4 ms·

> I'm used to the pseudo security that a NAT gives. In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I tur

by Slix 5y ago

> I'm used to the pseudo security that a NAT gives. In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? On my Netgear R6700, I can't figure it out from the UI or from forum posts/help content. And without being certain, I don't want to turn on IPv6. Even though I'm technical enough to understand IPv6. Because my printer or my light bulb being exposed to the internet is a huge risk that my router is supposed to stop.

jiggawatts 5y ago
IPv6 firewalls work the same as IPv4 firewalls. You just remove the NAT from the equation. The default is deny. You have to explicitly enable inbound ports. The difference is that you connect to the device address, not the NAT gateway address. No more port conflicts. No more split DNS. Etc...
throw0101a 5y ago
> In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? Copy-pasting from a previous discussion a little while ago: --- IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is recorded. When an 'outside' packet arrives the firewall checks its parameters to see if it corresponds with an existing connection, and if it does it passes it through. If the parameters do not correspond with anything in the firewall's table/s it assumes that someone is trying to create a new connection, which is generally not allowed by default, and therefore drops it. The main difference is that with IPv4 and NAT the original (RFC 1918?) source address and port are changed to something corresponding to the 'outside' interface of the firewall. With IPv6 address/port, rewriting is not done. Only state tables are updated and checked. New connections are not allowed past the firewall towards the inside with either protocol, and only replies to connections opened from the inside are passed through. There's no magical security behind NAT: tuples and packet flags are read, looked up in a state table, allowed or not depending on either firewall rule or state presence. The security comes from the state checking. […] I have a printer with an IPv6 stack. I also have IPv6 addresses from my ISP. Yet somehow my Asus AC-68U prevents the public Internet from reaching my printer. --- * https://news.ycombinator.com/item?id=28390634 https://news.ycombinator.com/item?id=28390634 IPv6 firewall on my Asus: * https://www.asus.com/us/support/FAQ/1013638/ https://www.asus.com/us/support/FAQ/1013638/ If you want to test, find the IPv6 address of your printer and try pinging it: * https://tools.keycdn.com/ipv6-ping https://tools.keycdn.com/ipv6-ping
- lokedhs 5y ago
  Ping will still likely work. At least I can ping all my machines on my private network. However, I'm not able to ssh into it or anything else, because all traffic is dropped. It all depends on firewall configuration, but I think you may unnecessarily scare people by suggesting they're wide open just because ping works.
  - kazen44 5y ago
    ICMP should be allowed anyways because of MTU path discovery. stop disabling ping
  - throw0101a 5y ago
    > ping True. There are IPv6 port scanners available: * http://www.ipv6scanner.com/cgi-bin/main.py http://www.ipv6scanner.com/cgi-bin/main.py * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-port-scanner.php https://www.subnetonline.com/pages/ipv6-network-tools/online...
- GrayShade 5y ago
  All right, but assuming I have a dynamic DNS setup, how do I connect to one of the hosts in my network? I think most OSes do that privacy thing where they periodically randomize the suffix of their v6 address.
  - yrro 5y ago
    Your hosts will also use SLAAC to determine their permanent 'management' address, that's the one you use for connecting _to_ them. The 'management' address won't be used as the source addrrss packets originating _from_ the host unless the use of temporary/privacy addresses is disabled.
    - carlhjerpe 5y ago
      I need to remove IPv4 from my home network so that I can finally try and understand all mechanics around it properly.
kalleboo 5y ago
Home routers (and even small business routers from companies you'd expect better from like Ubiquiti) are often completely missing the UI for stuff like IPv6 firewall and it's a real tragedy and definitely something that is holding back adoption.

by Slix 5y ago

jiggawatts 5y ago

IPv6 firewalls work the same as IPv4 firewalls. You just remove the NAT from the equation. The default is deny. You have to explicitly enable inbound ports. The difference is that you connect to the device address, not the NAT gateway address. No more port conflicts. No more split DNS. Etc...

throw0101a 5y ago

> In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? Copy-pasting from a previous discussion a little while ago: --- IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is recorded. When an 'outside' packet arrives the firewall checks its parameters to see if it corresponds with an existing connection, and if it does it passes it through. If the parameters do not correspond with anything in the firewall's table/s it assumes that someone is trying to create a new connection, which is generally not allowed by default, and therefore drops it. The main difference is that with IPv4 and NAT the original (RFC 1918?) source address and port are changed to something corresponding to the 'outside' interface of the firewall. With IPv6 address/port, rewriting is not done. Only state tables are updated and checked. New connections are not allowed past the firewall towards the inside with either protocol, and only replies to connections opened from the inside are passed through. There's no magical security behind NAT: tuples and packet flags are read, looked up in a state table, allowed or not depending on either firewall rule or state presence. The security comes from the state checking. […] I have a printer with an IPv6 stack. I also have IPv6 addresses from my ISP. Yet somehow my Asus AC-68U prevents the public Internet from reaching my printer. --- * https://news.ycombinator.com/item?id=28390634 https://news.ycombinator.com/item?id=28390634 IPv6 firewall on my Asus: * https://www.asus.com/us/support/FAQ/1013638/ https://www.asus.com/us/support/FAQ/1013638/ If you want to test, find the IPv6 address of your printer and try pinging it: * https://tools.keycdn.com/ipv6-ping https://tools.keycdn.com/ipv6-ping

lokedhs 5y ago
Ping will still likely work. At least I can ping all my machines on my private network. However, I'm not able to ssh into it or anything else, because all traffic is dropped. It all depends on firewall configuration, but I think you may unnecessarily scare people by suggesting they're wide open just because ping works.
- kazen44 5y ago
  ICMP should be allowed anyways because of MTU path discovery. stop disabling ping
- throw0101a 5y ago
  > ping True. There are IPv6 port scanners available: * http://www.ipv6scanner.com/cgi-bin/main.py http://www.ipv6scanner.com/cgi-bin/main.py * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-port-scanner.php https://www.subnetonline.com/pages/ipv6-network-tools/online...
GrayShade 5y ago
All right, but assuming I have a dynamic DNS setup, how do I connect to one of the hosts in my network? I think most OSes do that privacy thing where they periodically randomize the suffix of their v6 address.
- yrro 5y ago
  Your hosts will also use SLAAC to determine their permanent 'management' address, that's the one you use for connecting _to_ them. The 'management' address won't be used as the source addrrss packets originating _from_ the host unless the use of temporary/privacy addresses is disabled.
  - carlhjerpe 5y ago
    I need to remove IPv4 from my home network so that I can finally try and understand all mechanics around it properly.

kalleboo 5y ago

Home routers (and even small business routers from companies you'd expect better from like Ubiquiti) are often completely missing the UI for stuff like IPv6 firewall and it's a real tragedy and definitely something that is holding back adoption.