Hacker News Reader

Comment by takeda | Hacker News Reader

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

View on HN

IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic.

The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GUI at all.

Ubiquiti's router offerings are rather poor, VPNs can't roll over to WAN2 automatically, redundant tunnels are hard to configure, IPv6 support is a mess, asking Ubiquiti for support gets you an unhelpful chat that redirects you to help articles you've already read.

Other players in this space have had these capabilities for over a decade, and you can call to get help. Ubiquiti might be inexpensive, but its still more than double the price of Grandstream's SoHo/SMB router and access point offerings while offering equivalent support and features.

Really neither of these offerings are good outside the SoHo and single location business space. I wish for OpenWRT, OPNsense or WatchGuard's configurability wrapped in a single interface that lets you see the router, switches and access points performance live while letting you alter their settings, without seriously kneecapped router capabilities.

> IPv6 can be a privacy issue

Why do people throw this out there as if it's a fact we all agree on?

I've heard of one potential privacy issue 20 years ago, which was that IPv6 autoconf used the MAC address for the host part of the address, but this has long since been replaced with regularly rotating random suffixes.

So... why keep saying this?

Because the prefix stays the same. And many ISPs that provide IPv6 don’t rotate very often, if at all.

For most ISPs the IPv4 acts exactly the same way, being almost but not quite stable. I don't understand how that's a downside to IPv6.

Because "most ISPs" are actually wrong, it's "most American ISPs". In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). There's a reason why dynamic DNS services are popular.

P.S. If your security paradigm relies on IP addresses being semi-stable, you need to overhaul it.

>In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly).

Fair, but that's still IPv4 and IPv6 rotating at the same rate.

>In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly).

I'm in the rest of the world and my non-static IP address almost never changes. I actually memorised my external IP address at one point since I saw it so often.

This is wrong, at least in Europe, static IP is considered to be best practice.

I live in France and work in IT and never heard about this "best practice". Who claims that?

In use the highest fibre offering from Orange and have a dynamic IP. Fixed IP is for "professionals".

RIPE : https://www.ripe.net/publications/docs/ripe-690#5-2--why-non...

That's funny, because I kind of have the "lowest" fiber offering from Orange, and I don't think my IP ever changed ? (I wouldn't bet on it thought.)

The RIPE article is about IPv6. I use only v4

I monitor closely my Internet connection (since I serve stuff on it, and also because why not) and I saw my IP changing and wandering throughout the Ile-de-France. I would say that the changes are every 6 months or so (since one of my domain is with Gandi I had to write a checker and change the assignment through their API)

If you only use IPv4, then these days (with not only the Asiatic countries never having got IPv4, but Europe having ran out if IPv4 addresses), technically you don't have a "real" Internet connection any more.

I do not understand what you are saying. Do you imply thet IPv4 is non-existant in Asia??

How having ran out of IPv4 means that there is no "rea" Internet?

Honestly - it would be great if IPv6 caught up but the standard, first choice is IPv4.

My bad, I should have said that "some" Asian countries never had enough IPv4 addresses to start with. AFAIK this explains why India is one of the world leaders in IPv6 deployment ? (I've also heard that IPv6-only networks are not uncommon in some Asiatic countries ?)

IPv6 has been slowly rolled out for more than a decade now, though AFAIK the standard has only been finalized in 2017.

Since 2017, first choice should have been IPv6.

"Internet" stands for "International network". If you're using IPv4 only, when someone else uses IPv6 only, then obviously you won't be able to connect to each other. Therefore you aren't on the same network. And only one of them can be "really" called "Internet".

(Also, IPv4 was an experimental ARPANET protocol which wasn't supposed to be used "in production" worldwide, but here we are...)

Internet stands for interconnected network, with the capital "I" signifying that it's "the" interconnected network.

Not according to my network teacher (for the upper case one), but this is a moot point, since the result is the same.

Sadly anyway in theory, dual stack is less secure than single stack, despite whether IPv6 good or bad.

