5 ms·
One can still have intentionally unroutable addresses in IPv6.
by imoverclocked 5y ago
One can still have intentionally unroutable addresses in IPv6.
- tsimionescu 5y agoSure, but then you're again on par with IPv4+NAT in the area of connectivity - no worse, but no better. So why switch?
- gumby 5y agoBecause you have all the overhead of NAT plus losing functionality that cannot operate through NAT. If all you want is to have addresses that done leave the local net, just do that. You’ll lose weight in a famine but nobody would suggest it as a diet plan.
- tsimionescu 5y ago> Because you have all the overhead of NAT What overhead does NAT add compared to a L4 firewall? > plus losing functionality that cannot operate through NAT. What functionality does NAT prevent that a L4 firewall doesn't?
- imoverclocked 5y agoYou can simply not route a specific range, no firewall needed. NAT, on its own, doesn't provide security. At best, it provides obscurity. At worst, it breaks security [2]. NAT needs a properly configured firewall to provide security [1]. In this sense, NAT vs a Firewall is a false dichotomy. [1] https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ [2] https://www.computerworld.com/article/2556611/nat-traversal--nat-t--security-issues.html https://www.computerworld.com/article/2556611/nat-traversal-... edit: formatting
- tsimionescu 5y agoI wasn't claiming NAT is adding security. A combined IPv4 NAT/firewall will not necessarily be less performant than an IPv6 firewall - that was my claim. Also, GP claimed that certain services that don't work because of NAT would work on an IPv6 network. I was curious which services those might be, that don't work because of NAT but wouldn't be affected by a firewall.
- Dagger2 5y agoIf you're behind CGNAT then generally you won't be able to accept any inbound connections, so even things like a basic webserver aren't doable.
- gumby 5y agoThese stateful devices have to look at all the traffic and maintain connection data for every transaction. That takes space and time and is bounded in volume.
- tsimionescu 5y agoThe same is true of firewalls, so I don't get your point. Even in IPv6, your router-level firewall will need to know if a packet with dst_port=31536 is part of an existing connection or not, which means it has to monitor all traffic and maintain connection data for every transaction, no different from a NAT device.
- gumby 5y agoWhat is the point of a perimiter firewall in the modern Internet? Those TV and lightbulbs are attack vectors inside the firewall. And there are (and will be more) plenty of devices that bridge the cellular networks and the LAN. You need a defense at depth, not a crunchy perimeter with a squishy inside.