3 ms·

> #2 is people being nervous, but seriously the "DENY incoming on $WANIF if not in state table" rule is all you need. This didn’t exist. Many of the early impl

> #2 is people being nervous, but seriously the "DENY incoming on $WANIF if not in state table" rule is all you need. This didn’t exist. Many of the early implementations of “support” for ipv6 was a checkbox that said “enable”. These cheap routers (which is what the majority of people without deep pockets are on) rarely even gave you an explicit stateful firewall UI. If you got a “firewall” option at all, it was to block stuff from getting out of your network, not in. Know why? Because “NAT already did that”. If you wanted inbound unsolicited traffic you used port forwards or the “DMZ”. It’s not people being nervous, it’s the vast majority of network vendors not making the UX any good. I pushed people to try v6 hard, it was not the rosy transition it was supposed to be. v6 for a while ended up being a great accidental exfil path for malware for administrators that screwed this up. Don’t try to downplay it, it just makes you sound like an armchair quarterback, not smart. > #4 A /64 is a subnet. Normally all of your devices would be on the same subnet, although with IPv6 you get a whole bunch which is nice. A /60 is also a subnet, so is a /127. Subnetting is just breaking up larger IP spaces. Anyway, you missed the point of the comment. What I was getting at is that doing prefix delegation for home users for anything more than a /64 is immensely wasteful. Yet a bunch of very large ISPs do just that. Want to guess why? Once again, bone-headed implementations in off the shelf routers that do give a /64 per WiFi client. Untold waste in the v6 space because addressing guidance was (and still is) so poor.

jandrese 4y ago
If your firewall can do NAT (and spoiler alert: it can) then it has stateful logic built in. Maybe some of the really early home stuff didn't support it on IPv6, but that's long in the past. If you're worried about IPv6 using to exfil data then you're well beyond a great many administrators in locking down the network. Usually malware just exfils on IPv4 HTTPS because that's already allowed, and it's only avoided in places where the deep packet inspection services only run on IPv4. This is where you see a lot of corporate pushback on IPv6. The Deep Packet Inspection vendors have been very slow to adopt so corporate policy is often just to block all IPv6 period. I won't argue against a lot of home routers having egregiously bad firewall configuration UIs though. In IPv6 a /64 is special. It's the smallest network you are supposed to allocate. Some people think it is the equivalent of an IPv4 single address, but this isn't quite right. It is still a full subnet. It is better thought of as the IPv4 /24 behind a single NAT address. Home administrators are expected to put all of their hosts on it. Assigning a /64 to each client is not supposed to be a typical use case, and would be mostly to avoid having the clients inter-communicate. The problem however isn't wasted space, it's just that you'll exhaust your typical home /56 too quickly. I can see you're concerned about running out of IPv6 addresses due to excessive waste, but we've not even scratched the surface on them. The address space is mindbogglingly huge. A lot of the optimizations we have to do to save space with IPv4 are simply not relevant in IPv6.

jandrese 4y ago

If your firewall can do NAT (and spoiler alert: it can) then it has stateful logic built in. Maybe some of the really early home stuff didn't support it on IPv6, but that's long in the past. If you're worried about IPv6 using to exfil data then you're well beyond a great many administrators in locking down the network. Usually malware just exfils on IPv4 HTTPS because that's already allowed, and it's only avoided in places where the deep packet inspection services only run on IPv4. This is where you see a lot of corporate pushback on IPv6. The Deep Packet Inspection vendors have been very slow to adopt so corporate policy is often just to block all IPv6 period. I won't argue against a lot of home routers having egregiously bad firewall configuration UIs though. In IPv6 a /64 is special. It's the smallest network you are supposed to allocate. Some people think it is the equivalent of an IPv4 single address, but this isn't quite right. It is still a full subnet. It is better thought of as the IPv4 /24 behind a single NAT address. Home administrators are expected to put all of their hosts on it. Assigning a /64 to each client is not supposed to be a typical use case, and would be mostly to avoid having the clients inter-communicate. The problem however isn't wasted space, it's just that you'll exhaust your typical home /56 too quickly. I can see you're concerned about running out of IPv6 addresses due to excessive waste, but we've not even scratched the surface on them. The address space is mindbogglingly huge. A lot of the optimizations we have to do to save space with IPv4 are simply not relevant in IPv6.