5 ms·
I'm not sure what routers you've used or seen but every home router I've touched in the last 5 to 10 years has had the option to enable IPv6 in its settings. A
by apearson 8y ago
I'm not sure what routers you've used or seen but every home router I've touched in the last 5 to 10 years has had the option to enable IPv6 in its settings.
Also, IPv6 has a unique address that everybody can reach but most if not all routers have an IPv6 firewall that gives at least if not more security than NAT provides.
- AnIdiotOnTheNet 8y ago> IPv6 firewall that gives at least if not more security than NAT provides That's just not true. NAT and firewall both achieve what little security they provide through simple blocking of packets based on state information. Firewalls generally provide more robust state information, but NAT is what lets you redirect sockets. They work together.
- Dagger2 8y agoExcept NAT gives no security, because NAT doesn't block packets. If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor -- it's processed as normal like any other packet would be, and in the absence of a firewall (which is logically separate, even if often implemented in the same software stack) it'll be routed to whatever the destination in the packet header is.
- zamadatix 8y ago"If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor" Yes it is, it's the same scenario as if there was no route to the destination just at a higher abstraction layer. Think about it this way: a packet just hit the NAT IP from the internet, the packet has hit it's destination. There was no NAT table match for the packet so it was not rewritten. Where would the packet be forwarded to if not the bit bucket?
- Dagger2 8y agoIt's not the same scenario at all. If there's no route to the destination then the packet will necessarily be dropped, but with no matching NAT state table entry for a packet all that happens is that the dst header field is left alone. There will still be an IP in the dst header field! The router will still deliver the packet to that IP, subject to all the usual constraints (e.g. it needs a valid route etc). NAT won't stop that; only a firewall will.
- AnIdiotOnTheNet 8y agoAnd in practice what that means is that the router's own IP is the destination and the packet ends up at a closed port. Unless of course you're talking about using NAT outside the context of the RFC1918/internet boundary, in which case you're absolutely right, but that wasn't what was being discussed.
- Dagger2 8y agoIsn't it? I thought we were talking about NAT, not about RFC1918. Even NAT in combination with RFC1918 doesn't give you security. The use of RFC1918 would certainly limit the set of people that could connect to your LAN machines, but it would be hard to call the result secure since anybody sharing your upstream L2 network, plus your ISP and anyone who can trick, force or coerce them into cooperating could still access your network. And what does NAT add to the situation? Certainly not any security, since any connections that were possible before you added the NAT will still be possible afterwards too. In fact a lot more connections will become possible, so it seems like it reduces the security rather than improves it.