4 ms·
What is the opinion on IPv6 on this kind of problem? I mean, IPv4 being often behind a NAT, I guess a LOT of devices that would be exposed are protected by a NA
by kuon 9y ago
What is the opinion on IPv6 on this kind of problem? I mean, IPv4 being often behind a NAT, I guess a LOT of devices that would be exposed are protected by a NAT.
But in an IPv6 world where NAT is no longer required, don't you fear that a lot of device might get exposed?
I know it will be impossible to scan the whole address space, but I am sure other means of discovering IPs will arise.
- w8rbt 9y agoYou can use DNS and NTP to discover IPv6 nodes.
- e12e 9y agoHow does NTP fit? You mean listening for packets, or some kind of announce/resource broadcast that I'm not aware of?
- skgoa 9y agoYeah, that's one of the known issues with IPv6. You can still use a NAT or better yet a firewall that blocks all direct traffic between the internet and internal nodes. You can also do things like assigning nodes a new IPv6 adress every 24h.
- zAy0LfpBZLC8mAC 9y agoNAT does not prevent inbound connections. A stateful packet filter does. Stateful packet filters work with both IPv4 and IPv6.
- kuon 9y agoI know, but I meant how NAT with IPv4 was deployed by ISP (at least in europe), which is a single IP with all inbound connection blocked. I guess it will depend on how ISP will deploy IPv6, but where I saw it deployed, the ISP did not provide NAT by default and all allocated IP were routable and inbound traffic was not blocked.
- zAy0LfpBZLC8mAC 9y ago> I know, but I meant how NAT with IPv4 was deployed by ISP (at least in europe), which is a single IP with all inbound connection blocked. The single IP does not prevent inbound connections. The stateful packetfilter does. This has nothing to do with NAT. Also, NAT is not usually done by the ISP, but by the customer's router.
- e12e 9y agoTo be fair, the is might do carrier grade NAT, but then usually no/very limited filtering...
- zAy0LfpBZLC8mAC 9y agoWell, but then, you arguable don't have a single, IP, but rather none at all. Also, as you usually still have only one (non-)IP, the CPE still does NAT as well. And in any case, NAT does not prevent inbound connections, not even CGN. CGN might prevent inbound connections from the public internet, but your ISP can still connect to your internal network if you don't have a stateful filter on your side.
- kuon 9y agoMost of the time the customer router is controlled by the ISP. And I don't see why you are so pedantic on this, the point is about how NAT is generally deployed, and for consumers, this is with a single IP, stateful firewall and UPnP for port forwarding. And this might change with IPv6.
- zAy0LfpBZLC8mAC 9y agoNo, that is how IP(v4) is commonly deployed: With a single IP, NAT, UPnP for port forwarding, and a stateful firewall. Yes, that could change with IPv6. But it still doesn't have anything to do with NAT. Just because stateful firewalling happens on the same device as NAT, doesn't somehow make it a property of NAT. There also usually is a web interface on the same device. Now, with IPv6 that could change as well. Does that mean that web interfaces are a property of NAT? Or that it would be sensible to say "NAT is commonly deployed with a web interface"?