IPv6 privacy issue? You know that you get /32 block, you can change your IP from that block every hour if you want.

The issue with IPv6 is that links are significantly slower than IPv4 links today.

see: https://tools.ietf.org/html/rfc4941

No firewall or opt-in firewall (which only a tiny fraction of people turn on) is pretty common for IPv6. It's also somewhat an open question whether router firewalls are even a good idea on IPv6 (since the security advantages are not that certain, and it can prevent the adoption of new protocols).

> pretty common for IPv6

Source? Every consumer router I've ever seen that supported IPv6 also had a firewall covering IPv6. Given the crapshot routers tend to be I wouldn't be surprised if some messed that up, but "pretty common" seems unlikely.

https://lafibre.info/ipv6/ipv6-le-firewall/

For context, Free recently boasted reaching 99% IPv6 coverage. On their (now) midrange Freebox Revolution router, the IPv6 firewall is (AFAIK still today) opt-in.

Ugh. Idiots. CPEs should default to firewall on.

Well, OTOH, the fact that tens of millions of people have now been connected through firewall-free/disabled IPv6 for years, yet the (somewhat expected) disaster of widespread hacking/compromises clearly didn't happen... which could mean that this is not that critical of a security feature as could be expected ?

Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.

This is what I did a couple years ago. The documentation for OpenWRT is great, and Luci/LDE makes it approachable if you don’t feel comfortable managing from the CLI. I have one VLAN for my “privileged” devices and one for the “IO(shi)T” devices.

This is the way to do it.

NAT is not really security and UPnP doesn't really do much to prevent malicious software already on your network from doing malicious things except perhaps hosting itself on your WAN to spread further.

What disabling it does help is prevent improperly configured or flawed devices from accidentally exposing themselves to your WAN. IOT devices? Put them on a network with no UPnP. Workstations and video game consoles with up-to-date patches? UPnP is probably fine.

Aren't these two points slightly contradictory?

> the author depends on NAT as a security feature, when it was never designed to be one

> UPnP is a convenience feature, and is disabled in all security focused networks.

uPnP punches holes in a NAT. If you shouldn't be trusting NAT to protect you anyway, why bother disabling a feature that's designed to punch holes in it? Just set up your firewall to protect your network, and it's not an issue.

(I suppose some routers might automatically add a firewall exception when doing uPnP hole punching, but if so that's an issue with those routers, not with the idea of relying on a firewall.)

Ah that’s fair, but it’s the combination of both that is the worst

> I suppose some routers might automatically add a firewall exception when doing uPnP hole punching

Every consumer router I’ve ever had will open up a port in the firewall when uPnP is enabled and a request is received. Is that not standard?

UPNP doesn't "punch holes in NAT." It is dynamically configuring NAT to provide a specific translation. The same kind of dynamic translation happens the other way for any allowed outgoing traffic, and lots of old NAT traversal tricks made use of that before UPNP was a thing.

The hole was always there. People get this topic confused all the time because the majority of network devices doing NAT are also acting as firewalls of varying efficacy. There are basically no non-firewall routers anymore, they all have at least simple network address ACLs.

The purpose of upnp is touchless configuration. If you care about security, that is orthogonal to your goals, and so it must be restricted by some other policy enforcement.

There are at least some non-firewall or opt-in firewall (which amounts to the same for most people) for IPv6 routers provided by major ISPs.

Good point, I should have been more careful about the terminology. My point was that it's possible to have UPnP configure a port to be translated for a particular host on the LAN but still have a firewall on the router blocking access to that port.

Another reply to my comment suggests that at least some consumer routers open a firewall port up as well, meaning that UPnP is still a potential security hole on those routers. (This might actually be required by the IGD protocol spec for all I know, that would be unfortunate...)

This sort of thinking is endemic in industrial networks; they finally internalized basic ipv4 concepts in the late 00s and never considered maybe the stateful tracking required for UPNP and other NAT tricks also might exist without it.

