4 ms·

But as a side bonus, nearly every home computer now have a poor man firewall. I find this to be insanely important for the global internet security.

api 12y ago
It is, but mostly because popular operating systems have historically had poor application isolation and vulnerable services. My personal opinion is that having to have a firewall everywhere in front of everything is a hack that was put into place because of awful OS security, and will become less important as OS security improves.
- eli 12y ago
  And/or you just substitute a NAT that happens to also function like a firewall with a proper firewall. The router could do the same sort of filtering as NAT would entail, but not require a hacky NAT table.
  - VLM 12y ago
    Or rephrased its not possible to implement "working" NAT without a stateful firewall, but the lack of NAT doesn't imply its impossible to deploy a stateful firewall. (It would be interesting to research where this "can't have a stateful FW without NAT" meme came from. It is VERY popular among everyone but network guys)
anderiv 12y ago
This doesn't change with the vast majority of residential IPv6 deployments. Many people conflate having a public IP address with not having a firewall. This is not the case at all. Yes, internal clients will get public, routable IPv6 addresses. They are still behind a firewall, though, and you have just as much control over ingress and egress traffic as you did before.
- userbinator 12y ago
  The difference is in the isolation factor: there is absolutely NO way a packet with an internal IP can get anywhere on the public Internet, and likewise a packet with a public IP will never be accepted by a device that has been configured with an internal one. The failure modes are different - although firewalls can be configured to provide an "outgoing connections only" default like NAT, they are also software and thus not immune to bugs; a buggy firewall letting packets through which shouldn't be is far worse than a buggy NAT.
  - oasisbob 12y ago
    there is absolutely NO way a packet with an internal IP can get anywhere on the public Internet That very much depends on your definition of "public internet." My service provider doesn't properly filter RFC1918 space at their border. From my home on the west coast, I can hit 10.0.0.0/8 devices on the east coast in a separate AS. Is a reachable printer web interface 3000 miles away in New York on the public internet? The "Internet" is a very tough entity to define succinctly, but I'd argue yes.
    - graylights 12y ago
      Why would you need to filter an internal IP as a destination IP, routing should handle that. I understand filtering the source address as internal IP because that could be malicious spoofing of internal host (and destination can't legitimately reply.)
- maxhou 12y ago
  The problem is that all NAT related issues are not because of NAT itself, but because of the required stateful firewalling for NAT. To be able to NAT and un-NAT, you first need to classify traffic (that NEW, ESTABLISHED, RELATED,... stuff in Linux netfilter), changing the destination or source ip addresses is only the second part of that process. Protocols don't break only because of NAT, but mostly because of stateful firewalling, you'll face the same problems with IPv6 if you enable it.
userbinator 12y ago
Agreed; despite what many seem to think I don't believe that every device on a network should have a public IP by default. Even if the whole Internet becomes IPv6-only I'll probably still keep my home network behind a NAT router on a private subnet. As the recent series of articles on "smart" appliance security shows, many are exploitable through services listening on ports which the user normally isn't aware of. I would certainly not want a bigger number of those exposed to the public Internet than there already are.
- anderiv 12y ago
  See my comment on the parent...having a public IP address does not mean that it's accessible from the internet.
  - simoncion 12y ago
    This might be a totally off-topic tangent. I apologize if it is. It seems to me that if consumer routers are configured to refuse to forward inbound IPv6 packets to machines on the LAN, we would be in almost exactly the same situation vis a vis home service hosting as we are with IPv4 addresses, NATs, and automated port forwarding protocols. Frankly, this would be a giant step backwards from IPv6 as she is envisioned. From what I understand, the "average" home user has little to no idea of what a port is or why one might want to forward it. They are also very likely to be incapable of classifying machines that need not be globally reachable. So, either we have to write smart software that can determine whether or not a network device requires protection from inbound traffic, or we have to make a forwarding policy decision for this user when we send them their router. If we're serious about IPv6, we shouldn't configure our gateway devices to require the software that we write to assume that a globally-reachable address is likely to actually not be globally-reachable.
    - api 12y ago
      It would be slightly less evil without NAT. You'd still need the three-party handshake but it would always work. You'd no longer have the symmetric NAT craziness. You could also dispense with the need for frequent keepalives, a boon to mobile battery life. Getting rid of NAT is step one. Step two is deperimeterization: getting rid of in-line firewalls. Step two is going to have to wait on OSes having better service encapsulation and app isolation models and for programmers to remove their heads from their behinds and stop writing code that is vulnerable to stack-smashing and buffer overflow attacks. The last part will be tough. How much longer will the Sun be a main-sequence star? :)
mutagen 12y ago
I used to feel this way but I've come to the opposite conclusion. Most homes have a rarely updated, always on computer connected to the public internet with increasing numbers of known vulnerabilities.

