6 ms·

Except NAT is dead simple, and requires basically zero configuration of the CPE from the end-user perspective. Yeah, it complicates (though seldom completely br

Except NAT is dead simple, and requires basically zero configuration of the CPE from the end-user perspective. Yeah, it complicates (though seldom completely breaks) a host of important applications, but it's hard to think you could replace it with a firewall with an off the shelf configuration and have it work any better.

ktRolster 9y ago
It's not dead simple, it just seems that way because the router already comes configured for it. If you had a router already configured with a default firewall, that would seem dead simple, too.
- hueving 9y ago
  If it comes pre-configured with the same behavior as NAT (no unsolicited ingress), what does that really solve over using NAT?
  - Avernar 9y ago
    When you get multiple devices that require the same inbound ports (game consoles are a good example) you can open the same port for each device.
Johnny555 9y ago
And NAT is required for networks that are behind too few IPv4 IP's. With IPv6, users can put their devices out on the wild-west open internet without needing any kind of NAT or firewall for protection. The large number of open access points in the wild points out the danger here -- most consumers know nothing about network security and will set up their home network with dozens of IoT devices all on the public internet behind their ISP's non-firewalling router because they can, and everything works.
- mmagin 9y ago
  It is unlikely that ISPs are going to provide CPE that doesn't firewall incoming connections by default, even if it issues devices on the LAN real public IPv6 addresses.
  - Johnny555 9y ago
    About as unlikely as ISP's providing Wifi routers that default to open with no WPA password as used to be common? They'll do whatever makes support easiest until they are forced to do otherwise by regulation or bad press.
    - mmagin 9y ago
      The first (2010-vintage Apple Airport Extreme) and second (2017-vintage TP-Link something something) I'd done IPv6 with behaved this way by default if you enabled IPv6. I don't see why Comcast or AT&T would likely do worse. Sure they could, but this is not the likely scenario.
      - Johnny555 9y ago
        Then I imagine you don't have much experience with Comcast or AT&T if you don't see why they'd do worse than Apple.
alethiophile 9y ago
The default configuration for many firewalls (software, at least) approximates "allow all outgoing connections but no incoming". Assuming all your connections pass through the same box (which they usually will, for a home network), there's no reason why it shouldn't have such a firewall even if it's otherwise a router that doesn't do NAT. Denying the ISPs trivial inspection into the structure of home networks, OTOH, is a major benefit and maybe a concrete downside to adopting IPv6 locally.

ktRolster 9y ago

It's not dead simple, it just seems that way because the router already comes configured for it. If you had a router already configured with a default firewall, that would seem dead simple, too.

hueving 9y ago
If it comes pre-configured with the same behavior as NAT (no unsolicited ingress), what does that really solve over using NAT?
- Avernar 9y ago
  When you get multiple devices that require the same inbound ports (game consoles are a good example) you can open the same port for each device.

Johnny555 9y ago

And NAT is required for networks that are behind too few IPv4 IP's. With IPv6, users can put their devices out on the wild-west open internet without needing any kind of NAT or firewall for protection. The large number of open access points in the wild points out the danger here -- most consumers know nothing about network security and will set up their home network with dozens of IoT devices all on the public internet behind their ISP's non-firewalling router because they can, and everything works.

mmagin 9y ago
It is unlikely that ISPs are going to provide CPE that doesn't firewall incoming connections by default, even if it issues devices on the LAN real public IPv6 addresses.
- Johnny555 9y ago
  About as unlikely as ISP's providing Wifi routers that default to open with no WPA password as used to be common? They'll do whatever makes support easiest until they are forced to do otherwise by regulation or bad press.
  - mmagin 9y ago
    The first (2010-vintage Apple Airport Extreme) and second (2017-vintage TP-Link something something) I'd done IPv6 with behaved this way by default if you enabled IPv6. I don't see why Comcast or AT&T would likely do worse. Sure they could, but this is not the likely scenario.
    - Johnny555 9y ago
      Then I imagine you don't have much experience with Comcast or AT&T if you don't see why they'd do worse than Apple.

alethiophile 9y ago

The default configuration for many firewalls (software, at least) approximates "allow all outgoing connections but no incoming". Assuming all your connections pass through the same box (which they usually will, for a home network), there's no reason why it shouldn't have such a firewall even if it's otherwise a router that doesn't do NAT. Denying the ISPs trivial inspection into the structure of home networks, OTOH, is a major benefit and maybe a concrete downside to adopting IPv6 locally.