Hacker News Reader

Comment by veave | Hacker News Reader

I wonder who goes around thinking "I'm going to expose an oscilloscope to the WAN!". Something you have to do on purpose, taking lots of extra steps, because of CG-NAT. Kinda asking for it.

View on HN

Many universities give everyone on their network a fully routed IP address, at least this was the case ten-ish years ago for me in Germany. Was ideal if you were developing something and showing it off to someone at the other end of the campus while being on the phone or Teamspeak - just give the other person your IP address and spin up a server at 8080, that's it.

Besides, if I were on a red team, I'd enumerate all devices on the LAN as well. Simply to look for all that old cruft someone set up years ago and never updated... that's where you get persistence. No one goes and checks 'scopes, network gear or printers for indicators of compromise in their firmware, because no one thinks of them if the admin isn't looking for outgoing Internet traffic.

> Many universities give everyone on their network a fully routed IP address, at least this was the case ten-ish years ago for me in Germany

Times have changed a lot in the past decade. No reasonable network admin would be giving public IPs to everything that connects to the network any more.

IPv4 addresses are also scarce relative to a decade ago.

Routable IPs aren't the problem here. In fact under IPv6 you generally would give devices routable IPs. NAT is not a security mechanism.

Instead, you should put a default-deny rule on your firewall for all incoming traffic to user devices (which is generally the default setting anyway).

Trust me, it's not the case. I sell electronic instruments for laboratories, and in the large majority of the cases they are simply attacched to the local network. And such network has simply internet access. I once made a blogpost to advise our customers how to create a local instruments network for higher performances and security, but I don't know how much impact it had

You are forgetting that many universities (at least in the US) are sitting on enormous allocations of address space due to being early users of the technology from DARPA.

Coupled with "NAT isn't a firewall", assigning actual IPs to your end devices isn't all that silly if you happen to have a few million to spare.

As of a year ago, the major university I worked at still does this

I talked to the security person at a German university a few years ago and suggested that they put some restrictive firewall rules in place to increase security. He agreed with me in principle, but lamented the fact that the grey beards in the university's network administrator team follow a philosophy which says that networks need (or want?) to be free.

Yeah IPv4 addresses are not scarce at many (some?) big universities

IPv4 exhaustion isn't nearly the issue for universities that it is elsewhere. Most unis grabbed a large allocation early on, before it was an issue. Many have multiple class B allocations; quite a few have As.

Sadly, to my current understanding, my alma mater still does this. At the time it was extremely convenient - we had labs full of Solaris and Linux boxes, which could be remotely accessed from home without any issue. And I also seem to remember that basically nothing on IT's part had to be done during the Xbox 360 / Xbox Live craze, unlike my peers at other schools.

Even then, though, the downsides of consumer network security (mostly) relying on NAT were obvious. Common ports (80, 25, etc) were blocked inbound; the school's printers basically had to be on their own network, or get spammed all day.

> No reasonable network admin

You are speaking about academia. It's not mutually exclusive, but it's different then out there in the wild.

Most of the staff/admins in the universities that I've worked in have relatively modern sensibilities when it comes to this stuff. However, their constituents, particularly on the academic sides of the house ... less so. I've heard a modest firewall policy argued against on the grounds of Academic Freedom, let alone private IP addresses.

It is indeed a different environment.

There are so many devices on a campus network with nebulous ownership set up by clever but still-learning grad students and even undergrads, trying to secure the perimeter seems pointless. Someone internal will find a way to get hacked, or even themselves could be malicious (what are we going to do, background check every student?), so all the nodes on the network need to themselves be secured.

I can confirm that it is completely normal at German universities as of today. You can setup your own router at home if you so desire

This is still the case I think, though admins now restrict the access for sensitive equipment. My work laptop's ethernet has a fully public ip4, for example.

In the era of IPv6 you can't assume that your device is implicitly firewalled for incoming connections. My smartphone currently has a public IPv6 address from my relative's home wifi network.

But have you actually tested connecting to it from outside the network? Just because something has a public IPv6 address doesn't mean there isn't a firewall somewhere in between. It just means there's no NAT.

Oh I didn't realize that. How can that be identified and locked down?

IPv6 is intended to always use public addresses. If you have an ipv6 address, it's probably public. But that doesn't necessarily mean there's no firewall.

You can go to https://whatismyipaddress.com/ and get your public IP then paste it at https://ipspy.net/nmap to port scan yourself.

Your link does not report my public IPv6 address. Only my public IPv4 address.

Here is a service that will show you both your public IPv4 and your public IPv6 address.

https://whatismyipaddress.com/

Ah, thanks. I don't have an IPv6 address so I couldn't check.

Still, that's the only nmap-in-a-website I'm aware of. There are probably others.

Does the nmap scan work on IPv6? That site might actually only be IPv4...

I tried the online scan that you linked with my IPv6 address.

