Hacker News Reader

Comment by geek_at | Hacker News Reader

Just yesterday I witched my office network to IPv6 and one thought kept creeping in regarding security.

If I'm on IPv6 there is no NAT and it's basically security by obscurity (not really but port scans would take forever)

What if I host a small web script on my machine and I surf the web with my IPv6. Couldn't all website owners do port scans on my address (because they obviously see my address) and then access my local site or even God forbid one of my staff is running an unpatched windows. How is it safe if it's basically (in ipv4 terms) a 1:1 NAT for all my machines?

View on HN

IPv6 doesn't mean no firewall and NAT!=firewall

You should still be blocking incoming requests for IPv6 endpoints and only open ports you intend to serve publicly.

I do understand that but NAT was acting like another layer of firewall because I could be sure that none of my devices behind the nat could be accessed without port forwarding. With IPv6 they can

This is not exactly true. There are many tricks in the NAT traversal toolkit, depending on your configuration it can be fairly simple to work around. In every case where you use NAT, you also use a firewall.

100% of consumer IPv6-capible routers block unsolicited inbound IPv6 by default. It's not something you need to worry about unless you are hosting, and in that case your concerns are the same as if you're using IPv4.

Not from a passive, receiving network, no. If anyone on the network uses a web browser, there's a good chance your network can be attacked by a malicious ad through NAT slipstreaming, through (https://samy.pl/slipstream/)

NAT wasn't meant to be a security mechanism and because of that, the practical designs found in most devices don't treat it as such.

On IPv4, NAT and firewalls are usually one and the same rule set. That rule set is slightly smaller with IPv6 because of the lack of NAT, but the mechanisms are still the same. If your IPv4 firewall fails, NAT won't save you, because that's part of the system that failed.

If you're still insistent on using NAT then... use NAT. The core technique works on both protocols, you'll just have to set it up yourself because router vendors don't usually implement it.

That's not security, that's an assumption. UPnP was so vilified because it broke that assumption and revealed NAT never provided security, it provided an assumption.

Please DO NOT rely on a NAT for any sort of security. "Getting around" a NAT is so common today that Wikipedia even has a fairly comprehensive article dedicated to it [0].

Whether IPv4 or IPv6 does not negate the need for a firewall at the ingress/egress.

[0] https://en.wikipedia.org/wiki/NAT_traversal

Wouldn't those all apply to a simple stateful firewall too?

I mean, clearly OP doesn't need to worry about the lack of NAT, but not having gone through all of the things listed on that list, I would assume that they all require an active participant behind the NAT/firewall, and would still be required for just a plain old stateful firewall (assuming you don't have the ports open) when you want to communicate with some other endpoint behind another firewall.

> Wouldn't those all apply to a simple stateful firewall too?

Not necessarily. I mean if someone's setup really is "just NAT" then you can just send packets with the addresses of their internal hosts to their router and it will route them.

They thought of that already.

One of the differences between IPv6 and IPv4 is that the v6 address space is enormous and stack assumes your interface will have multiple addresses.

In particular, on each interface you normally have:

* A link-local IPv6 address (non route-able). This is used for neighbor discovery and router solicitation, among other things.

* A static-ish cryptographically generated address (often called a secured address). This is used for incoming connections.

* One or more temporary addresses with relatively short lifetimes. These are preferred for outgoing connections. The lifetime of these addresses often overlap because any the OS has to maintain the address for any open connections.

Note that these addresses can be generated automatically using SLAAC, and you would normally have a set of secured and temporary addresses for each upstream router that is sending router advertisements. You may also have another set of secured and temporary addresses in the IPv6 private range (equivalent to 10.0.0.0), if your router is advertising that (useful for internal services like DNS, where you want to configure the server address in the DHCPv6 config). So it’s not unusual for a given host on a simple home network to have a dozen addresses in 2 or 3 subnets (on one Ethernet interface).

The bottom line is that your server should be listening on the secured address and your web browser should be using temporary addresses for outbound connections.

> Relatively short lifetimes

If it's not a unique address for every request, it's unfortunately too long.

It’s no worse than IPv4, which tends to maintain the same address until you reboot your CPE.

You can always change the configuration to reduce the address refresh interval for your OS.

You can still have an NAT with IPv6. But ideally you don't, and you just put all traffic through a firewall. You can still block incoming connections or whatever you relied on that NAT for before.

Basically all consumer routers block incoming connections by default. It works almost the same as NAT except you can allow the same port on multiple machines in the network now.

In addition to all of the comments mentioning that a firewall accomplishes what you're looking for (and it is almost certainly built into your router) I'm curious as to what exactly you mean by "switching" your office network to IPv6. Are you just saying that you enabled it? Because you'd hit more than a couple speedbumps browsing the web if you completely got rid of IPv4.

There was no NAT when I was a wee nipper. That's what your firewall is for?

Of potential interest is that IPv6 also has the concept of link local addresses. These are automatically assigned and not routable.

But, yeh, I went through the same moment of fear that you did when I first turned on ipv6.

You want a firewall, not NAT.

