3 ms·

People sometimes ask "What's the advantage of IPv6?". Well, not having to futz around with STUN/NAT due to NAT is one improvement. See "How NAT traversal works"

People sometimes ask "What's the advantage of IPv6?". Well, not having to futz around with STUN/NAT due to NAT is one improvement. See "How NAT traversal works": * https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ * https://news.ycombinator.com/item?id=30707711 https://news.ycombinator.com/item?id=30707711 (2022) * https://news.ycombinator.com/item?id=24241105 https://news.ycombinator.com/item?id=24241105 (2020) And no, just because a device has a publicly IPv6 address does not mean it is actually / necessarily accessible from the public Internet. Firewalls do not stop working with IPv6. My iMac lives behind my Asus RT-AC68U; I can ping my iMac's IPv6 address: * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-ping.php https://www.subnetonline.com/pages/ipv6-network-tools/online... But I cannot connect to SSH from the Internet (but from my laptop SSH works), or port 80 (if I launch 'nc -6 -l 80'): * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-port-scanner.php https://www.subnetonline.com/pages/ipv6-network-tools/online... You can have something with a 2000/3 unicast, non-link-local IPv6 address, and decide via policy whether to allow connections to it, either with an on-host firewall, or with an upstream network device: * https://www.asus.com/support/FAQ/1013638/ https://www.asus.com/support/FAQ/1013638/ To repeat: Firewalls do not stop working with IPv6. And yes, there is still some layer of software that is needed for allowing network connections if the default firewall policy is default deny all (except for replies to 'internally' originated connections): * https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol * http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf But not having to deal with address weirdness is one less complication.

giancarlostoro 4y ago
I don't care about open ports, I care more about exposing my IP to internet strangers. I'm having flashbacks to Skype days where other gamers would get your IP and use malicious tools to basically nuke your internet. Skype was really dumb about leaking your IP to total internet strangers. I would basically just login to a less known account when this would happen because somebody got mad I did this or that in a video game. I hear Discord direct calls will also leak your IP so I never accept calls from anyone I don't personally know.
- Volundr 4y ago
  I don't think NAT really helps this scenario though. It's the difference between the router's IP being exposed and the specific computer. If I can take down your internet with one I can take it down with the other.
  - remram 4y ago
    NAT doesn't but TURN does, it is a remote server that relays your WebRTC traffic. If someone is video-chatting with you, they will see packets from the TURN server, and if they DOS it, your overall internet connection will be unaffected.

giancarlostoro 4y ago

I don't care about open ports, I care more about exposing my IP to internet strangers. I'm having flashbacks to Skype days where other gamers would get your IP and use malicious tools to basically nuke your internet. Skype was really dumb about leaking your IP to total internet strangers. I would basically just login to a less known account when this would happen because somebody got mad I did this or that in a video game. I hear Discord direct calls will also leak your IP so I never accept calls from anyone I don't personally know.

Volundr 4y ago
I don't think NAT really helps this scenario though. It's the difference between the router's IP being exposed and the specific computer. If I can take down your internet with one I can take it down with the other.
- remram 4y ago
  NAT doesn't but TURN does, it is a remote server that relays your WebRTC traffic. If someone is video-chatting with you, they will see packets from the TURN server, and if they DOS it, your overall internet connection will be unaffected.