3 ms·
Even in the land of IPv6 there would have to be something to punch a hole in the end user's firewall rules. Any good end-user router will default deny incoming
by spookthesunset 5y ago
Even in the land of IPv6 there would have to be something to punch a hole in the end user's firewall rules. Any good end-user router will default deny incoming IP traffic.
Assigning public IPv6 addresses to every device in your home just pushes the "deny" rule to a slightly different part of the network stack. We will still require something similar to STUN to get around firewall rules.
- nybble41 5y agoThe only default-deny rule for incoming traffic for general-purpose, up-to-date hosts should be the one built into the OS which rejects incoming connections to ports where nothing is listening. (If you enable UPnP, as most routers do by default, this is the policy you actually have in practice… just with more steps.) If you can get around the firewall rules with something like STUN then those rules aren't really doing you much good, are they? By all means, put random IoT devices on a separate VLAN and block all incoming connections directed there (without UPnP). And be sure to block all the obvious workarounds like STUN for that VLAN or there's no point in having the firewall. But for PCs, smartphones, and the like it should be possible to connect to their open ports from outside the network using their public IP addresses without any tweaks at the router. These devices are perfectly capable of securing their own listening ports.