4 ms·

hot take of the day: NAT is (mostly) a shitty idea. we can give everything a WAN ipv6 and a private LAN address. devices should maintain their own firewalls and

hot take of the day: NAT is (mostly) a shitty idea. we can give everything a WAN ipv6 and a private LAN address. devices should maintain their own firewalls and if defense in depth is required, the router should maintain a firewall that blocks incoming by default but still give everything its own address.

ipdashc 4y ago
While I mostly agree, there's definitely the issue of readdressing if your ISP changes your IPv6 prefix. In NATted IPv4, you can maintain your own eternally consistent internal address scheme, regardless of what's going on "outside". But in IPv6, if your dynamic IP changes, all your devices get new addresses. I can definitely see the value in creating a stable internal address layout on IPv6, as this article says. Of course, I have no idea how often an ISP actually changes your IPv6 prefix. In an ideal world, it'd never change...
- staringback 4y ago
  ULAs at least solve this problem for all networking that doesn't have to be internet facing
- anamax 4y ago
  People change ISPs....
  - ipdashc 4y ago
    For sure, but that's a predictable event that you can plan for and get ready to renumber your network / handle the renumbering. A dynamic IP change can just happen without much warning, and enjoy possibly spending an hour befuddled before you realize what happened.
- unethical_ban 4y ago
  The article's main topic is on NPTv6, which would supercede NAT as the tool for maintaining internal addressing.
  - ipdashc 4y ago
    Yeah, that's what I'm saying :) I thought the parent comment was saying that NAT was bad and NPTv6 was bad, but maybe I was mistaken.
atemerev 4y ago
Like I have said in another thread, if you misconfigure a firewall, the network usually works, but not secure. If you misconfigure a NAT, nothing works, and your error is clearly visible. I don't see a way to fix this (and configuration errors are common).
- unethical_ban 4y ago
  Fix it with user experience. Routers should have dashboards that give easy status of firewall configuration ala Windows firewall: Green for no inbound rules (or whitelisted rules) and yellow/red for non-checked rules. Routers could even have LEDs or status displays like some higher end Ubiquiti prosumer products have, showing firewall status. Routers could have a user-accessible API and Windows client that shows status on a taskbar item. The technical solutions are there, but I don't have faith ASUS and co will build a competent product.
  - atemerev 4y ago
    The technical solutions will not work, as there are many, many possibilities to make a mistake. Misleading router UI, copying the configuration from somewhere else and forgetting to update it, moving a computer to another network, just forgetting to enable a firewall (in many cases it is impossible to set up a IPv4 network without a NAT precisely because IPv4 addresses are rare — but it is perfectly possible to do it with IPv6, and it will be insecure by default). Secure systems are robust against user mistakes (and even middlemen mistakes). A NAT is one such system. Alternatives do not work like that.
  - throw0101a 4y ago
    > The technical solutions are there, but I don't have faith ASUS and co will build a competent product. The last time I was looking for a home router I specifically went for Asus because their default firmware is pretty good, and third-party options are available: * https://www.asuswrt-merlin.net/features https://www.asuswrt-merlin.net/features Currently running an RT-AC68U.
autoexec 4y ago
> devices should maintain their own firewalls This is insane. I don't want to have to learn, document, configure, and patch a different firewall on every internet connected device I own. That's a total nightmare. Computers can have their firewalls managed at the domain level. How is that support to work for bluray players, game consoles, light bulbs, phones, echo devices, door cams, thermostats, and kitchen appliances? Nope. At a minimum everyone should have a stateful firewall at their edge making their devices impossible to reach/scan from the internet at large. Home routers that defaulted to using NAT made that dead simple. On the rare occasion you really need something open to the entire internet it can sit in your DMZ. If I ever do make the move to using IPv6 on my network I'll likely continue to use NAT
- collegeburner 4y ago
  do you have to "learn, document, configure, and patch" a firewall on ur home router? most ppl just plug it in bc it's configured to work.
  - autoexec 4y ago
    Yes? My configuration isn't complex enough at home to require my own documentation, but I absolutely had to read what the manufacturer provided, configure the firewall for my needs, and update the firmware. I don't think anyone should just throw a router in front of their network and think "This will just work!" - I mean, it might "work", but what is it leaving open? What is it logging? Who can access it? Home routers have gotten pretty good about sane defaults these days, but at a minimum I'd be disabling UPnP and looking over what those defaults are before trusting it to protect my network.
    - collegeburner 4y ago
      which is literally the same situation as if you had a device local firewall? sensible defaults and you learn to configure for stuff you want to change.
      - 4y ago
asimops 4y ago
I agree that NATv6 is a bad idea, but imo we neeed firewalls on the router. Because on paper a endpoint firewall is a good idea, because you take that with you even when you change the network, but... then there is the Windows firewall: - Applications that punch their own holes, like steam - Windows which grants itself inbound exceptions and reenables them if you disable them - A non standard filtering order (deny is always defore allow, not in order) And then there are all those born in the 80s people that were told on LAN parties to "just disable the Windows firewall" and kept doing so.
- bob1029 4y ago
  > And then there are all those born in the 80s people that were told on LAN parties to "just disable the Windows firewall" and kept doing so. You caught me. I think a firewall on the router is absolutely essential regardless of NAT scenarios. With the understanding that you have an entire generation of computer users who equate that internet box with some degree of safety, you will find less friction with some tweak to that experience. You can still call it "port forwarding", block all inbound by default, and keep most of the same UX. I personally like to operate my home network like a DMZ. Being able to reach any computer from any other without screwing around with networking is very convenient to me. I operate with an all-or-nothing trust model on my LAN. Having some centralized firewall helps a lot with this.
  - em-bee 4y ago
    i would like to know why anyone would disagree with the parent comment.
- johnklos 4y ago
  Firewalls are only necessary for OSes that open ports without good reasons and without good controls. In other words, your reaction is justified if you think Windows is normal and an example of how things should be. The rest of the world, though, knows that you don't just randomly open ports without good reason and without ways to turn off services.
  - 4y ago

