3 ms·

My "main issue" with it is that if people are used to being behind NAT, they now have to be a bit more careful about securing their computers (firewall etc.) be

My "main issue" with it is that if people are used to being behind NAT, they now have to be a bit more careful about securing their computers (firewall etc.) because every computer now is publicly accessible. Most routers do not even seem to have an IPv6 firewall.

nsbq71 8y ago
Also some implementations (including Windows) [0] expose the MAC address of your device to the Internet, creating a huge privacy problem. IPv6 is a mess. [0] https://social.technet.microsoft.com/Forums/windows/en-US/57925467-2b8d-4c2d-b1f2-b0402581a30e/how-does-one-get-the-system-to-actually-use-the-ipv6-temporary-addresses?forum=win10itpronetworking https://social.technet.microsoft.com/Forums/windows/en-US/57...
arca_vorago 8y ago
One of these days yall are going to see it my way... in which I think ipv6nat is important to use despite everything you hear about ipv6nat saying it should never be used, usually by people theorycrafting instead of being responsible for actual systems. (Cue the "but nat was never very secure" etc comments.)
api 8y ago
Ultimately we do need to secure our endpoint devices. They need to be secure by default. NAT and firewalls let us get away with insecure broken OSes and services for a while, but not forever, and they create the "soft underbelly problem" where once someone manages to hop your firewall everything is vulnerable.
zAy0LfpBZLC8mAC 8y ago
NAT does not provide access protection. NAT only hides the lack of access protection when it isn't there. A stateful firewall provides access protection, and that works with both IPv4 and IPv6.
randomdestructn 8y ago
Same. And its only really an issue for me because around here the home/SOHO IPv6 rollout is transparent to clients. So people who have been trusting NAT to be a firewall wake up one day to their network being directly routable, and are none the wiser.
toast0 8y ago
The 'residential gateway' for my attached fiber connection doesn't allow incoming syns for the ipv6 addresses it hands out and I couldn't even find a way to tell it to let me actually use the internet as intended, other than bypassing it (which works fine). Most endpoints these days don't have much if anything listening by default though. The reality is that even trusted local networks are hostile networks, and vendors have responded to that.

nsbq71 8y ago

Also some implementations (including Windows) [0] expose the MAC address of your device to the Internet, creating a huge privacy problem. IPv6 is a mess. [0] https://social.technet.microsoft.com/Forums/windows/en-US/57925467-2b8d-4c2d-b1f2-b0402581a30e/how-does-one-get-the-system-to-actually-use-the-ipv6-temporary-addresses?forum=win10itpronetworking https://social.technet.microsoft.com/Forums/windows/en-US/57...

arca_vorago 8y ago

One of these days yall are going to see it my way... in which I think ipv6nat is important to use despite everything you hear about ipv6nat saying it should never be used, usually by people theorycrafting instead of being responsible for actual systems. (Cue the "but nat was never very secure" etc comments.)

api 8y ago

Ultimately we do need to secure our endpoint devices. They need to be secure by default. NAT and firewalls let us get away with insecure broken OSes and services for a while, but not forever, and they create the "soft underbelly problem" where once someone manages to hop your firewall everything is vulnerable.

zAy0LfpBZLC8mAC 8y ago

NAT does not provide access protection. NAT only hides the lack of access protection when it isn't there. A stateful firewall provides access protection, and that works with both IPv4 and IPv6.

randomdestructn 8y ago

Same. And its only really an issue for me because around here the home/SOHO IPv6 rollout is transparent to clients. So people who have been trusting NAT to be a firewall wake up one day to their network being directly routable, and are none the wiser.

toast0 8y ago

The 'residential gateway' for my attached fiber connection doesn't allow incoming syns for the ipv6 addresses it hands out and I couldn't even find a way to tell it to let me actually use the internet as intended, other than bypassing it (which works fine). Most endpoints these days don't have much if anything listening by default though. The reality is that even trusted local networks are hostile networks, and vendors have responded to that.