3 ms·

CGNAT is pretty expensive compared to rolling out IPv6 and tunneling IPv4 on it using stuff like MAP-E. I guess they still have no need to NAT everyone ATM beca

CGNAT is pretty expensive compared to rolling out IPv6 and tunneling IPv4 on it using stuff like MAP-E. I guess they still have no need to NAT everyone ATM because they have plenty of IPv4s to distribute to their subscribers.

api 4y ago
That is correct. My ISP in Ohio gives me both IPv6 and global V4.
Scoundreller 4y ago
CGNAT is pretty much the only setup on mobile though. Dunno if any equipment vendor doesn’t do that. Would worry about most average cell phones sitting directly on the public internet. I think there’s a reason we haven’t heard about mass-owns of mobile phones and it’s because they’re always effectively behind firewalls, not because of their superior security.
- qalmakka 4y ago
  This is not correct. Especially in the USA lots of mobile phones now have IPv6 connectivity. From https://www.arin.net/blog/2020/01/16/mobile-edge-of-the-internet-is-rapidly-moving-to-ipv6/ https://www.arin.net/blog/2020/01/16/mobile-edge-of-the-inte... "80% of smartphones in the US on the major cellular network operators use IPv6 and major mobile networks are driving IPv6 adoption with Verizon Wireless at 84%, Sprint at 70%, T-Mobile USA at 93%, and AT&T Wireless at 57%" And this were numbers from four years ago. NAT is not a firewall and it's dangerous to think of it as such, because it causes people to follow a lax approach to security and think they are protected, when they actually aren't.
  - Scoundreller 4y ago
    That’s fine and all: but are they issuing mobile phones a publicly addressable IP or not? Can a Verizon subscriber run a web server on their mobile phone and share their IPv6 or not?
    - qalmakka 4y ago
      NAT66 is, in general, utterly broken and most OSes prefer IPv4 to ULAs - thus, if a mobile subscriber can connect to an external IPv6 service, it's very likely the address they were given by their carrier is publicly routable.
  - theamk 4y ago
    From practical standpoint, most common NAT setups come with "default deny incoming" firewall, and systems have relied on this fot a very long time. I hope that IPv6 is rolled out to homes, most ISPs would do the right thing and set up customer routers firewall in "default deny incoming " mode. Otherwise, the number of worms would increase a lot.
    - qalmakka 4y ago
      We may argue that Windows Firewall (and macOS) by default already do that. On Linux, I usually set nftables like such on all my machines, but it's trivial for "user friendly" distros to ship sane defaults for nftables. What scares me a lot is that lots of folks out there still rely on iptables, and do not realize that they need ip6tables to set IPv6 tables - I dread of the moment some random ISP will push IPv6 routes, SLAAC picks up an IPv6 on a random Linux box and that box gets instantly pwned because it has no ip6tables rule whatsoever blocking inbound traffic.
      - extra88 4y ago
        The many embedded devices in homes are much scarier than home sysadmins not configuring their boxes correctly.
Duralias 4y ago
For some reason CGNAT seems to be the norm here in Sweden, IPv6 is still almost nowhere to be seen, only existing in a select few cities. I've been behind CGNAT since I think 2010, at first with DSL with a small ISP and then with one of the big ones with fiber (bredband2), who introduced CGNAT many years ago to prepare for moving to IPv6, which they have still yet to do. They even stopped supporting their 6rd tunnel apparently.

api 4y ago

That is correct. My ISP in Ohio gives me both IPv6 and global V4.

Scoundreller 4y ago

CGNAT is pretty much the only setup on mobile though. Dunno if any equipment vendor doesn’t do that. Would worry about most average cell phones sitting directly on the public internet. I think there’s a reason we haven’t heard about mass-owns of mobile phones and it’s because they’re always effectively behind firewalls, not because of their superior security.

qalmakka 4y ago
This is not correct. Especially in the USA lots of mobile phones now have IPv6 connectivity. From https://www.arin.net/blog/2020/01/16/mobile-edge-of-the-internet-is-rapidly-moving-to-ipv6/ https://www.arin.net/blog/2020/01/16/mobile-edge-of-the-inte... "80% of smartphones in the US on the major cellular network operators use IPv6 and major mobile networks are driving IPv6 adoption with Verizon Wireless at 84%, Sprint at 70%, T-Mobile USA at 93%, and AT&T Wireless at 57%" And this were numbers from four years ago. NAT is not a firewall and it's dangerous to think of it as such, because it causes people to follow a lax approach to security and think they are protected, when they actually aren't.
- Scoundreller 4y ago
  That’s fine and all: but are they issuing mobile phones a publicly addressable IP or not? Can a Verizon subscriber run a web server on their mobile phone and share their IPv6 or not?
  - qalmakka 4y ago
    NAT66 is, in general, utterly broken and most OSes prefer IPv4 to ULAs - thus, if a mobile subscriber can connect to an external IPv6 service, it's very likely the address they were given by their carrier is publicly routable.
- theamk 4y ago
  From practical standpoint, most common NAT setups come with "default deny incoming" firewall, and systems have relied on this fot a very long time. I hope that IPv6 is rolled out to homes, most ISPs would do the right thing and set up customer routers firewall in "default deny incoming " mode. Otherwise, the number of worms would increase a lot.
  - qalmakka 4y ago
    We may argue that Windows Firewall (and macOS) by default already do that. On Linux, I usually set nftables like such on all my machines, but it's trivial for "user friendly" distros to ship sane defaults for nftables. What scares me a lot is that lots of folks out there still rely on iptables, and do not realize that they need ip6tables to set IPv6 tables - I dread of the moment some random ISP will push IPv6 routes, SLAAC picks up an IPv6 on a random Linux box and that box gets instantly pwned because it has no ip6tables rule whatsoever blocking inbound traffic.
    - extra88 4y ago
      The many embedded devices in homes are much scarier than home sysadmins not configuring their boxes correctly.

Duralias 4y ago

For some reason CGNAT seems to be the norm here in Sweden, IPv6 is still almost nowhere to be seen, only existing in a select few cities. I've been behind CGNAT since I think 2010, at first with DSL with a small ISP and then with one of the big ones with fiber (bredband2), who introduced CGNAT many years ago to prepare for moving to IPv6, which they have still yet to do. They even stopped supporting their 6rd tunnel apparently.