4 ms·

In the case of many consumer/desktop machines, being behind a NAT is a very useful first tier security barrier. Every machine being fully reachable -- say via

In the case of many consumer/desktop machines, being behind a NAT is a very useful first tier security barrier. Every machine being fully reachable -- say via IPv6? I foresee many IT headaches and the Nortons/McAffees of the world raking in more money.

zrm 12y ago
NAT != firewall. You can have a firewall without NAT. Probably the sensible thing to do for IPv6 is to make the default to block the ports of specific applications people don't canonically expect to be visible from the internet, like Windows file sharing or telnet or HP JetDirect, but allow everything else so that VoIP and other P2P apps will all work properly.
- Wilya 12y ago
  Of course you can do without a NAT. But the NAT has the advantage to make the firewall rules trivial to write. Put "DROP all packets with destination 192.168.0.0/16 coming from the external interface", and a few other boilerplate rules of the same kind, and poof: you just secured 99.9% of the NAT-ed networks. No configuration required. To do the same without a NAT, you need at the very least to adapt the rules to the IP addresses of the machines behind the firewall, which add complexity and increase the likelihood someone will screw up the configuration. And, hu, please don't open ports by default. That's just a recipe for disaster. If apps really want to open a globally accessible port, make them explicitly signal that to the firewall so it opens access.
  - deleted 12y ago
    [deleted]
  - Danieru 12y ago
    You know you could just drop all packets with destination of any valid address coming from an external interface. This isn't BGP, you're not going to really be routing the entire internet.
- jmspring 12y ago
  Yes, NAT != firewall, but most consumer machines with static/world routable/reachable IPs have been particularly prone to attack over the years. Public access points (hotel, airport, etc) offer a similar level of risk -- yes Firewalls are important, but I'd pretty much make sure most machines/devices under my control in my home network (v6 or v4) not be world reachable. I'm just oldskool paranoid that way.
  - zrm 12y ago
    The only way you can make a device "not be world reachable" is to not connect it to the internet. It's silly to think that a vulnerable application invoking listen() is more dangerous than a vulnerable application invoking connect(). As soon as you connect to some cloud server you're exposed to any malformed data anyone can ask it to relay to you.
deleted 12y ago
[deleted]
ghshephard 12y ago
Not a problem - all of the enterprise IPv6 networks I've seen (not that many, but some) have deployed their IPv6 in RFC 4193 and they use IPV6 NAT at the border. Your average IT Enterprise director/VP has little to no interest in having end-end routing of IPv6 to their internal workstations.
lloeki 12y ago
> being behind a NAT is a very useful first tier security barrier. Misconception. being behind a NAT without a firewall is a very useful nothing in terms of security, because one is basically a static route away from being reachable. It just happens that masquerading is coupled with packet dropping in most appliances and configurations. Only the firewall protects you.
- Wilya 12y ago
  Even if I don't have a firewall, pretty much any competent ISP will configure its switches to drop any packet pointing to/from something that looks like private IP address space. Not to mention they wouldn't route it to me anyway. So even if I don't have a firewall, you would probably need to physically plug yourself directly on the WAN port of my NAT box for your static route to work. Not to say the firewall is useless, but even by itself, the combination NAT + private IP space prevents a lot of attacks. That's very different from what happens when you have no NAT and no firewall, where you are basically reachable by any kid on the other side of the earth.

zrm 12y ago

NAT != firewall. You can have a firewall without NAT. Probably the sensible thing to do for IPv6 is to make the default to block the ports of specific applications people don't canonically expect to be visible from the internet, like Windows file sharing or telnet or HP JetDirect, but allow everything else so that VoIP and other P2P apps will all work properly.

Wilya 12y ago
Of course you can do without a NAT. But the NAT has the advantage to make the firewall rules trivial to write. Put "DROP all packets with destination 192.168.0.0/16 coming from the external interface", and a few other boilerplate rules of the same kind, and poof: you just secured 99.9% of the NAT-ed networks. No configuration required. To do the same without a NAT, you need at the very least to adapt the rules to the IP addresses of the machines behind the firewall, which add complexity and increase the likelihood someone will screw up the configuration. And, hu, please don't open ports by default. That's just a recipe for disaster. If apps really want to open a globally accessible port, make them explicitly signal that to the firewall so it opens access.
- deleted 12y ago
  [deleted]
- Danieru 12y ago
  You know you could just drop all packets with destination of any valid address coming from an external interface. This isn't BGP, you're not going to really be routing the entire internet.
jmspring 12y ago
Yes, NAT != firewall, but most consumer machines with static/world routable/reachable IPs have been particularly prone to attack over the years. Public access points (hotel, airport, etc) offer a similar level of risk -- yes Firewalls are important, but I'd pretty much make sure most machines/devices under my control in my home network (v6 or v4) not be world reachable. I'm just oldskool paranoid that way.
- zrm 12y ago
  The only way you can make a device "not be world reachable" is to not connect it to the internet. It's silly to think that a vulnerable application invoking listen() is more dangerous than a vulnerable application invoking connect(). As soon as you connect to some cloud server you're exposed to any malformed data anyone can ask it to relay to you.

deleted 12y ago

[deleted]

ghshephard 12y ago

Not a problem - all of the enterprise IPv6 networks I've seen (not that many, but some) have deployed their IPv6 in RFC 4193 and they use IPV6 NAT at the border. Your average IT Enterprise director/VP has little to no interest in having end-end routing of IPv6 to their internal workstations.

lloeki 12y ago

> being behind a NAT is a very useful first tier security barrier. Misconception. being behind a NAT without a firewall is a very useful nothing in terms of security, because one is basically a static route away from being reachable. It just happens that masquerading is coupled with packet dropping in most appliances and configurations. Only the firewall protects you.

Wilya 12y ago
Even if I don't have a firewall, pretty much any competent ISP will configure its switches to drop any packet pointing to/from something that looks like private IP address space. Not to mention they wouldn't route it to me anyway. So even if I don't have a firewall, you would probably need to physically plug yourself directly on the WAN port of my NAT box for your static route to work. Not to say the firewall is useless, but even by itself, the combination NAT + private IP space prevents a lot of attacks. That's very different from what happens when you have no NAT and no firewall, where you are basically reachable by any kid on the other side of the earth.