3 ms·
> 2. I'm used to the pseudo security that a NAT gives. If you wish to do this with IPv6 you can with ULA and NPTv6: * https://en.wikipedia.org/wiki/Unique_loc
by throw0101a 5y ago
> 2. I'm used to the pseudo security that a NAT gives.
If you wish to do this with IPv6 you can with ULA and NPTv6:
* https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address
* https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Translation https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr...
> 3. All those ICMPv6 messages sniffing (and snooping?) really don't fill me with joy joy happiness.
For those wondering: ping works by sending ICMP(v4) echo request packets. If you wish to block v4 ping you block echo requests (Type 8) and echo replies (Type 0):
* https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol https://en.wikipedia.org/wiki/Internet_Control_Message_Proto...
ping6 works by sending ICMP(v6) echo request packets. In IPv6-land block Types 128 and 129:
* https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol_for_IPv6 https://en.wikipedia.org/wiki/Internet_Control_Message_Proto...
To block traceroute block Types 11 (v4) and 3 (v6): TTL/hop exceeded notifications.
> IPv6 really does feel like a Godzillian monstrosity and a chore to type in: double colons between every number and it's in Hex? At least with IPv4 you can type the numbers in pretty rapidly on a numpad.
We've run out of IPv4 addresses. We need a larger address space with more bits. More bits mean more typing. Get over it? ¯\_(ツ)_/¯
- BenjiWiebe 5y agoPlease don't block ttl exceeded packets... It will cause some very hard to troubleshoot network issues for someone somewhere sometime.
- kjs3 5y agoAmen, brother. Someone like your CEO at somewhere like his lake house at the end of a dodgy DSL line from Cletus's ISP and Bait Shop. I kid, I kid...they didn't sell bait. There are a lot of unpleasant failure modes to blocking ICMP without completely understanding the implications.
- throw0101a 5y agoI agree… but some folks seem to think blocking ping and traceroute give you some kind of extra security.