4 ms·

IPv6 doesn't mean no firewall and NAT!=firewall You should still be blocking incoming requests for IPv6 endpoints and only open ports you intend to serve publi

IPv6 doesn't mean no firewall and NAT!=firewall You should still be blocking incoming requests for IPv6 endpoints and only open ports you intend to serve publicly.

geek_at 5y ago
I do understand that but NAT was acting like another layer of firewall because I could be sure that none of my devices behind the nat could be accessed without port forwarding. With IPv6 they can
- xnyan 5y ago
  This is not exactly true. There are many tricks in the NAT traversal toolkit, depending on your configuration it can be fairly simple to work around. In every case where you use NAT, you also use a firewall. 100% of consumer IPv6-capible routers block unsolicited inbound IPv6 by default. It's not something you need to worry about unless you are hosting, and in that case your concerns are the same as if you're using IPv4.
- jeroenhd 5y ago
  Not from a passive, receiving network, no. If anyone on the network uses a web browser, there's a good chance your network can be attacked by a malicious ad through NAT slipstreaming, through (https://samy.pl/slipstream/ https://samy.pl/slipstream/) NAT wasn't meant to be a security mechanism and because of that, the practical designs found in most devices don't treat it as such. On IPv4, NAT and firewalls are usually one and the same rule set. That rule set is slightly smaller with IPv6 because of the lack of NAT, but the mechanisms are still the same. If your IPv4 firewall fails, NAT won't save you, because that's part of the system that failed. If you're still insistent on using NAT then... use NAT. The core technique works on both protocols, you'll just have to set it up yourself because router vendors don't usually implement it.
- soneil 5y ago
  That's not security, that's an assumption. UPnP was so vilified because it broke that assumption and revealed NAT never provided security, it provided an assumption.

IPv6 doesn't mean no firewall and NAT!=firewall You should still be blocking incoming requests for IPv6 endpoints and only open ports you intend to serve publicly.

geek_at 5y ago

I do understand that but NAT was acting like another layer of firewall because I could be sure that none of my devices behind the nat could be accessed without port forwarding. With IPv6 they can

xnyan 5y ago
This is not exactly true. There are many tricks in the NAT traversal toolkit, depending on your configuration it can be fairly simple to work around. In every case where you use NAT, you also use a firewall. 100% of consumer IPv6-capible routers block unsolicited inbound IPv6 by default. It's not something you need to worry about unless you are hosting, and in that case your concerns are the same as if you're using IPv4.
jeroenhd 5y ago
Not from a passive, receiving network, no. If anyone on the network uses a web browser, there's a good chance your network can be attacked by a malicious ad through NAT slipstreaming, through (https://samy.pl/slipstream/ https://samy.pl/slipstream/) NAT wasn't meant to be a security mechanism and because of that, the practical designs found in most devices don't treat it as such. On IPv4, NAT and firewalls are usually one and the same rule set. That rule set is slightly smaller with IPv6 because of the lack of NAT, but the mechanisms are still the same. If your IPv4 firewall fails, NAT won't save you, because that's part of the system that failed. If you're still insistent on using NAT then... use NAT. The core technique works on both protocols, you'll just have to set it up yourself because router vendors don't usually implement it.
soneil 5y ago
That's not security, that's an assumption. UPnP was so vilified because it broke that assumption and revealed NAT never provided security, it provided an assumption.