example, mine has 40 GBs and I'm pretty sure it counts both upload and download, because I generally consume very little, except for one week when I was on holiday with no other internet access and wanted to upload my pictures to my home server and didn't otherwise use the phone more than usual.
    • 9mo ago
• globular-toast 9mo ago
  I actually wanted to write this article myself but every time I started writing it up I thought "fuck, this is too obvious, I'm being condescending". But then I read these comments and I'm sad again.
• compounding_it 9mo ago
  NAT is just one slice of IPv4. Granted your private IP is not routable (with CGNAT now your gateway is also no longer routable), but think of other features of IPv6 that are congruent: SLAAC basically means your routable IPv6 address changes so many times in a day (and there are multiple of those at any given instant) that even if the attackers know your prefix, its going to be very difficult to do anything meaningful. the address space is too big. And we are assuming here that there is no firewall. Note : macOS firewall on a new install is disabled iirc.
  • direwolf20 9mo ago
    [dead]
• nottorp 9mo ago
  No one's complaining that IPV6 is insecure. It may as well be very secure, but no one bothers to understand it if they're not paid to do that. Of course you can have default drop in your IPV6 firewall, but it's far easier to keep in your head that internal NATed IPs aren't accessible and "real" IPs are.
  • jeroenhd 9mo ago
    I've seen plenty of discussions here on HN where people have made that claim. Even more elsewhere on the discussion side of other news websites by sysadmins that disable IPv6 because one of their industrial routers didn't come with a default deny rule that one time which made them think that's normal. The people who are supposed to know IPv6 never seemed to have learned it and many of them don't seem to be open to the idea of learning something new. Of course half the world runs on IPv6 now so they'll have to get with the times eventually, but the prevalence of statements like these is quite depressing.
    • nottorp 9mo ago
      > many of them don't seem to be open to the idea of learning something new To the idea of learning something designed by commitee, over complex and stinking of enterprise and that you simply can't deploy "by hand". One of the advantages of NAT by the way is that your "outside" configuration and "inside" configurations are completely independent with the exception of the snat rule.
      • jeroenhd 9mo ago
        The "inside" is your /56 or /48. You can add more local-only "inside"s if you'd like, which is useful for terrible ISPs with rotating network prefixes. The "outside" is everything on the internet. If you can make your way through the absolute slog that is ARP+DHCP, you can get through NDP+SLAAC. Or even NDP+DHCPv6 if you're a control freak. > One of the advantages of NAT by the way is that your "outside" configuration and "inside" configurations are completely independent with the exception of the snat rule. If you want NAT, then set up NAT. Your fdb6:fc49:f5ae::/48 ULA is your 192.168.x.y address. Set up DHCPv6 if you'd like to pretend you control your address space. You could even just ignore the spec and use fdfd::/48 as your ULA so you can memorize addresses (fdfd::1, fdfd::2, that's even shorter than 192.168.1.2!). Use fe80::1 (a perfectly valid address) on your router as a standard gateway and have it do NAT to the outside world. Even though it's heavily discouraged (because NAT is a massive hack after all), you can do NAT on IPv6 without any special tooling.
• almosthere 9mo ago
  So with IPv4 with NAT you definitely have this security. According to this article with IPv6 you MIGHT have that security -we don't know. That's not secure.
  • mrsssnake 9mo ago
    Also with IPv6 with NAT you definitely have this security, but with IPv4 without NAT you MIGHT have that security... Disabling security features makes them disabled. Also security of NAT is a side effect because of that the devices behind it are not connected to the internet just tricks them into thinking they are.
• deknos 9mo ago
  Of course it's not insecure because of NAT. NAT (in all its forms) is just a very convenient technology for many people and niche situations. And adoption of IPv6 will be hindered as long as NAT is not a first class citizen. And of course, mostly NAT should not be used as "firewall replacement". But what many firewall proponents forget here: NON-IT People at home cannot run and manage a firewall (and proxies). For them, NAT is a convenient and mostly okayish replacements. Another niche would be IP Packet Handling of VMs.