ipdashc 4y ago

While I mostly agree, there's definitely the issue of readdressing if your ISP changes your IPv6 prefix. In NATted IPv4, you can maintain your own eternally consistent internal address scheme, regardless of what's going on "outside". But in IPv6, if your dynamic IP changes, all your devices get new addresses. I can definitely see the value in creating a stable internal address layout on IPv6, as this article says. Of course, I have no idea how often an ISP actually changes your IPv6 prefix. In an ideal world, it'd never change...

staringback 4y ago
ULAs at least solve this problem for all networking that doesn't have to be internet facing
anamax 4y ago
People change ISPs....
- ipdashc 4y ago
  For sure, but that's a predictable event that you can plan for and get ready to renumber your network / handle the renumbering. A dynamic IP change can just happen without much warning, and enjoy possibly spending an hour befuddled before you realize what happened.
unethical_ban 4y ago
The article's main topic is on NPTv6, which would supercede NAT as the tool for maintaining internal addressing.
- ipdashc 4y ago
  Yeah, that's what I'm saying :) I thought the parent comment was saying that NAT was bad and NPTv6 was bad, but maybe I was mistaken.

atemerev 4y ago

Like I have said in another thread, if you misconfigure a firewall, the network usually works, but not secure. If you misconfigure a NAT, nothing works, and your error is clearly visible. I don't see a way to fix this (and configuration errors are common).

