5 ms·
I now receive a block of IPv6 from Comcast. I allow the router to assign them to devices on the network, but I admit that I am somewhat worried that my local P
by metalliqaz 9y ago
I now receive a block of IPv6 from Comcast. I allow the router to assign them to devices on the network, but I admit that I am somewhat worried that my local PC is no longer isolated from the Internet by a private IP.
- lwhalen 9y agoYou want to set up an 'egress only' v6 gateway for your /64s (or however you carve up your netblock). That is going to be the closest analogue to behind-a-NAT-like behavior.
- metalliqaz 9y agoThanks I'll look into it with pfSense.
- bArray 9y agoI think whilst it's nice to have that barrier, it's prevention rather than cure anyway. There's no substitute for secure devices :)
- 2bitencryption 9y agowhat's more secure than a device you cannot possibly reach? I'll take an insecure device isolated at the bottom of the ocean in a titanium block over a probably-secure device that is publicly addressable any day.
- Spivak 9y agoYour appliance 'router' can (and probably does) run a firewall to give you that kind of control. NAT never really gave you that.
- linkregister 9y agoWhich devices are secure?
- deleted 9y ago[deleted]
- JetSpiegel 9y agoYour router has a firewall, external computers can't just send packets to the internal addresses. NAT is not a firewall.
- mirimir 9y agoSo IPv6 firewall rules are common now for consumer routers?
- Spivak 9y agoFirst, nothing is common for consumer IPv6 routers, they're practically non-existent. Second, you get the same security benefits by having a firewall that denies outbound connections not already established.
- sparewalking 9y agoI bought an IPv6 router 3-4 years ago.
- voltagex_ 9y agoMost people don't buy routers, they are given them by their ISPs. My parents switched ISP at the start of the year and were given a 5 year old modem/router.
- Spivak 9y agoYou're also on Hacker News. They have been available for a long time, but they're firmly a techie/early adopter product.
- Symbiote 9y agoIn many countries the ISP supplies the router. I've had IPv6 capable routers for years and years in Britain, but it's only in the last 2 years or so that the IPv6 address has been assigned by the ISP.
- 9y ago
- mavendependency 9y agoThis is the case for ipv6 on mobile data by default. Would using a usb modem result in getting affected by smb exploits or something of the sort?
- belorn 9y agoBe sure that you are really isolated if relying on it for protection. Its only as secure as the least secure node inside the bubble, and there can be quite a dangerous in large networks like in a company or campus. It would not surprise me if a number of WannaCry victims was behind nat and got infected by a machine on the same local network.
- djsumdog 9y agoI was at a company that made a mistake like this during their IPv6 rollout. The firewalls are different an individual, and initially they only had iptables rules on their BGR and an empty ip6tables set.