Hacker News Reader

Comment by Aurornis | Hacker News Reader

> Many universities give everyone on their network a fully routed IP address, at least this was the case ten-ish years ago for me in Germany

Times have changed a lot in the past decade. No reasonable network admin would be giving public IPs to everything that connects to the network any more.

IPv4 addresses are also scarce relative to a decade ago.

View on HN

Routable IPs aren't the problem here. In fact under IPv6 you generally would give devices routable IPs. NAT is not a security mechanism.

Instead, you should put a default-deny rule on your firewall for all incoming traffic to user devices (which is generally the default setting anyway).

Trust me, it's not the case. I sell electronic instruments for laboratories, and in the large majority of the cases they are simply attacched to the local network. And such network has simply internet access. I once made a blogpost to advise our customers how to create a local instruments network for higher performances and security, but I don't know how much impact it had

You are forgetting that many universities (at least in the US) are sitting on enormous allocations of address space due to being early users of the technology from DARPA.

Coupled with "NAT isn't a firewall", assigning actual IPs to your end devices isn't all that silly if you happen to have a few million to spare.

As of a year ago, the major university I worked at still does this

I talked to the security person at a German university a few years ago and suggested that they put some restrictive firewall rules in place to increase security. He agreed with me in principle, but lamented the fact that the grey beards in the university's network administrator team follow a philosophy which says that networks need (or want?) to be free.

Yeah IPv4 addresses are not scarce at many (some?) big universities

IPv4 exhaustion isn't nearly the issue for universities that it is elsewhere. Most unis grabbed a large allocation early on, before it was an issue. Many have multiple class B allocations; quite a few have As.

Sadly, to my current understanding, my alma mater still does this. At the time it was extremely convenient - we had labs full of Solaris and Linux boxes, which could be remotely accessed from home without any issue. And I also seem to remember that basically nothing on IT's part had to be done during the Xbox 360 / Xbox Live craze, unlike my peers at other schools.

Even then, though, the downsides of consumer network security (mostly) relying on NAT were obvious. Common ports (80, 25, etc) were blocked inbound; the school's printers basically had to be on their own network, or get spammed all day.

> No reasonable network admin

You are speaking about academia. It's not mutually exclusive, but it's different then out there in the wild.

Most of the staff/admins in the universities that I've worked in have relatively modern sensibilities when it comes to this stuff. However, their constituents, particularly on the academic sides of the house ... less so. I've heard a modest firewall policy argued against on the grounds of Academic Freedom, let alone private IP addresses.

It is indeed a different environment.

There are so many devices on a campus network with nebulous ownership set up by clever but still-learning grad students and even undergrads, trying to secure the perimeter seems pointless. Someone internal will find a way to get hacked, or even themselves could be malicious (what are we going to do, background check every student?), so all the nodes on the network need to themselves be secured.

I can confirm that it is completely normal at German universities as of today. You can setup your own router at home if you so desire

Reply on news.ycombinator.com