unethical_ban 4y ago
Fix it with user experience. Routers should have dashboards that give easy status of firewall configuration ala Windows firewall: Green for no inbound rules (or whitelisted rules) and yellow/red for non-checked rules. Routers could even have LEDs or status displays like some higher end Ubiquiti prosumer products have, showing firewall status. Routers could have a user-accessible API and Windows client that shows status on a taskbar item. The technical solutions are there, but I don't have faith ASUS and co will build a competent product.
- atemerev 4y ago
  The technical solutions will not work, as there are many, many possibilities to make a mistake. Misleading router UI, copying the configuration from somewhere else and forgetting to update it, moving a computer to another network, just forgetting to enable a firewall (in many cases it is impossible to set up a IPv4 network without a NAT precisely because IPv4 addresses are rare — but it is perfectly possible to do it with IPv6, and it will be insecure by default). Secure systems are robust against user mistakes (and even middlemen mistakes). A NAT is one such system. Alternatives do not work like that.
- throw0101a 4y ago
  > The technical solutions are there, but I don't have faith ASUS and co will build a competent product. The last time I was looking for a home router I specifically went for Asus because their default firmware is pretty good, and third-party options are available: * https://www.asuswrt-merlin.net/features https://www.asuswrt-merlin.net/features Currently running an RT-AC68U.

autoexec 4y ago

> devices should maintain their own firewalls This is insane. I don't want to have to learn, document, configure, and patch a different firewall on every internet connected device I own. That's a total nightmare. Computers can have their firewalls managed at the domain level. How is that support to work for bluray players, game consoles, light bulbs, phones, echo devices, door cams, thermostats, and kitchen appliances? Nope. At a minimum everyone should have a stateful firewall at their edge making their devices impossible to reach/scan from the internet at large. Home routers that defaulted to using NAT made that dead simple. On the rare occasion you really need something open to the entire internet it can sit in your DMZ. If I ever do make the move to using IPv6 on my network I'll likely continue to use NAT

collegeburner 4y ago
do you have to "learn, document, configure, and patch" a firewall on ur home router? most ppl just plug it in bc it's configured to work.
- autoexec 4y ago
  Yes? My configuration isn't complex enough at home to require my own documentation, but I absolutely had to read what the manufacturer provided, configure the firewall for my needs, and update the firmware. I don't think anyone should just throw a router in front of their network and think "This will just work!" - I mean, it might "work", but what is it leaving open? What is it logging? Who can access it? Home routers have gotten pretty good about sane defaults these days, but at a minimum I'd be disabling UPnP and looking over what those defaults are before trusting it to protect my network.
  - collegeburner 4y ago
    which is literally the same situation as if you had a device local firewall? sensible defaults and you learn to configure for stuff you want to change.
    - 4y ago

asimops 4y ago

I agree that NATv6 is a bad idea, but imo we neeed firewalls on the router. Because on paper a endpoint firewall is a good idea, because you take that with you even when you change the network, but... then there is the Windows firewall: - Applications that punch their own holes, like steam - Windows which grants itself inbound exceptions and reenables them if you disable them - A non standard filtering order (deny is always defore allow, not in order) And then there are all those born in the 80s people that were told on LAN parties to "just disable the Windows firewall" and kept doing so.

bob1029 4y ago
> And then there are all those born in the 80s people that were told on LAN parties to "just disable the Windows firewall" and kept doing so. You caught me. I think a firewall on the router is absolutely essential regardless of NAT scenarios. With the understanding that you have an entire generation of computer users who equate that internet box with some degree of safety, you will find less friction with some tweak to that experience. You can still call it "port forwarding", block all inbound by default, and keep most of the same UX. I personally like to operate my home network like a DMZ. Being able to reach any computer from any other without screwing around with networking is very convenient to me. I operate with an all-or-nothing trust model on my LAN. Having some centralized firewall helps a lot with this.
- em-bee 4y ago
  i would like to know why anyone would disagree with the parent comment.
johnklos 4y ago
Firewalls are only necessary for OSes that open ports without good reasons and without good controls. In other words, your reaction is justified if you think Windows is normal and an example of how things should be. The rest of the world, though, knows that you don't just randomly open ports without good reason and without ways to turn off services.
- 4y ago