  • Dagger2 9mo ago
    We haven't forgotten that, but we're also aware that non-IT people can't run NAT either. They can plug in a box that already has NAT configured though, and if they can manage that then they can also plug in a box that already has a firewall configured. VMs work fine without NAT too -- DHCPv6-PD lets the VM software automatically request a routed prefix.
  • Thiez 9mo ago
    Surely for the people who cannot run and manage a firewall the default 'deny incoming' rule that basically every single consumer router ships with works just as well to protect from incoming traffic as NAT? I notice many comments are assuming a sanely preconfigured NAT on routers, but are also assuming either no firewall or one without any preconfigured rules. It seems like a strawman to me.
• self_awareness 9mo ago
  I'm on ipv6 since 2 years and I am very happy. I profit from NAT-less network, can connect to my home device from a VPS without thinking it's sitting behind 2 routers. No port forwarding needed, just connect and it works. Well, I guess I still need to enable connection to this device on a firewall, but that's obvious. We really should move on from IPv4. By the way, IPv6 also supports NAT if that's what you want. But using NAT in IPv6 is like saying "i want to have my own personal universe so I can put 2 Raspberry PIs in it".
• p0w3n3d 9mo ago
  I'd argue not about security, but transparency - when having your mac address partially included in the IPv6, you would basically allow browsers and other systems identify you without additional steps. Early IPv6 commonly used EUI-64 addressing, which did embed your MAC address into the IPv6 interface ID
  • figmert 9mo ago
    Sure, but your MAC address is easily spoofed. In fact, all major operating systems do it nowadays for public WiFi systems and you have to explicitly opt-out of randomising your MAC Address when connecting.
    • p0w3n3d 9mo ago
      Still it's really convenient to be hidden behind NAT not being unique in the constantly-growing list of gathered data
  • direwolf20 9mo ago
    [dead]
• xurukefi 9mo ago
  I hate NAT with a passion. It's a terrible technology, whose disruptive nature has probably prevented any novelty on the transport layer. But this article is oversimplifying things. It is well known that NAT is not meant for security and that NAT is not a firewall. But one cannot deny that it implicitly brings some "default" security to the table. With NAT it's basically impossible to screw you over because there is no meaningful practical way to allow inbound connections without the client explicitly defining them (port forwarding). With IPv6, you could have a lazy vendor that does not do any firewalling or a has a default allow policy or maybe buggy firewall. With NAT that is not possible. There is no lazy/buggy NAT implementation that allows inbound connections for your entire network, because it is technically not possible. When a NATting device receives a packet with a destination port that has not previously been opened by a client, it does not decide to drop this packet because of a decision by the vendor. It drops the packet because there is simply no other option due to the nature of NAT. That is what people mean when they talk about the inherent "security" of NAT. Again, NAT is terrible. We need to finally get rid globally of IPv4 and all the NATting that comes with it. But let's keep it to the facts.
  • bandrami 9mo ago
    > there is no meaningful practical way to allow inbound connections without the client explicitly defining them This... just isn't true though. Your router knows it has one network on one interface and one network on another interface and if it receives a packet on the one interface destined for the network on the other interface will happily route it unless something (a firewall) tells it not to. All the protection comes from trusting your ISP and its peers to not route RFC1918-private networks
• fredsted 9mo ago
  It's wild because saying that NAT is required kind of admits your machines are vulnerable on the LAN! You should have good firewall rules no matter what.
• Havoc 9mo ago
  >NAT isn’t actually a security feature Perhaps not in the high brow network security world, but in practice it really is used that way. Who here has never launched an unauthenticated server on their LAN?
  • ryangibb 9mo ago
    What does NAT do for security that a firewall doesn't?
    • BrandoElFollito 9mo ago
      If you do not have any communication though this firewall - nothing. But then why having a connection in the first place?
  • Latty 9mo ago
    That's what the firewall on your router is for. NAT might also stop someone connecting, but it's not a guarantee. You can get given a public address and be exposed, you can find out your server actually does UPNP automatically and so is exposed, etc... a firewall is more explicit and a better defence.
