3 ms·
From practical standpoint, most common NAT setups come with "default deny incoming" firewall, and systems have relied on this fot a very long time. I hope tha
by theamk 4y ago
From practical standpoint, most common NAT setups come with "default deny incoming" firewall, and systems have relied on this fot a very long time.
I hope that IPv6 is rolled out to homes, most ISPs would do the right thing and set up customer routers firewall in "default deny incoming " mode. Otherwise, the number of worms would increase a lot.
- qalmakka 4y agoWe may argue that Windows Firewall (and macOS) by default already do that. On Linux, I usually set nftables like such on all my machines, but it's trivial for "user friendly" distros to ship sane defaults for nftables. What scares me a lot is that lots of folks out there still rely on iptables, and do not realize that they need ip6tables to set IPv6 tables - I dread of the moment some random ISP will push IPv6 routes, SLAAC picks up an IPv6 on a random Linux box and that box gets instantly pwned because it has no ip6tables rule whatsoever blocking inbound traffic.
- extra88 4y agoThe many embedded devices in homes are much scarier than home sysadmins not configuring their boxes correctly.