4 ms·

Sorry I do not trust the likes of home router vendors to implement a linux firewall correctly While people may say "NAT is Not security", it is in fact a laye

Sorry I do not trust the likes of home router vendors to implement a linux firewall correctly While people may say "NAT is Not security", it is in fact a layer (ahd huge one) in the security onion, that ipV6 is likely going to increase drastically the amount of ransomware and other malware on the public internet simply because that NAT layer is gone

yamtaddle 4y ago
I remember what it was like when lots more home computers were routable from the public Internet, because having a NAT router between them and there wasn't a nearly-100%-adoption thing yet. In fact, I worked at an ISP (dial-up and DSL) in that era. It was indeed a shit-show. Adding a NATting router to those set-ups instantly increased their security tremendously. Sure you could use a proper firewall, but the router w/NAT Just Works.
- phpisthebest 4y ago
  I cant wait until all the printers, and webcams all showup on the public internet again....
  - yamtaddle 4y ago
    Portscanning for smb shares and webcams, LOL. Good times. Found entire offices routing their whole network publicly, back then, shared network drives and printers right there for use by anyone who stumbled on them. It was nuts. Worms spread like crazy. It was a real mess, and that's with the Internet being way the fuck friendlier than it is now.
    - garbagecoder 4y ago
      What's ironic is that the IPv6 people will tell you you can do all of that with IPv6. Which is true, but if we NEED TO CHANGE because we're out of addresses then why go to something that doesn't use the address space? The problem IPv6 seeks to address has mostly been engineered around for now.
      - JohnFen 4y ago
        > The problem IPv6 seeks to address has mostly been engineered around for now. For now is the operative phrase. These are band-aids to keep IPv4 running, but they won't be effective forever.
JohnFen 4y ago
> Sorry I do not trust the likes of home router vendors to implement a linux firewall correctly Neither do I, but that's a fixable situation. Get an appliance router that lets you put DD-WRT (or similar) on it. Or use a computer instead of an appliance and set it up any way you like.
- phpisthebest 4y ago
  I am by trade a network administrator, and I run enterprise gear in my home. I am not running a home router or dd-wrt. But I am not a typlical user going down to best buy to pick up the latest Belkin or Asus wireless AP / router combo they have on sale for $99 and hooking it up to my internet using default "wizard" settings from the mobile app... Nor I am I trusting Comcast, or ATT to configure their residental rented equipment properly with proper firewall rules My comment is not about me, I have enterprise grade nextgen firewalls that are $$ My comment is about Grandma that calls up comcast to have them set it all up, or Sally that is going into best buy for the "Geek Squad" so hook her up...
  - Symbiote 4y ago
    Large ISPs like Comcast already have enormous IPv6 networks, and have appropriate, default-deny firewall configurations for them. I'm only familiar with the largest ISPs in Britain, but they also have default-deny configurations on the IPv6 routers they supply. Obviously. > Grandma / Sally Try avoiding the casual ageism and sexism.
    - phpisthebest 4y ago
      >Try avoiding the casual ageism and sexism. Try not to find offense in all things, feel free to refer to my comment thread from the other day about offense being a you problem not a me problem ;)
  - KerrAvon 4y ago
    If I’m following your logic, you’re saying you trust tplink etc to keep Grandma safe, but only for IPv4, and not IPv6? Why?
blibble 4y ago
> that ipV6 is likely going to increase drastically the amount of ransomware and other malware on the public internet simply because that NAT layer is gone malware has connected outwards to c&c servers for more than 20 years
pixl97 4y ago
This is one of the worst takes I've seen in this thread. NAT is only kind of a firewall and there have been plenty of terrible router firmwares out there that have lead people to subvert it (UPNP being one of the most problematic). If you in your other thread don't trust the ISP device, then don't trust NAT on your ISP device either. Quite often the ISP can have their modem route traffic from their internal 10 net to your internal network if they so choose to. Instead IPv4, or IPv6 setup to drop NEW/SYN connections to your devices via a router that you provide.
- phpisthebest 4y ago
  >If you in your other thread don't trust the ISP device, then don't trust NAT on your ISP device either There is no logic there. firewall configuration is much harder to secure than NAT configuration.
  - lmm 4y ago
    > There is no logic there. firewall configuration is much harder to secure than NAT configuration. Disagree. Just the XML parsing logic required for uPnP alone is more complex than a basic firewall implementation.
    - JohnFen 4y ago
      uPnP seems a distraction from the topic. It's not necessary for networking to network -- my LAN intentionally does not support it at all. It is necessary for certain use cases, of course, but it's not mandatory in a network in the general case.
      - lmm 4y ago
        It's necessary for feature parity with IPv6 (or, equivalently, with the 2000s-era Internet). Even if you don't use uPnP, the amount of complex protocol parsing necessary to support/work around NAT (e.g. SIP is particularly tricky) is a larger attack surface than a full IPv6 stack.