  • kawsper 9mo ago
    When I was about 12 I was working on a PHP3 application, I had some issues with a MySQL query, and I pasted my code to pastebin (or whatever we used back then) and shared the link on IRC, the code included my database credentials. Back then our ISP gave every computer a public IP. The next thing that happened was that someone changed my MySQL password, and me being 12, I didn’t know how to change it back. They made me beg for the password, to much amusement to the whole channel, and then they helped me secure it and taught me how to reset the password. NAT would have saved me, but I wouldn’t have received a free, though a bit embarrassing, security lesson.
  • yesco 9mo ago
    That's a strange example. An unauthenticated server on a LAN wouldn't be exposed to the Internet any more than a network using NAT would be. You would need to explicitly configure your routers firewall to expose a local node, the same way you would need to explicitly configure port forwarding with a NAT based network. I've see some argue that a hypothetically buggy router would somehow be less likely to fail if NAT was used but really, that could be equally said about bad port formatting defaults, which have in fact happened. Complexity is what increases the likelihood of bugs at the end of the day. NAT is just an addressing hack, a weirdly complex way of indirectly routing to local addresses. It only influences what is written on the envelope, not how that envelope is processed at the post office.
• skywhopper 9mo ago
  Networking folks love to write this article. “NAT isn’t a security layer.” I’ve been hearing it for 20 years. But while that’s not its purpose and while there are other layers that can provide the same features, it’s still a very useful piece of a larger puzzle of defining borders in a network architecture. Sometimes it helps if those borders are obvious to the eye, via the use of a private address zone, or if opening a port on the server can never “just work”, regardless of your external firewall rules. All sorts of trivial mistakes can be avoided with This One Weird Trick. So sure, it’s not technically required, and doesn’t solve every problem. But the constant harping about “NAT isn’t security” is sorta pointless.
• pregnenolone 9mo ago
  As someone with limited networking knowledge, I’m not really getting smarter here. Some say it adds security; others disagree. Let me ask this: does IPv6 benefit me in any way if I have multiple devices at home behind a router and I'm not running any servers or similar services?
  • deng 9mo ago
    No
  • reincarnate0x14 9mo ago
    No idea what you're doing on a daily basis, but let's grab a not-exactly random example. You and your friends are at your house trying to play an online game of King's Court (it's super checkers!) with some friends in Denmark. For whatever reason the developers decided all clients will use port 12345 to communicate. In ipv4 with NAT, local connections will be possible but only the first one to try to communicate out will ever possibly succeed. You and your friend are thwarted and have to find some NAT-defeating means or just give up on doing 10-jump moves to ruin each other's evenings and have an internet drinking game. With IPv6, all of it works fine. Most casual users have lived with NAT so long they assume its limitations are natural. But they are not. You can achieve the same result with a firewall or ACLs or whatever on ipv6, but that's a choice and not a limitation.
  • Macha 9mo ago
    Do you play video games with P2P networking? Then your choices are to pick one of the following: - the hosting player enables upnp - use ipv6 - the hosting player manually sets up port forwarding (consumer routers often talk about a DMZ option which takes an IP address - really this is just forwarding all ports not matched by any other rule)
    • smw 9mo ago
      STUN
  • arka2147483647 9mo ago
    Smart home and lighting standard Matter over Thread requires it. Discovered this after i bought some Ikea smart lights. Though you don't need a public IP6, a local static IP6 with SLAAC is enough.
• TacticalCoder 9mo ago
  It s true. That s not the reason it is insecure. The reason it is insecure is people who infiltrated the committee made sure to make data exfiltration possible through mandatory ICMP for everything. Good luck setting up proper firewallimg rules for IPv6 while both respecting its specs and preventing hard-to-detect exfil through ICMPv6. It's a rube-goldberg of a protocol and it s hard to believe it s all incompetence and there ain't t some malice involved. NAT for IPv4 was an accidental godsend, especially useful in an era where you d hack your neighbors' computers when they where on the same subnet as yours. Don t tell me it didn't t happen for I was doing that on dial-up back in the days. Thankfully the point is mostly moot because people are still free to use IPv4 at home/companies while having their router using IPv6. IPv4 shall thankfully outlive me. And I don't t care if it means more work for people working in the "punch the monkey" ads industry.
