4 ms·

Check with your ISP to see if you have IPv6 available, and use that. I have a cheap VPS that I can jump through if I'm on an IPv4 only host.

sneak 6y ago
The solution in TFA works behind NAT and routers/firewalls, and has the added benefit of encrypting all of the traffic between the two machines thanks to SSH. I’m not sure people who aren’t network administrators should be putting public IPv6 all over their LAN behind their router, at least not until v6 is more common and routers have better inbound security features for such things (like how NAT functions today for v4).
- quaintdev 6y ago
  NAT like security for IPv6 is just dumb. We should always configure firewall for v4 and V6. NAT is not for security!! It has different purpose which is now being taken care by V6 and NAT should just die.
  - franga2000 6y ago
    Yes, BUT: for many many years, home networks have relied primarily on NAT for security. The firewall was only ever touched when doing something advanced and even people who were doing things like setting up home servers and such rarely had to deal with it. Every single tutorial on the topic is IPv4-specific and until IPv6 isn't more common, people will not write guides and tutorials with IPv6 in mind. So until the knowledge of proper security on open networks is common enough among home tinkerers, we should not be recommending people just throw everything straight onto the open Internet.
    - mercora 6y ago
      i don't think the typical NAT setup differs too much from a typical filtering setup. That is, only allow return traffic from public interfaces. While that is kinda implicit using NAT the change to being explicit is trivial. somewhat simplified like this using iptables on linux: iptables -t nat -A POSTROUTING -o WAN -j MASQUERADE vs iptables -A FORWARD -i WAN -m state ! --state RELATED,ESTABLISHED -j REJECT
  - kzrdude 6y ago
    Security has layers, no layer has to be perfect. What's wrong with having NAT as an obscurity layer?
    - fogihujy 6y ago
      The problem is that many people use NAT as the only line of defense, and that model fails utterly once IPv6 comes into the picture. There's nothing wrong in using NAT to increase the cost of attack as a part of a larger defence strategy.

sneak 6y ago

The solution in TFA works behind NAT and routers/firewalls, and has the added benefit of encrypting all of the traffic between the two machines thanks to SSH. I’m not sure people who aren’t network administrators should be putting public IPv6 all over their LAN behind their router, at least not until v6 is more common and routers have better inbound security features for such things (like how NAT functions today for v4).

quaintdev 6y ago
NAT like security for IPv6 is just dumb. We should always configure firewall for v4 and V6. NAT is not for security!! It has different purpose which is now being taken care by V6 and NAT should just die.
- franga2000 6y ago
  Yes, BUT: for many many years, home networks have relied primarily on NAT for security. The firewall was only ever touched when doing something advanced and even people who were doing things like setting up home servers and such rarely had to deal with it. Every single tutorial on the topic is IPv4-specific and until IPv6 isn't more common, people will not write guides and tutorials with IPv6 in mind. So until the knowledge of proper security on open networks is common enough among home tinkerers, we should not be recommending people just throw everything straight onto the open Internet.
  - mercora 6y ago
    i don't think the typical NAT setup differs too much from a typical filtering setup. That is, only allow return traffic from public interfaces. While that is kinda implicit using NAT the change to being explicit is trivial. somewhat simplified like this using iptables on linux: iptables -t nat -A POSTROUTING -o WAN -j MASQUERADE vs iptables -A FORWARD -i WAN -m state ! --state RELATED,ESTABLISHED -j REJECT
- kzrdude 6y ago
  Security has layers, no layer has to be perfect. What's wrong with having NAT as an obscurity layer?
  - fogihujy 6y ago
    The problem is that many people use NAT as the only line of defense, and that model fails utterly once IPv6 comes into the picture. There's nothing wrong in using NAT to increase the cost of attack as a part of a larger defence strategy.