674
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 24 Jun 2024
674 points (98.0% liked)
Programmer Humor
31214 readers
1206 users here now
Post funny things about programming here! (Or just rant about your favourite programming language.)
Rules:
- Posts must be relevant to programming, programmers, or computer science.
- No NSFW content.
- Jokes must be in good taste. No hate speech, bigotry, etc.
founded 4 years ago
MODERATORS
Actually, the Dutch government has mandated that all of its services need to be IPv6 compatible.
The longer you try to avoid IPv6, the harder you'll make your life when you eventually need to use it.
It's really not that hard, especially compared to the kludge of protocols that make up IPv4. I know change is scary and difficult, but if you can do IPv4, you can do IPv6.
My ISP doesn't support IPv6, now what?
It's really bullshit.
Really bullshit ISP indeed.
Hurricane Electric have a free tunnel broker that is super simple to set up if you really want to get on the bandwagon.
https://tunnelbroker.net/
Though honestly I'd say the benefits of setting it up aren't really worth the trouble unless you're keen.
Yeah it's a huge source of problems. If you are outside the US your IPv6 prefix is never gonna be correct in every GeoIP database, even if you send a request to have it corrected, so you sometimes get geoblocked and other sites just block you because it sometimes gets classified as VPN.
I agree. GeoIP was never a good idea, but here we are. Any ASN could be broken up and routed wherever (and changed) but it's still far too prevalent.
I did it by acquiring my own AS number and prefix, allowing me to set the geofeed, and announcing it via public BGP from a box in a data center. Took a few days for most things to pick it up the geolocation.
Sounds (labor and money) expensive.
What's the best way to spoof geoip on ipv6 ?
It's the same as IPv4 (tunnel) except as mentioned above its still hard to get an IP with the right label
Hurricane Electric will give you a bunch of free /64s and a /48 to play with, which you can set up for tunneling on any IPv4 connection that doesn't block ICMP traffic to HE. You can set this up within a range of routers, but if your router doesn't support it, you can also set it up on most PCs (Windows and Linux for sure, for macOS you'll need to check, but I'm sure it'll be fine).
You can also use IPv6 locally by simply advertising a subnet from the right range (an ULA), which is also useful for maintaining internal addressing if you do get normal IPv6 but your ISP is a bunch of dickwads that rotate the subnets they hand out (likely to happen if they make you pay extra for a static IP right now).
I did this until I moved to an ISP that cared about IPv6.
It was almost trivial even with the ISP's PoS router.
ipv6 in companies... ipv6 is not hard, but for internal networking no company (really) "needs" more than rfc1918 address space. thus any decision in that direction is always "less" needed than any bonus for (da)magement personnel is crucial for the whole companies survival...
for companies services to be reachable from outside/ipv6 mostly "only" the loadbalancers/revproxies etc need to be ipv6 ready but ... this i.e. also produces logs that possibly break decades old regexes that no one understands any more (as the good engineers left due to too many boni payed to damagement personnel) while other access/deny rules that could break or worse let through where they should block (remember that 192.168. could the local part of ipv6 IF sone genious used a matching mech that treats the dot "." as a wildcard as overpayed damagement personnel made them rush too fast), could be hidden "somewhere". altogether technical debt is a huge blocker for everything, especially company growth, and if no customer "demands" ipv6, then it stays on the damagement personnels list as "fulfilling the whishes of engineers to keep them happy" instead of on the always deleted "cleaning up technical debt caused by damagement personnel" list.
setting up firewalls for ipv6 is quite easy and if you go the finegrained "whitelisted or drop/block" approach from the beginning it might take a bit for ipv6 specials to be known to you, but the much bigger thing is IMHO the then current state of firewall rules. and who knows every existing rule? what rules should be removed already and must not be ported to ipv6? usually firewalls and their rules are a big mess due to ... again too many boni payed to damagement personnel, hindering the company from the needed steps forward...
ipv6 adoption is slow for reasons that are driving huge cars that in turn speed up other problems ;-|
I know several companies that, because of bad network planning, have ended up using public address ranges as internal IP addresses. IPv6 would've solved this easily, but I don't think the relevant network admins ever bothered to learn network configuration beyond 1990. But hey, who needs that arbitrary /8 anyway, right? Not like anyone's going to host DNS on 1.0.0.0/8!
i once had to look at a firefall appliance cluster, (discovered, it could not do any failover in its current state but somehow the decider was ok with that) but when looking at its logs, i discovered an rsh and rcp access from an ip address that belonged to a military organisation from a different continent. i had to make it a security incident. later the vendor said that this was only the cluster internal routing (over the dedicated crosslink), used for synchronisation (the thing that did not work) and was only used by a separate routing table only for clustersync and that could never be used for real traffic. but why not simply use an ip that you "own" by yourself and PTR it with a hint about what this ip is used for? instead of customers scratching their head why military still uses rcp and rsh. i guess because no company reads firewall logs anyway XD
someone elses ip? yes! becuase they'll never find out !!1!
i really appreciate that ipv6 has things like a dedicated documentation address range and that fc00:/7 is nicely short.