• 1dom 9mo ago
  John, your post opens saying it's addressing the point: “the NAT-by-default of IPv4 effectively means that I get the benefit of a default-deny security strategy.” Your title is "IPv6 is not insecure because it lacks NAT" I'm sure anyone who understands how NAT offers the equivalent of a default block rule also understands that the absence of NAT alone doesn't make IPv6 insecure. This makes the title feel a little clickbaity-strawmanny, sorry. Your response seems to be: "most firewalls have a default block rule too meaning they're no worse than IPv4 w/ NAT." There's more security to be had in an intrinsic architectural feature (like IPv4 NAT being necessary due to limited IPv4 space meaning most IPv4 devices behind CANNOT be addressed from the internet without NAT) then there are in policy features (most firewalls SHOULD have the default deny IPv6 rule that will stop their address being reached from the internet.) That doesn't make IPv6 insecure because no NAT. But it does mean - IMO - that the intrinsic block that comes with IPv4 NAT is a better security measure for making devices inaccessible than relying on default firewall rules. What point are you trying to make here, and is it actually more useful than the point you say you're addressing?
  • quotemstr 9mo ago
    > There's more security to be had in an intrinsic architectural feature No, there is not. Even ignoring the question of whether the concept of an ordinal ranking in amount of security even makes sense, this claim doesn't make sense. If the invariant is that incoming connections are blocked by default, an IPv4 NAT and an IPv6 default deny rule are equivalent in security: both uphold the invariant. If the claim is that a misconfiguration of the gateway can make the system vulnerable, again, the two kinds of firewall configuration are equivalent: you can configure an IPv6 firewall to pass traffic and you can configure a DMZ host or port forwarding in the NAT case. There's no basis for claiming the two schemes differ in the level of security provided.
    • user3939382 9mo ago
      You talked right past the key point which is valid: > There's more security to be had in an intrinsic architectural feature (like IPv4 NAT being necessary due to limited IPv4 space meaning most IPv4 devices behind CANNOT be addressed from the internet without NAT) then there are in policy features (most firewalls SHOULD have the default deny IPv6 rule that will stop their address being reached from the internet.) One security property is architectural, one isn’t. They’re not the same.
• deng 9mo ago
  Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original definitions of a term. NAT was originally meant to just do address translation, but it has evolved. * Of course, ipv6 is not less secure because it doesn't have NAT, as the same filtering behavior can be replicated with a firewall. That may even have advantages over NAT.
  • zajio1am 9mo ago
    RFC 4787 does not really describe how real world implementations behave. As almost all SOHO routers are Linux-based, i prefer to discuss Linux netfilter-based NAT behavior than some hypothetical RFC 4787 NAT. There are clear differences. For example, RFC 4787 says: > REQ-1: A NAT MUST have an "Endpoint-Independent Mapping" behavior While Linux netfilter behavior is "Address and Port-Dependent Mapping". As Linux netfilter implements both NAT and firewall behavior, it is relevant for the discussion which parts of overall netfilter behavior falls into 'NAT part' and which into 'firewall part'. There is clear distinction - DNAT/SNAT rules in nat table represent NAT behavior, while REJECT/DROP rules in filter table represent firewall behavior. As Linux-based SOHO routers are usually configured with both NAT and firewall netfilter rules to implement both NAT and firewall behavior, one cannot answer question 'Does NAT filter traffic?' based on external behavior of such SOHO routers, but has to analyze which part of the network stack is responsible for such behavior, or how the same network stack configured with just NAT rules and no firewall rules would behave. And here the answer is no, it would pass traffic (that do not match existing connections) unmodified.
    • deng 9mo ago
      The problem is: what is an implementation detail, and what is NAT as a concept? This line is very blurry. The RFC does not really distinguish this and also doesn't want to. As it says, it tries to document behavior and explicitly uses the term "NAT filtering". When we say "This box here does NAT", then we implicitly assume this behavior. You might argue that implicit is not good, and I would agree (this is the advantage of ipv6 with firewall: filtering is explicit rather than implicit). However, if someone tells me "Well actually, NAT does not do filtering, the firewall does", then to me this is similar to arguing with staff in a supermarket that the tomato belongs in the berries section. I also want to make clear that I fully agree with the article's main point: NAT's primary purpose was and still is address conservation, and that ipv6 is no less secure than ipv4. I do disagree though with the notion that "NAT does not do filtering" or that "NAT does not provide any security".
