8 ms·

Perhaps I just misunderstand IPv6 but I prefer IPv4 with NAT and temporarily leased public router address for privacy and security reasons. AFAIK IPv6 means eve

Perhaps I just misunderstand IPv6 but I prefer IPv4 with NAT and temporarily leased public router address for privacy and security reasons. AFAIK IPv6 means every device gets assigned a stable unique address everybody can identify and reach it by. And I have never seen a SOHO WiFi router that would support IPv6 anyway (perhaps latest fancy expensive ones do).

pixl97 8y ago
Windows uses ipv6 temporary addresses by default. NAT isnt security, and lot of implementations are faulty, so dont depend on it for security.
- geofft 8y ago
  NAT absolutely is security. It prevents naming a resource that an attacker shouldn't have access to, which is the fundamental principle behind many successful security schemes: capability models, containers / virtualization, MMUs, etc. Sure, there are implementation flaws (as there have been in other such schemes), and sure, just clicking a NAT button and walking away doesn't get you security any more than just clicking a capability or virtualize or MMU button gets you security. But it's a powerful and solid building block, and the Internet is a better and safer place because of widespread use of NAT.
  - Dagger2 8y ago
    It doesn't actually do that though. If you give a machine an IP of X, and then you turn on NAT on the upstream router so that its outbound connections appear to come from Y instead, the machine is still called X. NAT won't prevent someone from sending a packet to X, and it won't cause the router to somehow drop the packet when it sees it either. That stuff is handled by firewalls, not by NAT.
    - geofft 8y ago
      On Linux at least, NAT isn't handled by routing, it's handled by a separate layer (the firewall layer, in fact). I think that's the obvious way of implementing NAT: you're not routing at all. On the public side you're not accepting any packets not addressed to you. On the private side you're converting all packets, so you're not doing normal packet forwarding. When packets arrive on the public side, you have to translate addresses sent to the router to convert Y to X, so you might as well drop packets that aren't sent to a valid target. I'd expect you have to go out of your way to get NAT "wrong," possibly by trying to stuff the functionality on top of actual routing. Home routers generally don't need to do actual routing ever (and if they do, they're in a non-NAT mode) so it would be surprising for them to get this wrong.
      - Dagger2 8y ago
        It's handled by a separate layer, yes, but that doesn't mean that the routing layer magically disappears. It's still there, and in fact it's still required to forward every single packet that goes through the router. NAT is just simply an extra layer on top that sometimes changes the addresses in the src or dst fields of some packets. Dropping packets not sent to a valid target is called firewalling. NAT doesn't decide what's valid and what isn't; all it does is detect packets which correlate to known connections and rewrite some of the headers on those packets. Home routers, like all routers, do a lot of routing. They sit between two networks and they forward packets between them, which is pretty much the definition of a router. Having some header rewriting going on doesn't change that.
Kranar 8y ago
IPv6 allows for so many IP addresses that you could give yourself a new IP address every minute and never worry about running out.
- vnw 8y ago
  Every time I see a conversation about IPv6, this argument comes up. Is "it's got a gorillion IP addresses" the only redeemable quality IPv6 has?
  - yjftsjthsd-h 8y ago
    It's less a redeeming quality and more the entire reason why we bothered to switch to a new system. So yes, that is the point.
    - vnw 8y ago
      Then, given that CG-NAT solutions have proven to work well and they don't bother most end users, it's no wonder the transition to IPv6 has stopped.
      - tambre 8y ago
        > it's no wonder the transition to IPv6 has stopped Where are you getting that from? Looking at public IPv6 statistics from big companies shows that it's going up. Google's shows a 4.5% increase in IPv6 of total traffic during the past year[0]. Facebook's shows a 6% increase and at 55% for the US [1]. Meanwhile Mexico went from 5% IPv6 to 25% this year [2]. [0]: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html [1]: https://www.facebook.com/ipv6/?tab=ipv6 https://www.facebook.com/ipv6/?tab=ipv6 [2]: https://www.vyncke.org/ipv6status/project.php?metric=p&timeforward=365&timebackward=365&country=mx https://www.vyncke.org/ipv6status/project.php?metric=p&timef...
        zzzcpan 8y ago
        These statistics are meaningless propaganda. What you should be interested in is the velocity of IPv6 adoption growth among ISPs and countries where adoption stopped all together, to know what to expect from actual adoption in coming years. (it's basically a failure btw)
apearson 8y ago
I'm not sure what routers you've used or seen but every home router I've touched in the last 5 to 10 years has had the option to enable IPv6 in its settings. Also, IPv6 has a unique address that everybody can reach but most if not all routers have an IPv6 firewall that gives at least if not more security than NAT provides.
- AnIdiotOnTheNet 8y ago
  > IPv6 firewall that gives at least if not more security than NAT provides That's just not true. NAT and firewall both achieve what little security they provide through simple blocking of packets based on state information. Firewalls generally provide more robust state information, but NAT is what lets you redirect sockets. They work together.
  - Dagger2 8y ago
    Except NAT gives no security, because NAT doesn't block packets. If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor -- it's processed as normal like any other packet would be, and in the absence of a firewall (which is logically separate, even if often implemented in the same software stack) it'll be routed to whatever the destination in the packet header is.
    - zamadatix 8y ago
      "If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor" Yes it is, it's the same scenario as if there was no route to the destination just at a higher abstraction layer. Think about it this way: a packet just hit the NAT IP from the internet, the packet has hit it's destination. There was no NAT table match for the packet so it was not rewritten. Where would the packet be forwarded to if not the bit bucket?
      - Dagger2 8y ago
        It's not the same scenario at all. If there's no route to the destination then the packet will necessarily be dropped, but with no matching NAT state table entry for a packet all that happens is that the dst header field is left alone. There will still be an IP in the dst header field! The router will still deliver the packet to that IP, subject to all the usual constraints (e.g. it needs a valid route etc). NAT won't stop that; only a firewall will.
deleted 8y ago
[deleted]
geofft 8y ago
This is entirely legitimate. IPv6 is actively confusing in what "enabling" means - is there a firewall, and under what conditions are ports opened? Is there mandatory use of privacy addresses from clients, and is there any protection from clients who generate SLAAC addresses from their MAC address? Is there a NAT? (NAT66 is a thing, but very few people implement it.) The mental model of IPv4 NAT is much more straightforward and I would strongly recommend that home users prefer that.