At the end it said

Nmap done: 0 IP addresses (0 hosts up) scanned in 2.20 seconds

Even though it claims to support IPv6

Also the site spent a whole lot of time showing progress bars and stuff.

Whereas when I run Nmap from one of my servers on the internet against my public home IPv6 address

    % nmap -6 -A -T4 2a0c:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx

I get:

    Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-16 17:43 CEST
    Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
    Nmap done: 1 IP address (0 hosts up) scanned in 2.23 seconds

So in conclusion yeah, that site you linked was not able to scan IPv6

I think better than that online version of Nmap is to run Nmap from another computer on another IPv6 enabled network against your own public home IPv6 address. Assuming you have additional computers like a server or a VPS, etc. Same way I did.

Another possible alternative is to use shodan.io and check what they have found in their past scans for your IP address. Seems that shodan requires creating an account now in order to use it. Not sure if it did before. I remember testing shodan.io a few years ago but don’t remember if I had to create an account then.

The site is actually spinning up a VM to run the nmap so those progress bars are real. Thanks for checking. I reached out to the creator and he will update it to work with IPv6.

Agree nmap from another machine is best but that's not always an option. I'm thinking like if I am on hotel wifi or something. I might not have easy access to another box.

Shodan is a great suggestion.

It might just be that your host is blocking all IPv6 probes, as nmap reports, in which case your host would already be in your desired configuration.

Also I'd be extremely surprised if Shodan had anything on your IPv6 address.

Notice the difference of their output:

Nmap done: 0 IP addresses (0 hosts up) scanned in 2.20 seconds

And mine:

Nmap done: 1 IP address (0 hosts up) scanned in 2.23 seconds

And note that 0 IP addresses scanned is exactly what you get if you run nmap with an IPv6 address as target but without the -6 flag. They probably are doing just that; running nmap without the -6 flag.

But let's try something else.

    % host google.com

    google.com has address 142.250.184.14
    google.com has IPv6 address 2a00:1450:4003:808::200e
    google.com mail is handled by 10 smtp.google.com.

    % nmap -6 -A -T4 2a00:1450:4003:808::200e

    Starting Nmap 7.80 ( https://nmap.org ) at 2023-07-16 16:53 BST
    Nmap scan report for mad06s10-in-x0e.1e100.net (2a00:1450:4003:808::200e)
    Host is up (0.032s latency).
    Not shown: 998 filtered ports
    PORT    STATE SERVICE   VERSION
    80/tcp  open  http      gws
    [...]
    Nmap done: 1 IP address (1 host up) scanned in 76.10 seconds

And now try putting 2a00:1450:4003:808::200e into their web tool and see what they report.

At the moment their website will get 0 addresses scanned for that as well.

Nmap done: 0 IP addresses (0 hosts up) scanned in 1.58 seconds

I prefer https://www.whatsmyip.org/

Firewalls.

In the network path. On the device. They control what packets get allowed or denied.

I wish we lived "in the era of ipv6". Unfortunately one of the biggest mobile providers in my country (and the only one available to me at reasonable speed) has no ipv6 setup. Also, they NAT their entire network.

So, to have any way to connect back to my home network I have to run a permanent vpn to a server in aws and connect to that.

Probably quite a few people who want to remote-monitor a test setup? The web interface is one of the selling points.

Exactly! I don't see anything on shodan. (I didn't look very hard, however.)

All the people against NAT/PAT and hyping up v6 as a way to get rid of it.

That's unrelated. Any firewall can block incoming connections without the massive performance penalty of NAT

There's no performance penalty for NAT that I'm aware of, I'd like to hear more about this. IPv6 OTOH has enough privacy busting concerns that I personally will never use it on my home systems. Trying to use only IPv4 on a smart phone though causes various connectivity issues, I've tried it. Google does own Android and wants to make sure they know as much about what we do on our phones as possible.

What performance penalty does NAT entail? Even low end home routers have built-in NAT on the chip, no cpu is used for NATting.

> low end home routers have built-in NAT on the chip

Low end home routers have tiny connection tracking tables and fall back to software routing when that table overflows. IMO if you don't notice the massive drop in performance when this happens, you have very low standards/expectations for internet latency. In had to upgrade to a prosumer router just to get acceptable perf on IPv4

Virtually all SOHO routers do routing on CPU.

If you're going to do SOHO routing safely/correctly, you'll need to do some sort of connection tracking. You'll need to allow packets on new and existing outbound connections, but only allow incoming packets on existing connections. SOHO routers generally won't support this in hardware, so you have to route on the CPU anyway.

NAT on IPv4 vs stateful routing on IPv6 is a wash in terms of performance.

I'm thinking maybe they meant performance impact on peer-to-peer protocols like WebRTC, where if both sides are behind NAT, you might end up routing traffic between two local devices with a NAT gateway between them through a remote TURN server to establish connectivity.

NAT is and always was a massive band-aid for the lack of public IPv4 addressing.

Reply on news.ycombinator.com