• everdrive 9mo ago
  Right, IPv6 is annoying because it lacks NAT. There's a big difference between something being a huge pain to deal with (IPv6) and being insecure.
  • rnhmjoj 9mo ago
    Ok, I'll bite: why do you say that IPv6 lacking NAT (which is not true by the way) would be annoying? We can finally get rid of an ugly workaround from 30 years ago that broke one core principle of the Internet (end-to-end connectivity) and a ton of protocols that required even uglier hacks (FTP and SIP ALGs, TURN/STUN, etc.) to barely work. Why would this be annoying?
    • InfamousRece 9mo ago
      At my previous place IPv6 was useable (I was getting /60 prefix rather than /64 I’m getting now) but the prefix was changing often - several times per day. This was annoying because every prefix change all addresses of my devices changed too. So in practice I always used private IPv4 addresses to connect to them. A NAT would solve this issue.
      • rnhmjoj 9mo ago
        Well, delegated IPv6 prefixes are supposed[1] to be static or somewhat persistent, but some ISPs do this, yes. This is most likely a practice carried over from IPv4 where there is a small pool of addresses. Fortunately in my experience it's not too common: most ISPs that deployed IPv6 did it the right way. Anyway, to get persistent addresses you can set up a ULA prefix (the equivalent of RFC 1918 addresses) and a simple prefix translation[3]. This is a form of NAT, but unlike the usual IPv4 NAT (actually NAPT) it doesn't deal with ports, so it's slightly less annoying problematic. There also are a few more techniques, like using mDNS and writing firewall rules that match the suffix of the client addresses, but not many CPE allows for this. [1]: https://www.ripe.net/publications/docs/ripe-690/#53-why-persistent-prefix-assignments-are-recommended https://www.ripe.net/publications/docs/ripe-690/#53-why-pers... [2]: https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address [3]: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6
• mikkupikku 9mo ago
  With IPv4, if NAT isn't working right then I simply cannot get online and I need to fix it. Fail safe. With IPv6, when my computers being globally addressable is the norm, if my firewall is misconfigured my computers will probably still be online. Fail unsafe. Arguing this is pointless anyway because it's not even my decision, it's my ISP. I am however quite happy with my ISP's choices in this regard.
• ZiiS 9mo ago
  The is a huge difference between: I assume my crappy router's firewall works and is configured safe by default. And I assume my crappy router's doesn't forward ports by default.
• sylware 9mo ago
  IPv4 is not secure because it requires a NAT in order to be? Big centralized online services does not want IPv6 because it "unlocks" internet as intended, full p2p at scale. They won't let that happen easily. And please stop with that 'computers security', we all know here it does not exist (NAT or not), it is a fantasy. Saying otherwise is engaging in bad faith.
  • mrsssnake 9mo ago
    > And please stop with that 'computers security', we all know here it does not exist (NAT or not), it is a fantasy. Saying otherwise is engaging in bad faith. So you are willing to message me your credentials then?
    • sylware 9mo ago
      Bad faith using a deviation on "social engineering", unrelated here.
• redsnake 9mo ago
  Security is a state of mind. So, whatever makes you feel secure, it's your security tool. NAT can be used for security, like VLANs gets a lot used for LAN security. And BTW, NAT can alter destination of IPv4 packet, but also the source. Which is not necessarily only masquerading, and it's seen a lot as embedded security, especially for home Internet. A firewall does not provide security by itself, it has to be configured in the specific way for the situation. I've seen a lot of firewalls with 100s of rules, but the first one was accept all forward, forgotten there by an admin after a test several days/months/years ago. We are trying too much to put things in unique and well defined boxex. Universe does'n work like this. Security is just a state of mind.