pixl97 8y ago

Windows uses ipv6 temporary addresses by default. NAT isnt security, and lot of implementations are faulty, so dont depend on it for security.

geofft 8y ago
NAT absolutely is security. It prevents naming a resource that an attacker shouldn't have access to, which is the fundamental principle behind many successful security schemes: capability models, containers / virtualization, MMUs, etc. Sure, there are implementation flaws (as there have been in other such schemes), and sure, just clicking a NAT button and walking away doesn't get you security any more than just clicking a capability or virtualize or MMU button gets you security. But it's a powerful and solid building block, and the Internet is a better and safer place because of widespread use of NAT.
- Dagger2 8y ago
  It doesn't actually do that though. If you give a machine an IP of X, and then you turn on NAT on the upstream router so that its outbound connections appear to come from Y instead, the machine is still called X. NAT won't prevent someone from sending a packet to X, and it won't cause the router to somehow drop the packet when it sees it either. That stuff is handled by firewalls, not by NAT.
  - geofft 8y ago
    On Linux at least, NAT isn't handled by routing, it's handled by a separate layer (the firewall layer, in fact). I think that's the obvious way of implementing NAT: you're not routing at all. On the public side you're not accepting any packets not addressed to you. On the private side you're converting all packets, so you're not doing normal packet forwarding. When packets arrive on the public side, you have to translate addresses sent to the router to convert Y to X, so you might as well drop packets that aren't sent to a valid target. I'd expect you have to go out of your way to get NAT "wrong," possibly by trying to stuff the functionality on top of actual routing. Home routers generally don't need to do actual routing ever (and if they do, they're in a non-NAT mode) so it would be surprising for them to get this wrong.
    - Dagger2 8y ago
      It's handled by a separate layer, yes, but that doesn't mean that the routing layer magically disappears. It's still there, and in fact it's still required to forward every single packet that goes through the router. NAT is just simply an extra layer on top that sometimes changes the addresses in the src or dst fields of some packets. Dropping packets not sent to a valid target is called firewalling. NAT doesn't decide what's valid and what isn't; all it does is detect packets which correlate to known connections and rewrite some of the headers on those packets. Home routers, like all routers, do a lot of routing. They sit between two networks and they forward packets between them, which is pretty much the definition of a router. Having some header rewriting going on doesn't change that.