It also means you no longer need the kludge that is NAT. Full E2E connectivity is really nice -- though I've found some network admins dislike this idea because they're so used to thinking about it differently or (mistakenly) think it adds to their security.
NAT still has its place in obfuscating the internal network. Also, it's easier to think about firewall/routing when you segregate a network behind a router on its own subnet, IMO.
Given how large the address space is, it's super easy to segregate out your networks to the nth degree and apply proper firewall rules.
There's no reason your clients can't have public, world routeable IPs as well as security.
Security via obfuscation isn't security. It's a crutch.
There are a lot of valid reasons, other than security, for why you wouldn't want that though. You don't necessarily want to allow any client's activity to be traceable on an individual level, nor do you want to allow people to do things like count the number of clients at a particular location. Information like that is just unnecessary to expose, even if hiding it doesn't make anything more secure per se.
Well good news. Because ipv6 has a thing called privacy extensions which has been switched on by default on every device I've used.
That generates random ipv6 addresses (which are regularly rotated) that are used for outgoing connections. Your router should block incoming connections to those ips but the os will too. The proper permanent ip address isn't used for outgoing connections and the address space allocated to each user makes a brute force scan more prohibitive than scanning the whole Ipv4 Internet.
So I'm going to say that using routable ipv6 addresses with privacy extensions is more secure than a single Ipv4 Nat address with dnat.
Obfuscation is not security, and not having IPv6 causes other issues. Including some security/privacy ones.
There is no problem having a border firewall in IPv6. NAT does not help that situation at all.
Yes, of course. But saying trite things like that doesn't get around the idea that giving out a map of the internal network by default isn't the best policy.
You don't need to give up IPV6 to have NAT though.
But why bother? "Let's make my network slower and more complicated so it works like a hack on the old thing".
That's what temporary privacy addresses are for. Clients can just keep generating new addresses in your /64, which is it's own subnet.
I think you'll find some ISPs will be reluctant to let go of CGNAT - they're doing quite nicely by charging extra for 'commercial' services where it's not in the way.
Fortunately, many of us know about cloudflare tunnelling and other services, so NAT really isn't a problem to self hosters and even SMEs any more.
Why do you say NAT doesn't make a network more secure?
This article is biased to selling you more F5 equipment but is a reasonable summary:
https://www.f5.com/resources/white-papers/the-myth-of-network-address-translation-as-security
Long story short is that NAT is eggshell security and you should be relying on actual firewall rules (I wouldn't recommend F5) instead of the implicit but not very good protections of NAT.
Unless you've gone out of your way to disable the H.263 NAT ALG, NAT actually allows websites and other services to open either random ports on your machine (if using business firewalls) or ports on any device on your network (many consumer routers).
If your router allows you to disable SIP ALG and H.263 ALG, you should. If it doesn't, well, maybe they've been patched? If you've applied a kernel firmware update to your router the last 1-2 years you may be safe (though not many vendors will bother updating the kernel when updating their routers). You'll lose access to SIP phones and some video calling services over IPv4, but at least some Javascript on a random blog won't be able to hack your printer.
This wouldn't work with IPv6, as these two protocols just work with IPv6 (and IPv4, as it was designed). ALGs are hacks around protocols, rewriting packets to make all of the problems NAT causes go away.
More info on this here: https://www.armis.com/research/nat-slipstreaming-v2-0/
Thank you
It wasn't designed for a security purpose in the first place. So turn the question around: why does NAT make a network more secure at all?
The answer is that it doesn't. Firewalls work fine without NAT. Better, in fact, because NAT itself is a complication firewalls have to deal with, and complications are the enemy of security. The benefits of obfuscating hosts behind the firewall is speculative and doesn't outweigh other benefits of end to end addressing.
The main benefit of a NAT is that by default it prevents all external access to the hosts inside the network. Any port you have open is not accessible unless explicitly forwarded.
This has a lot of security benefits. Regardless, everything you said is sounds true to me.