• jonathanlydall 9mo ago
  This article may have been prompted by my (or similar) response to John's comment on [1] yesterday. He stated: > NAT is not a firewall: all it does is rewrite packets, it does not drop them. I noted (without quoting at the time) that the article actually mentions this aspect of NAT, here is a quote from yesterday's article: > Time and time again we are lectured that NATs are not a good security device, but in practice NATs offer a reasonable front-line defence against network side malware scanning and injection, so there may be a larger story behind the use of NATs and device-based networks than just a simple conservative preference to continue to use an IPv4 protocol stack. Since I didn't state it before, I don't see any need to add NAT to IPv6 and certainly not for security reasons when a firewall is the correct way to secure networks. I don't feel that IPv6 is inherently more or less secure than IPv4, regardless of NAT. I also agree that even for IPv4, firewalls should be used and that NAT should not be relied on as a security measure for any remotely high stakes situation. The reason I made my comment though is because I seem to share the same opinion as yesterday's article's author that people stating "NATs are not a good security device" are missing the point that in regard to IPv4, NAT may not be a "fully proper" security measure, but in practice it is "plenty good enough" for the vast majority of internet users. People proclaiming how NAT is not a security measure seem to me to be ignoring our reality where 100s of millions of consumer routers, incidentally but nevertheless effectively, use it as one. Even without a firewall to drop packets on these devices doing NAT, they effectively block a whole class of automated malicious activity. Is it safe to have unprotected network devices shielded only by NAT without a firewall? No, not really. Should you use a proper firewall even if you have NAT? Yes, absolutely, but a lot of people don't and are nevertheless adequately protected considering they probably have no "open" devices on their network and have no particular reason to be targeted by a truly determined malicious actor. [1] https://news.ycombinator.com/item?id=46691835 https://news.ycombinator.com/item?id=46691835
• jokoon 9mo ago
  I don't understand, after all this time, why ipv4 still dominates
• torginus 9mo ago
  I think there's a philosophical difference between IPv4 and IPv6. IPv4 is from the era of local computer networks, which feature clients and servers. Clients talk to servers, but servers are not supposed to care or even know about clients unless clients decide to reach out to them. Client-to-Client communication is generally discouraged. The IP address is just a technicality and outside of local networks, just a part of the routing strategy. IPv6 on the other hand is like an URL - an address you can use to find any device from anywhere on the planet. It makes no distinction between client and server. Which is why its pushed in places like IoT and smartphones - a voip call has no conceptual client and server. One could make ones smartphones Ipv6 address openly available, and anyone could initiate a voip call to their phones. Would this be wise? I'd argue there's no scenario under which this doesn't cause an unacceptable level of risk, as even if the software is perfect, they'd be still vulnerable to DDOS attacks. This means that NAT-equivalent firewall rules are necessary, which makes the whole discussion kind of moot, but it's not a good portent for Ipv6 that it makes previously unfeasible kinds of attacks potentially practical. NAT also allows for other neat tricks, like IP level load balancing. I'd say one huge and unambiguous advantage of IPv6 is that it makes UDP trivial.
  • tbrownaw 9mo ago
    > IPv4 is from the era of local computer networks, which feature clients and servers. Clients talk to servers, but servers are not supposed to care or even know about clients unless clients decide to reach out to them. Client-to-Client communication is generally discouraged. No, it was meant to be a global address space where anything could talk to anything. That became unworkable due to scale and the limit inherent in using only 32 bits for the address space. Some older protocols (ftp) don't play nice with NAT and need special handling, because address multiplexing was never intended to be a thing.
  • throw0101a 9mo ago
    > IPv4 is from the era of local computer networks, which feature clients and servers. IPv4 on the ARPANET 'went live' in January 1983,[1] but the concept of a firewall didn't really happen until about a decade later (with some protocols having to be altered[2]): * https://en.wikipedia.org/wiki/Firewalls_and_Internet_Security https://en.wikipedia.org/wiki/Firewalls_and_Internet_Securit... Some of us still remember open (SMTP) relays and the openness of the early Internet: * https://en.wikipedia.org/wiki/Open_mail_relay https://en.wikipedia.org/wiki/Open_mail_relay IPv4 has always not been only about local computer networks: end-to-end connectivity was there at the start and only got choked off later. [1] https://en.wikipedia.org/wiki/Flag_day_(computing) https://en.wikipedia.org/wiki/Flag_day_(computing) [2] https://datatracker.ietf.org/doc/html/rfc1579 https://datatracker.ietf.org/doc/html/rfc1579
• tbrownaw 9mo ago
  > NAT isn’t actually a security feature—it’s an address conservation mechanism that became necessary because we ran out of IPv4 addresses. > But the security benefits people attribute to NAT actually come from the stateful firewall that’s typically bundled with NAT routers. 1. It requires a stateful firewall. 2. It isn't possible to accidentally a default-allow rule on that firewall. It may not be intended as a security feature, but it can't not act as one in practice.