I've set up several private v6 networks to deal with renewable energy projects in which the integrator used the same ipv4 address blocks on every single one, and the whole 6to4 translation explanation landed like they had just seen a devil sorcerer graft a goat head onto a human.

There are many, many networking and originally UNIX tools tricks (e.g. SSH) you can show to the poor people supporting industrial networks/ hardware. I have written some of my tricks down in this OrgPage: https://www.orgpad.com/s/UHUor4 there are screenshots for Linux and Windows for some things related to SSHFS, SOCKS Proxy and more. Click units with shadows to open them. From time to time, I update it to reflect new tricks.

This knowledge saved at least 2 companies hundreds if not thousands of euros in on-site support, hardware and other expenses. Funnily, while these things are quite hacky, they tend to work better than most of the dedicated hardware I have seen in practice, while keeping you/ the technician/ engineer in control. With any kind of working infrastructure, you can estimate how good your solutions are because you don't get called at random times and from monitoring/ explicit contact you just see/ hear the things work fine.

Your link doesn't open in my Firefox, unfortunately.

I tried just now in two different Firefox (ESR and current) versions and it works. Perhaps you have to enable JavaScript, since OrgPad is a web application?

You can also try this not-shortened link: https://www.orgpad.com/o/AWhUSD7lhAjYC0sw-9lcDd

Disabled uBO, still no luck. It says "Computing sizes of all cells, 50 remaining ..." and spins forever.

IMHO IPv6 is an ISP problem, I don't need every (any, really) of my devices accessible from outside my personal VPN, and IPV4 private space is more than sufficient for that.

IPv6 is overly complex, therefore insecure. Thanks to the US Patriot Act I dont even trust the VPN stuff tbh.

> IPv6 is overly complex

I'm being a bit pedantic about this since you're right that in practice, setting up stuff for IPv6 is in-fact complex since support for it is all over the place.

But I want to stress that IPv6 as a protocol is much simpler, more intuitive and much more versatile than IPv4. I'd even go so far as to say that it's actually fantastically suited for local networks, especially so in complicated setups with multiple subnets (in an alternate reality where everything supports it).

It's really, truly, a genuine shame that it never gained the momentum it could have.

The basics of the client side are simple.

But the routing is not simple.

I'm pretty well versed in networking generally - even IPv6, but a quick glance over something like: http://ipv6now.com.au/primers/IPv6RoutingSecurity.php

Makes it obvious why it still hasn't gotten anywhere, _no one_ wants to dig through all that unless they really really have to.

Security depends on securing the routing and address allocation. So it is hardly surprising very few were/are willing to step up a declare IPv6 installations safe for service.

Combine that with most users being happy and comfortable with 1 IP address and there was no mass market appeal for IPv6 hardware or software.

I'd go so far as saying the vast majority of people do not even realise their machines can be accessed from the outside world when they only have one public address behind their "firewalled super safe ISP router", and would be terrified to find out they can.

> http://ipv6now.com.au/primers/IPv6RoutingSecurity.php

Everything listed there either also applies/transfers to IPv4 or is not applicable at all to the situation you're evaluating.

> Makes it obvious why it still hasn't gotten anywhere

Uh....

https://www.google.com/search?q=google+ipv6+traffic+percenta...

44.44%

https://www.google.com/search?q=google+global+ipv6+traffic+p...

34.15%

[EDIT: sibling post by minimaul has the better link:] https://www.google.com/intl/en/ipv6/statistics.html#tab=ipv6...

> Combine that with most users being happy and comfortable with 1 IP address and there was no mass market appeal for IPv6 hardware or software.

The mass market appeal for IPv6 is the fact that we do not have enough IPv4 to actually give one internet connection a unique IP. CGNAT is getting ever more present in the marketplace as a result of this.

Major providers are rolling out IPv6. eg in the USA, several major cable/fibre providers provide v6, several mobile networks provide IPv6 using things like 464xlat. It's the same in the UK - BT for example provide IPv6 on consumer internet connections, EE (a major phone carrier) provide v6 and use 464xlat to provide v4 connectivity to handsets.