Kranar 8y ago

IPv6 allows for so many IP addresses that you could give yourself a new IP address every minute and never worry about running out.

vnw 8y ago
Every time I see a conversation about IPv6, this argument comes up. Is "it's got a gorillion IP addresses" the only redeemable quality IPv6 has?
- yjftsjthsd-h 8y ago
  It's less a redeeming quality and more the entire reason why we bothered to switch to a new system. So yes, that is the point.
  - vnw 8y ago
    Then, given that CG-NAT solutions have proven to work well and they don't bother most end users, it's no wonder the transition to IPv6 has stopped.
    - tambre 8y ago
      > it's no wonder the transition to IPv6 has stopped Where are you getting that from? Looking at public IPv6 statistics from big companies shows that it's going up. Google's shows a 4.5% increase in IPv6 of total traffic during the past year[0]. Facebook's shows a 6% increase and at 55% for the US [1]. Meanwhile Mexico went from 5% IPv6 to 25% this year [2]. [0]: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html [1]: https://www.facebook.com/ipv6/?tab=ipv6 https://www.facebook.com/ipv6/?tab=ipv6 [2]: https://www.vyncke.org/ipv6status/project.php?metric=p&timeforward=365&timebackward=365&country=mx https://www.vyncke.org/ipv6status/project.php?metric=p&timef...
      - zzzcpan 8y ago
        These statistics are meaningless propaganda. What you should be interested in is the velocity of IPv6 adoption growth among ISPs and countries where adoption stopped all together, to know what to expect from actual adoption in coming years. (it's basically a failure btw)

apearson 8y ago

I'm not sure what routers you've used or seen but every home router I've touched in the last 5 to 10 years has had the option to enable IPv6 in its settings. Also, IPv6 has a unique address that everybody can reach but most if not all routers have an IPv6 firewall that gives at least if not more security than NAT provides.

AnIdiotOnTheNet 8y ago
> IPv6 firewall that gives at least if not more security than NAT provides That's just not true. NAT and firewall both achieve what little security they provide through simple blocking of packets based on state information. Firewalls generally provide more robust state information, but NAT is what lets you redirect sockets. They work together.
- Dagger2 8y ago
  Except NAT gives no security, because NAT doesn't block packets. If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor -- it's processed as normal like any other packet would be, and in the absence of a firewall (which is logically separate, even if often implemented in the same software stack) it'll be routed to whatever the destination in the packet header is.
  - zamadatix 8y ago
    "If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor" Yes it is, it's the same scenario as if there was no route to the destination just at a higher abstraction layer. Think about it this way: a packet just hit the NAT IP from the internet, the packet has hit it's destination. There was no NAT table match for the packet so it was not rewritten. Where would the packet be forwarded to if not the bit bucket?
    - Dagger2 8y ago
      It's not the same scenario at all. If there's no route to the destination then the packet will necessarily be dropped, but with no matching NAT state table entry for a packet all that happens is that the dst header field is left alone. There will still be an IP in the dst header field! The router will still deliver the packet to that IP, subject to all the usual constraints (e.g. it needs a valid route etc). NAT won't stop that; only a firewall will.

deleted 8y ago

[deleted]

geofft 8y ago

This is entirely legitimate. IPv6 is actively confusing in what "enabling" means - is there a firewall, and under what conditions are ports opened? Is there mandatory use of privacy addresses from clients, and is there any protection from clients who generate SLAAC addresses from their MAC address? Is there a NAT? (NAT66 is a thing, but very few people implement it.) The mental model of IPv4 NAT is much more straightforward and I would strongly recommend that home users prefer that.