  • Dagger2 9mo ago
    No, NAT requires state tracking, not a stateful firewall. If you want a firewall when NATing, you have to configure that separately. You can absolutely NAT without a firewall, and it won't act like one by itself.
• user3939382 9mo ago
  I’m not using any networking implementation that’s less tested and ipv6 is less tested. Network routing means there are dozens of TCPIP implementations touching traffic. The benefit of ipv6 for my case isn’t worth the risk. If you’ve never run into an ipv6 specific bug good for you.
  • mrsssnake 9mo ago
    How is nearly 50% of modern Internet infrastructure not well tested enough? Also, IPv6 is not an implementation by itself. > Network routing means there are dozens of TCPIP implementations touching traffic. One reason why routers should not fiddle with TCP and stay on IP layer.
    • user3939382 9mo ago
      > IPv6 is not an implementation by itself. I’m not sure what you mean by this. In other words, there is code that is specifically written for ipv6 handling which in some cases isn’t tested as thoroughly as ipv4. Less of an issue as ipv6 adoption grows but it’s non zero. I don’t like the address format, I prefer NAT by default, routing by prefix, like everything ipv6 offers I don’t feel comfortable with even without that. But it’s the most technical reason I don’t like it, the rest is a personal/vibes thing.
• ahlCVA 9mo ago
  Obviously the two aren't the same (especially given the need to do routing), but I've always found it amusing that in the systems world, capability-based systems (i.e. making it impossible to address things you aren't allowed to access) are gaining traction while the philosophy in the networking world seems to be going in the opposite direction (make it possible to address everything, i.e. IPv6 vs. NATted IPv4, then add filtering).
• notpublic 9mo ago
  Is it fair to say IPV6 with ULA (Unique Local Addresses) is best of both worlds?
• egberts1 9mo ago
  NAT's only functions are: - share a precious IP address at the NAT gateway border - hide your internal LAN from external network mapper Last point becomes moot when internal mapping software kicks in, legitimately or not, JavaScript or disingenuous application/daemon/app. Welcome to Cybersecurity SecOP. Now this is where Carrier-Grade NAT really shines: added functionality of handling mobile devices' changing IP addresses as it hops from one subnet to another (switching between G5/CSM/WiFi/personal-hotspot)
  • mrsssnake 9mo ago
    > handling mobile devices' changing IP addresses as it hops from one subnet to another We could create TCP/UDP alternative that would handle mobile IP addresses or even make traffic take multiple of those paths at once (look up MPTCP). But we cannot apply it in real scenarios mostly because of middleboxes (like CGNAT) messing up and limiting the messages that should be taken care of on the endpoint.
    • egberts1 9mo ago
      Right now, there is another battle between AT&T's CGNAT (entire customer base) and Yahoo's NEW login authentication mechanism. Web browser visiting Yahoo Mail is poorly comparing your external IPv6 with your home's IPv4 and rejecting your login. This problem gets worse for Linux users as more and more websites (DirecTV) start to use the NEWEST Yahoo login authentication until AT&T somehow starts disbursing IPv6 inside your LAN, ... or something. So "NAT" security is technically being compromised by Yahoo's JavaScript.
• RajT88 9mo ago
  I could get behind this argument if commodity ISP gateways required special rules for IPv6 (from what I have seen - they do not). As far as I can tell, this is just pedantry, until those features are implemented in most ISP gateways. Akamai has been warning that IPv6 scanning attacks are on the rise. Maybe someone knows better than I about this.
• apitman 9mo ago
  There's no such thing as secure or insecure, only more secure or less secure.