India and Germany are further ahead still, generally. Google's IPv6 stats are a good indicator of just how much v6 is in use now: https://www.google.com/intl/en/ipv6/statistics.html#tab=ipv6...

Usually, inbound IPv6 are firewalled by the ISP router just fine. As far as I know, there is UPnP with IPv6 though there seems to be some work into that direction. Also, current CGNAT setups tend to close connections before they should according to RFCs: https://anderstrier.dk/2021/01/11/my-isp-is-killing-my-idle-...

All the IPv6 routing security has to be done with IPv4 as well. ARP -> NDP, prevent source address spoofing, DHCP guard/ RA guard are basically two sides of the same coin. Serious networking hardware supports this for years or there are firmware updates supporting it. For about the last 5 years, supporting IPv6 became much easier, almost as easy as supporting IPv4 for most of the real world use cases. Anyway, the reality is, we don't really have much choice other than to migrate to IPv6 sooner or later.

Pretty often, IPv6 is NOT firewalls (or the firewall is opt-in which in practice amounts to the same thing).

Perhaps. Do you have concrete examples? As with everything: "Trust, but verify." https://en.wikipedia.org/wiki/Trust,_but_verify

https://news.ycombinator.com/item?id=26688591

Well, the governments are starting to get the stick out : you don't have IPv6 support? No 5G authorisation for you!

@yesco is right that practice is all over the place for IPv6 if it works at all. But in general, IPv6 as a protocol is just fine, at least equally secure as IPv4 and not more complex than IPv4 in many practical cases. I would even go so far to say it is way easier to do a clean address plan with IPv6. Usually, IPv6 inbound access is blocked by default on the ISP routers firewall.

In practical networks, IPv4 tends to be set up in some way and usually seems to work correctly - until you discover all the atrocious hacks people have commited over the ~ 25 years of practical, widespread use. Quite often multiple levels of NAT without much reason for it, UPnP where it shouldn't be, payment for even single IP addresses (great, we are paying for numbers other people got basically for free) and more - IPv4 are often handled like pets. Compared to IPv6, it is much harder to do a simple split into security groups based on prefix with IPv4. (In IPv6, you can usually just give every broadcast domain a /64 and will not do a huge mistake - they are a single security group. Sometimes, you might want to hand out a /64 or even shorter prefix to every client though.)

There are some great resources for modern and practical IPv6 too: https://knihy.nic.cz/#IPv6-2019 (4th edition in Czech by Pavel Satrapa, but can be translated using Google Translate and is more or less ok as a translation: https://docs.google.com/document/d/10CRjSRBLcdqtGjJgaW5Sct5h...) there are older books in English that are also mostly relevant still. The free IPv6 course by RIPE NCC is also a good way to get up to speed and avoid (spreading) FUD.

I have the opposite problem, where I actually want one of my devices to be publicly accesible but my ISP only provides NAT.

And they even disable UPnP from some of their routers for "security reasons".

Why the sarcastic quotes around “security reasons”? Mom and pop need same defaults. An argument can be made that disabling it is a same default.

OP is not talking about disabled by default, he’s talking about disabled permanently, i.e. you literally cannot turn uPnP on because the ISP disables the functionality. I know that AT&T does this with their BGW210-700. Security is good, but locking people out of basic features is not.

“Overly complex, therefore insecure” Has to be the most incorrect understanding I’ve ever seen in computing... And I’ve seen people talking to their mice...

Maybe they were from the future and just needed a tank for some whales...

You made my day^

NAT can mean 2 things, 1 to 1, and 1 to many. Firewall is a concept not a thing.

IPv6 could be set up so every computer has an internal address and you choose to map external to internet using 1 to 1 NAT.

As a former maintainer of firewalls... You are wrong. From beginning to end, utterly, and completely.

::Pets His firewalls lovingly:: “Don’t listen to Him, He didn’t mean it.”

Ah yeah the good old IPv6-NAT....

Reply on news.ycombinator.com