4 ms·

> The trade-off was the machines behind the NAT mechanism couldn't be reached from the Internet That can also be pretty awesome given that so many devices now

> The trade-off was the machines behind the NAT mechanism couldn't be reached from the Internet That can also be pretty awesome given that so many devices now may not work in the interest of their users. It is a hassle for IOT, but we have long since then solutions for that and maybe those are better anyway. My provider only supplies IPv6 and you always connect to IPv4 through a transport. That is sometimes down or has too many concurrent users. Makes the net almost unusable still. Perhaps I should learn Hindi.

ipv6_or_nat 5y ago
You need a firewall if your end points are publicly reachable, not NAT.
- raxxorrax 5y ago
  Completely true, I wasn't too serious about that, just pointing out that there were unintended benefits.
- tekknik 5y ago
  NAT still provides some layer of protection, especially if you don’t trust the firewall software. This is going to open up a can of worms once everybody gets global addresses and can’t figure out how to configure their firewall.
  - ipv6_or_nat 5y ago
    What?! You don’t trust the firewalls software so you are good to trust the NAT software?
    - tekknik 5y ago
      Windows firewall? no. iptables? yes. Why? because I know how to configure one and not the other. Also because of things like this: https://www.enterprisenetworkingplanet.com/security/qa-behind-the-windows-firewall-exploit/ https://www.enterprisenetworkingplanet.com/security/qa-behin...
  - Dagger2 5y ago
    It actually doesn't. NAT just changes the apparent source address of outbound connections; it doesn't do anything to inbound ones. In any case, people manage to do both NAT and firewalls on v4 today so I don't see why they'd suddenly be unable to do firewalls in v6, especially since you don't have the complication of needing to figure out NAT as well. The large address space also helps a lot, because it makes it much harder to find servers on v6 (including deliberately exposed servers, e.g. cameras or NASs that people want to access from a different network), compared to v4 where you can enumerate all active servers over the entire internet without much trouble.
    - tekknik 5y ago
      NAT prevents an external host from making arbitrary connections to a host behind the NAT without further configuration. This is something your average person doesn’t need to know or really care about. But once every device they have is globally routable they will have to care and ensure their machines are secure and behind a firewall. And if that firewall should fail then you’re sitting on the public network with your pants down. Your other part is security through obscurity, and I can think of at least 2 ways to scan the entire address space in a short amount of time. So nope doesn’t count either.
      - Dagger2 5y ago
        It doesn't do that. How can rewriting the source address of outbound connections prevent inbound connections? You're not going to exhaustively scan the entire v6 space in any short amount of time. It is possible to whittle down the space you need to scan, but only moderately. It's still rather unviable compared to v4.
        tekknik 5y ago
        Pick any network doing NAT, attempt to make a connection. It will be denied. NAT devices are both firewalls and translators and if you don’t have a configuration for port forwarding, be it via established connection or manual configuration, the connection won’t get through. And importantly this is a configuration the user doesn’t touch. And scanning IP spaces is insanely easy to parallelize and uses so few resources an arduino can be used to scan. Given enough nodes it’s instant. And with every windows box on the planet globally routable, bonets will never be stronger. But let’s pretend this is true and say it takes too much time. What about when it doesn’t? What happens to your security via obscurity then?

ipv6_or_nat 5y ago

You need a firewall if your end points are publicly reachable, not NAT.

raxxorrax 5y ago
Completely true, I wasn't too serious about that, just pointing out that there were unintended benefits.
tekknik 5y ago
NAT still provides some layer of protection, especially if you don’t trust the firewall software. This is going to open up a can of worms once everybody gets global addresses and can’t figure out how to configure their firewall.
- ipv6_or_nat 5y ago
  What?! You don’t trust the firewalls software so you are good to trust the NAT software?
  - tekknik 5y ago
    Windows firewall? no. iptables? yes. Why? because I know how to configure one and not the other. Also because of things like this: https://www.enterprisenetworkingplanet.com/security/qa-behind-the-windows-firewall-exploit/ https://www.enterprisenetworkingplanet.com/security/qa-behin...
- Dagger2 5y ago
  It actually doesn't. NAT just changes the apparent source address of outbound connections; it doesn't do anything to inbound ones. In any case, people manage to do both NAT and firewalls on v4 today so I don't see why they'd suddenly be unable to do firewalls in v6, especially since you don't have the complication of needing to figure out NAT as well. The large address space also helps a lot, because it makes it much harder to find servers on v6 (including deliberately exposed servers, e.g. cameras or NASs that people want to access from a different network), compared to v4 where you can enumerate all active servers over the entire internet without much trouble.
  - tekknik 5y ago
    NAT prevents an external host from making arbitrary connections to a host behind the NAT without further configuration. This is something your average person doesn’t need to know or really care about. But once every device they have is globally routable they will have to care and ensure their machines are secure and behind a firewall. And if that firewall should fail then you’re sitting on the public network with your pants down. Your other part is security through obscurity, and I can think of at least 2 ways to scan the entire address space in a short amount of time. So nope doesn’t count either.
    - Dagger2 5y ago
      It doesn't do that. How can rewriting the source address of outbound connections prevent inbound connections? You're not going to exhaustively scan the entire v6 space in any short amount of time. It is possible to whittle down the space you need to scan, but only moderately. It's still rather unviable compared to v4.
      - tekknik 5y ago
        Pick any network doing NAT, attempt to make a connection. It will be denied. NAT devices are both firewalls and translators and if you don’t have a configuration for port forwarding, be it via established connection or manual configuration, the connection won’t get through. And importantly this is a configuration the user doesn’t touch. And scanning IP spaces is insanely easy to parallelize and uses so few resources an arduino can be used to scan. Given enough nodes it’s instant. And with every windows box on the planet globally routable, bonets will never be stronger. But let’s pretend this is true and say it takes too much time. What about when it doesn’t? What happens to your security via obscurity then?