Why can you not have NAT when running the network on IPv6? I've never seen anyone explain this

NAT is a workaround for the small amount of address space that was allocated originally. That's not the case on IPv6. I'm sure you can NAT stuff but why the hell would you want to do that and have to maintain all the stateful pain in the ass stuff required such as NAT tables which are going to be much larger.

To prevent the machines in the network from being exposed publicly

If you have machines in the network which you don't trust to handle their own incoming connections securely you can block those connections at the firewall, without port or address translation. Ideally you'd put those on hosts on their own locked-down VLAN. NAT (or NAPT) doesn't add any security (see: NAT traversal) and having different internal vs. external addresses significantly increases the complexity of the system—not just the router but applications as well, which are forced to deal with their public addresses and ports differing from the ones they were assigned.

I'd rather blacklist devices that I believe are somehow secure than blacklist devices that I think are insecure. How would you even keep on top of that in a large company network? Better to just default to hiding all devices behind the NAT

That’s what firewalls are for.

You can, but the point is that you shouldn't have to because there are enough addresses. NAT only makes networking code for applications harder.

NAT complexity is only marginally more than for a stateful firewall, and is probably lower than for an application firewall. And you still want a stateful firewall in IPv6 networks!

Not needing to do address translation is a large amount of code that you don't need to run to keep IP traffic flowing.

Sure, you absolutely need a stateful firewall, but not needing address translation makes it easier to troubleshoot, makes it easier to establish end to end connectivity and no need to port forward or things of that nature so multiple clients can all use the same port.

With NAT you may need STUN, TURN, ICE, and probably a few more acronyms:

* https://en.wikipedia.org/wiki/STUN

* https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_...

* https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab...

Not sure if that's more or less complicated than already knowing your IP address and 'just' using UPnP/PCP:

* http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf

* https://en.wikipedia.org/wiki/Port_Control_Protocol

But NAT can protect your internal addresses. If your ISP changes your IPv6 address/prefix, all devices in your network will change their addresses too. This is pain in the ass that can be alleviated by NAT.

You can use link-local addresses for that. There addresses are only available inside the local network and are never routed. When you use IPv6 your interfaces have multiple addresses, at least one external and one link-local.

The whole point of a NAT is negated by a switch to IPv6

No it's not -- maybe I'd prefer not to advertise how many devices I have on my network.

Wouldn’t that be the purpose of a router, not NAT? The two are often bundled together but they aren’t necessarily inclusive

IPv6 address randomisation fixes that, and it's enabled by default on most IPv6 stacks.

You can. I've seen sites use it because they didn't have an allocation of their own, but they didn't want to rely on their ISP's numbering either. So they used 1:1 NAT between their carrier's space and their ULA space. Like renting a /8 and mapping it to 10/8. Except in v6land it's nowhere near as crazy as it sounds.

NAT isn't required in v6, it's not wanted in v6, but it's perfectly possible. If you think about it, PAT/NAT (port-based NAT) doesn't happen at the IP stack, it happens at the port level.

> If I'm on IPv6 there is no NAT and it's basically security by obscurity (not really but port scans would take forever)

That's why firewalls exist. And they work with IPv6.

My ISP gives out an IPv6 address to my Asus, which also picks up some prefixes for allocation via DHCP-PD. This causes my printer pick up an IPv6 address, but it is not accessible to the outside world.

Statefull firewalls still exist with IPv6, so by default connections from the general Internal cannot connect to your 'internal' systems. Hole punching still needs to be done with UPNP/PCP (at least on residential systems; SMB may not want this)

* http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf

* https://en.wikipedia.org/wiki/Port_Control_Protocol

The advantage of IPv6 is that you no longer have to have things like STUN, TURN, etc. (Remember Skype super-nodes?) Your client knows its own IP(v6) address, gets the IP address of the other end, and then tells your firewall to allow connections between just those two addresses. Once your session is done the ACL is deleted and you're completely default-blocked from the outside again.

Copy-pasting from a previous discussion a little while ago:

---

An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is recorded. When an 'outside' packet arrives the firewall checks its parameters to see if it corresponds with an existing connection, and if it does it passes it through. If the parameters do not correspond with anything in the firewall's table(s) it assumes that someone is trying to create a new connection, which is generally not allowed by default, and therefore drops it.

The main difference is that with IPv4 and NAT the original (RFC 1918?) source address and port are changed to something corresponding to the 'outside' interface of the firewall. With IPv6 the address/port rewriting is not done.† Only state tables are updated and checked.

New connections are not allowed past the firewall towards the inside with either protocol, and only replies to connections opened from the inside are passed through.‡

There's no magical security behind NAT: tuples and packet flags are read, looked up in a state table, allowed or not depending on either firewall rule or state presence. The security comes from the state checking.

† It is possible to have private IPv6 addresses using ULA, and then the router/firewall uses NPTv6 to rewrite the prefix (leaving the /64 interface component alone).

‡ Just like with IPv4 (NAT), to allow unsolicited 'new' connections in you have to do do firewall hole punching with (e.g.) UPNP. But by default things are blocked.

---

No-NAT != access from the Internet.

Reply on news.ycombinator.com