yamtaddle 4y ago

I remember what it was like when lots more home computers were routable from the public Internet, because having a NAT router between them and there wasn't a nearly-100%-adoption thing yet. In fact, I worked at an ISP (dial-up and DSL) in that era. It was indeed a shit-show. Adding a NATting router to those set-ups instantly increased their security tremendously. Sure you could use a proper firewall, but the router w/NAT Just Works.

phpisthebest 4y ago
I cant wait until all the printers, and webcams all showup on the public internet again....
- yamtaddle 4y ago
  Portscanning for smb shares and webcams, LOL. Good times. Found entire offices routing their whole network publicly, back then, shared network drives and printers right there for use by anyone who stumbled on them. It was nuts. Worms spread like crazy. It was a real mess, and that's with the Internet being way the fuck friendlier than it is now.
  - garbagecoder 4y ago
    What's ironic is that the IPv6 people will tell you you can do all of that with IPv6. Which is true, but if we NEED TO CHANGE because we're out of addresses then why go to something that doesn't use the address space? The problem IPv6 seeks to address has mostly been engineered around for now.
    - JohnFen 4y ago
      > The problem IPv6 seeks to address has mostly been engineered around for now. For now is the operative phrase. These are band-aids to keep IPv4 running, but they won't be effective forever.

JohnFen 4y ago

> Sorry I do not trust the likes of home router vendors to implement a linux firewall correctly Neither do I, but that's a fixable situation. Get an appliance router that lets you put DD-WRT (or similar) on it. Or use a computer instead of an appliance and set it up any way you like.

phpisthebest 4y ago
I am by trade a network administrator, and I run enterprise gear in my home. I am not running a home router or dd-wrt. But I am not a typlical user going down to best buy to pick up the latest Belkin or Asus wireless AP / router combo they have on sale for $99 and hooking it up to my internet using default "wizard" settings from the mobile app... Nor I am I trusting Comcast, or ATT to configure their residental rented equipment properly with proper firewall rules My comment is not about me, I have enterprise grade nextgen firewalls that are $$ My comment is about Grandma that calls up comcast to have them set it all up, or Sally that is going into best buy for the "Geek Squad" so hook her up...
- Symbiote 4y ago
  Large ISPs like Comcast already have enormous IPv6 networks, and have appropriate, default-deny firewall configurations for them. I'm only familiar with the largest ISPs in Britain, but they also have default-deny configurations on the IPv6 routers they supply. Obviously. > Grandma / Sally Try avoiding the casual ageism and sexism.
  - phpisthebest 4y ago
    >Try avoiding the casual ageism and sexism. Try not to find offense in all things, feel free to refer to my comment thread from the other day about offense being a you problem not a me problem ;)
- KerrAvon 4y ago
  If I’m following your logic, you’re saying you trust tplink etc to keep Grandma safe, but only for IPv4, and not IPv6? Why?

blibble 4y ago

> that ipV6 is likely going to increase drastically the amount of ransomware and other malware on the public internet simply because that NAT layer is gone malware has connected outwards to c&c servers for more than 20 years

pixl97 4y ago

This is one of the worst takes I've seen in this thread. NAT is only kind of a firewall and there have been plenty of terrible router firmwares out there that have lead people to subvert it (UPNP being one of the most problematic). If you in your other thread don't trust the ISP device, then don't trust NAT on your ISP device either. Quite often the ISP can have their modem route traffic from their internal 10 net to your internal network if they so choose to. Instead IPv4, or IPv6 setup to drop NEW/SYN connections to your devices via a router that you provide.

phpisthebest 4y ago
>If you in your other thread don't trust the ISP device, then don't trust NAT on your ISP device either There is no logic there. firewall configuration is much harder to secure than NAT configuration.
- lmm 4y ago
  > There is no logic there. firewall configuration is much harder to secure than NAT configuration. Disagree. Just the XML parsing logic required for uPnP alone is more complex than a basic firewall implementation.
  - JohnFen 4y ago
    uPnP seems a distraction from the topic. It's not necessary for networking to network -- my LAN intentionally does not support it at all. It is necessary for certain use cases, of course, but it's not mandatory in a network in the general case.
    - lmm 4y ago
      It's necessary for feature parity with IPv6 (or, equivalently, with the 2000s-era Internet). Even if you don't use uPnP, the amount of complex protocol parsing necessary to support/work around NAT (e.g. SIP is particularly tricky) is a larger attack surface than a full IPv6 stack.