Not really, though. It was never designed as a security boundary. You can "open" a UDP port by sending UDP packets to another host, and then that host can send UDP packets to you, for instance. Usually the IP addresses of the two hosts are exchanged through a third party, and that's how STUN/TURN works in essence. Without this, you'd need to port forward every UDP connection manually, both incoming and outgoing.
NAT only protects you when you have hosts that only communicate along preset routes, but then a normal firewall will also work fine. It's not like having a public IP means any traffic will actually go through, every modern consumer router has a standard deny all firewall. At best, it sort of hides what devices are sending the traffic.
Meanwhile, NAT has flaws breaking traffic (causing NAT slipstreaming risks, like I linked elsewhere). It also has companies like Nintendo instruct you to forward every single port to their device if you have connectivity issues. If that forward is not towards a MAC address, and your PC gets the IP your Nintendo Switch used to have, you've just disabled your firewall to play Animal Crossing.
If you want to, you can do NAT on IPv6. Every operating system supports it, even if it's a stupid idea.
I still have to initiate the outgoing UDP. Are you talking about the specific case where any software running on my host can initiate it without me requesting?
Edit: apparently NAT is full of security bugs
In the instance of UDP handshakes yes, you need local software to initiate the connection on one of your devices somewhere (I highly doubt that your home router verifies the origin of those packets, so a hacked printer or IoT crap can open ports to your desktop no problem). Other problems are harder to solve.
NAT is great at what it does, but it does not guarantee security. It blocks straightforward attacks, but brings in tons of edge cases and complexity that sophisticated attacks can abuse. At the same time, the same security can be achieved using IPv6 and a firewall without all the complexity.
It's a neat workaround that means you don't need to mess with subnetting and routing tables when you do stuff like run virtual machines and when your ISP doesn't offer IPv6. It was designed so larger businesses with 10 machines could access the internet without spending a lot of money on a /30, not to replace firewalls, and it still works well for what it's designed to do.
Understood. CG-NAT has been so annoying, I would love for IPv6 to completely replace v4 ASAP
You can get exactly the same benefit by blocking non-established/non-related connections on your firewall. NAT does nothing to help security.
Edit: BTW--every time I see this response of "NAT can prevent external access", I severely question the poster's networking knowledge. Like to the level where I wonder how you manage to config a home router correctly. Or maybe it's the way home routers present the interface that leads people to believe the two functions are intertwined when they aren't.
I didn't mean prevent, just makes it harder by default. You can still open connections from within the NAT
Edit: I do admit to failing at accessing my IPv6 PC from my IPv6 phone
Edit2: apparently NAT is full of security bugs
If your home router blocked incoming connections on IPv4 by default now, then it's likely to continue doing so for IPv6. At least, I would hope so. The manufacturer did a bad job if otherwise.
I figure the mobile carrier was blocking incoming connections to my phone. This was a couple of years ago, things might have changed since then.
Yeah, no. If remote hosts could not send traffic to hosts behind NAT almost nothing would work.
The hacks employed to make NAT work make security worse, not better.
You're talking about NAT traversal? We do have control over which we apps we run though?
Edit: apparently NAT is full of bugs
I had network speed issues and the solution was literally to disable ipv6... Fiber 1gbit network still had issues. https://www.reddit.com/r/youtube/comments/owbjdl/anyone_else_getting_buffering_when_using_ipv6/
This has nothing to do with IPv6 itself. I pull in 4K YouTube videos over IPv6 just fine. My IPv6 routes actually have lower latency than my IPv4 routes, funnily enough.
Sounds like your ISP has broken their IPv6 routes, or your modem is outdated and can't do IPv6 hardware acceleration. Disabling IPv6 to downgrade your connection will work as a workaround, at least until your ISP switches over to something using IPv6 as the connection backbone (like DS-Lite, which would allow your ISP to significantly reduce their IPv4 space and make a quick profit selling off their allocations, which is unfortunately becoming more and more common).
Your ISP or modem manufacturer needs to fix the actual problem here.
4k was fine until I tried watching 8k 60fps HDR on YouTube, disabling IPv6 fixed it. It was weird because speedtest and torrents were completely fine using full bandwidth, just YouTube needed me to disable ipv6
Weird. Ipv6 and YouTube stats for nerds shows between 140mbit and 600mbit depending on what's being watched and the time of day.
Is it possible your isp has problems with their ipv6 setup?
IPv6 overheads should only have a marginal impact on max speeds.
I’ve heard of all sorts of issues with my fiber ISP (Verizon Fios) rolling out IPv6. It’s been years that they’ve been slowly rolling it out for testing in a few places. There’s virtually no useful documentation on their website about it. And it’s still not available where I am.