6 ms·

Agreed. IPv6 has been a disaster whenever I've experienced it. Here are some shocks I've received: - there is concern when you browse the web with a IPv6 addre

by tostitos1979 11y ago

Agreed. IPv6 has been a disaster whenever I've experienced it. Here are some shocks I've received: - there is concern when you browse the web with a IPv6 address that you create a target for attackers (by revealing your address). Solution ... shadow IP addresses! When I saw this on my Mac, I was shocked! - IPv6 to IPv4 NAT exists but is stateful. WTF? This significantly increases the cost and lowers the ability to scale. A high performance NAT solution would have been the first thing I would have designed (for interop purposes)

dspillett 11y ago
> (by revealing your address) How is this any different to IPv4? An incoming default deny rule on your firewall offers the same protection as the "accidental" protection that NAT provides, and you can translate/proxy/VPN/whatever-else IPv6 addresses/connections in all the same ways you can with IPv4 in order to disguise the source IPv6 address if you really have a need to. Heck, if you are worried about security having a /64 allocated means that if you aren't providing incoming services you jump around a huge range if you want to so you don't need to be at the same address now as you were an hour ago (unless you have active TCP streams or similar that have been running that long), and even without moving around if you pick your address within the /64 arbitrarily you aren't going to be found by a port scanner in any amount of time that would make scanning a practical option. > IPv6 to IPv4 NAT exists but is stateful. Isn't IPv4 NAT stateful when translating potentially many source addresses? Otherwise how do you reverse the translation when response packets arrive? A one-to-one mapping shouldn't need to be stateful, but where that is useful most people go with being dual-stacked instead.
- dorfsmay 11y ago
  I think what the OP means here is that by default some stack use to use the numbers from the MAC address for the last part of the ipv6, creating privacy concerns. Most stack these will by default, or can be configured to, get a different random ipv6 address (within your allocated range) every time they get one.
feld 11y ago
Traditional NAT implies state. If you aren't keeping track of state you can't traverse the NAT. The state is the NAT table. Now, there are some "NAT" implementations that don't keep state but they for very specific scenarios. You can't port forward, for example. You can map 1:1 IPv4 to IPv6 though, but why do that when you can give native v6 the whole way?
cm2187 11y ago
> you create a target for attackers (by revealing your address) Are you referring to using the MAC address in the IP? https://en.wikipedia.org/wiki/IPv6_address#Modified_EUI-64 https://en.wikipedia.org/wiki/IPv6_address#Modified_EUI-64
feld 11y ago
> IPv6 to IPv4 NAT exists but is stateful. Actually... RFC6145 This document describes the Stateless IP/ICMP Translation Algorithm (SIIT), which translates between IPv4 and IPv6 packet headers (including ICMP headers). This document obsoletes RFC 2765.

dspillett 11y ago

> (by revealing your address) How is this any different to IPv4? An incoming default deny rule on your firewall offers the same protection as the "accidental" protection that NAT provides, and you can translate/proxy/VPN/whatever-else IPv6 addresses/connections in all the same ways you can with IPv4 in order to disguise the source IPv6 address if you really have a need to. Heck, if you are worried about security having a /64 allocated means that if you aren't providing incoming services you jump around a huge range if you want to so you don't need to be at the same address now as you were an hour ago (unless you have active TCP streams or similar that have been running that long), and even without moving around if you pick your address within the /64 arbitrarily you aren't going to be found by a port scanner in any amount of time that would make scanning a practical option. > IPv6 to IPv4 NAT exists but is stateful. Isn't IPv4 NAT stateful when translating potentially many source addresses? Otherwise how do you reverse the translation when response packets arrive? A one-to-one mapping shouldn't need to be stateful, but where that is useful most people go with being dual-stacked instead.

dorfsmay 11y ago
I think what the OP means here is that by default some stack use to use the numbers from the MAC address for the last part of the ipv6, creating privacy concerns. Most stack these will by default, or can be configured to, get a different random ipv6 address (within your allocated range) every time they get one.

feld 11y ago

Traditional NAT implies state. If you aren't keeping track of state you can't traverse the NAT. The state is the NAT table. Now, there are some "NAT" implementations that don't keep state but they for very specific scenarios. You can't port forward, for example. You can map 1:1 IPv4 to IPv6 though, but why do that when you can give native v6 the whole way?

cm2187 11y ago

> you create a target for attackers (by revealing your address) Are you referring to using the MAC address in the IP? https://en.wikipedia.org/wiki/IPv6_address#Modified_EUI-64 https://en.wikipedia.org/wiki/IPv6_address#Modified_EUI-64

feld 11y ago

> IPv6 to IPv4 NAT exists but is stateful. Actually... RFC6145 This document describes the Stateless IP/ICMP Translation Algorithm (SIIT), which translates between IPv4 and IPv6 packet headers (including ICMP headers). This document obsoletes RFC 2765.