api 12y ago

It is, but mostly because popular operating systems have historically had poor application isolation and vulnerable services. My personal opinion is that having to have a firewall everywhere in front of everything is a hack that was put into place because of awful OS security, and will become less important as OS security improves.

eli 12y ago
And/or you just substitute a NAT that happens to also function like a firewall with a proper firewall. The router could do the same sort of filtering as NAT would entail, but not require a hacky NAT table.
- VLM 12y ago
  Or rephrased its not possible to implement "working" NAT without a stateful firewall, but the lack of NAT doesn't imply its impossible to deploy a stateful firewall. (It would be interesting to research where this "can't have a stateful FW without NAT" meme came from. It is VERY popular among everyone but network guys)

anderiv 12y ago

This doesn't change with the vast majority of residential IPv6 deployments. Many people conflate having a public IP address with not having a firewall. This is not the case at all. Yes, internal clients will get public, routable IPv6 addresses. They are still behind a firewall, though, and you have just as much control over ingress and egress traffic as you did before.

userbinator 12y ago
The difference is in the isolation factor: there is absolutely NO way a packet with an internal IP can get anywhere on the public Internet, and likewise a packet with a public IP will never be accepted by a device that has been configured with an internal one. The failure modes are different - although firewalls can be configured to provide an "outgoing connections only" default like NAT, they are also software and thus not immune to bugs; a buggy firewall letting packets through which shouldn't be is far worse than a buggy NAT.
- oasisbob 12y ago
  there is absolutely NO way a packet with an internal IP can get anywhere on the public Internet That very much depends on your definition of "public internet." My service provider doesn't properly filter RFC1918 space at their border. From my home on the west coast, I can hit 10.0.0.0/8 devices on the east coast in a separate AS. Is a reachable printer web interface 3000 miles away in New York on the public internet? The "Internet" is a very tough entity to define succinctly, but I'd argue yes.
  - graylights 12y ago
    Why would you need to filter an internal IP as a destination IP, routing should handle that. I understand filtering the source address as internal IP because that could be malicious spoofing of internal host (and destination can't legitimately reply.)
maxhou 12y ago
The problem is that all NAT related issues are not because of NAT itself, but because of the required stateful firewalling for NAT. To be able to NAT and un-NAT, you first need to classify traffic (that NEW, ESTABLISHED, RELATED,... stuff in Linux netfilter), changing the destination or source ip addresses is only the second part of that process. Protocols don't break only because of NAT, but mostly because of stateful firewalling, you'll face the same problems with IPv6 if you enable it.

userbinator 12y ago

Agreed; despite what many seem to think I don't believe that every device on a network should have a public IP by default. Even if the whole Internet becomes IPv6-only I'll probably still keep my home network behind a NAT router on a private subnet. As the recent series of articles on "smart" appliance security shows, many are exploitable through services listening on ports which the user normally isn't aware of. I would certainly not want a bigger number of those exposed to the public Internet than there already are.

anderiv 12y ago
See my comment on the parent...having a public IP address does not mean that it's accessible from the internet.
- simoncion 12y ago
  This might be a totally off-topic tangent. I apologize if it is. It seems to me that if consumer routers are configured to refuse to forward inbound IPv6 packets to machines on the LAN, we would be in almost exactly the same situation vis a vis home service hosting as we are with IPv4 addresses, NATs, and automated port forwarding protocols. Frankly, this would be a giant step backwards from IPv6 as she is envisioned. From what I understand, the "average" home user has little to no idea of what a port is or why one might want to forward it. They are also very likely to be incapable of classifying machines that need not be globally reachable. So, either we have to write smart software that can determine whether or not a network device requires protection from inbound traffic, or we have to make a forwarding policy decision for this user when we send them their router. If we're serious about IPv6, we shouldn't configure our gateway devices to require the software that we write to assume that a globally-reachable address is likely to actually not be globally-reachable.
  - api 12y ago
    It would be slightly less evil without NAT. You'd still need the three-party handshake but it would always work. You'd no longer have the symmetric NAT craziness. You could also dispense with the need for frequent keepalives, a boon to mobile battery life. Getting rid of NAT is step one. Step two is deperimeterization: getting rid of in-line firewalls. Step two is going to have to wait on OSes having better service encapsulation and app isolation models and for programmers to remove their heads from their behinds and stop writing code that is vulnerable to stack-smashing and buffer overflow attacks. The last part will be tough. How much longer will the Sun be a main-sequence star? :)

mutagen 12y ago

I used to feel this way but I've come to the opposite conclusion. Most homes have a rarely updated, always on computer connected to the public internet with increasing numbers of known vulnerabilities.