3 ms·

A lot of people expect a stateful firewall blocking incoming connections on their local network. Applying the same NAT system that is used for IPv4 to IPv6 is p

A lot of people expect a stateful firewall blocking incoming connections on their local network. Applying the same NAT system that is used for IPv4 to IPv6 is probably the best way to get this layer of security. Now in theory most devices should be safe to connect to the internet. But how many Internet of Shit devices are there in the average household that probably shouldn't be trusted? Crappy security cameras with 10 year old firmware written by the lowest bidder as well as "smart" thermostats that probably aren't much better. So maybe keeping the stateful firewall by default is the best option.

derefr 3y ago
> Applying the same NAT system that is used for IPv4 to IPv6 is probably the best way to get this layer of security. ...why? Routers have (stateful) firewalls, entirely separate from their NAT-ing abilities. You can still have the firewall without the NAT. (And the protocols that IoT devices rely on, like UPnP, are technically protocols for manipulating firewall rules, not NAT port-forwarding rules; so they still work fine without NAT in place.) > But how many Internet of Shit devices are there in the average household that probably shouldn't be trusted? I'm not sure about IPv4, but in IPv6 a given single logical interface can acquire multiple IPv6 addresses — meaning that your laptop or phone will have both a public global IPv6 address, and a link-local fe80:: IPv6 address. And things like multicast, DHCP discovery, etc. will only be attempted or accepted through that link-local address. Now imagine a router that combines that firewall rule, with a bit of logic to automatically assign devices that join the AP, to separate VLANs, depending on their MAC address vendor part. So laptops and phones go on the "home" VLAN, while IoT devices go on the "sandboxed" VLAN. Where these VLANs are peered, but with stateful firewall rules between them: "sandboxed" devices don't get to speak to "home" devices, unless the "home" device speaks to them first; and multicast packets from "home" devices won't reach "sandboxed" devices. In other words, a home-network gateway-router should have all the same defaults that an IaaS-tenant VPC does: nodes on the network have public-routable IPs; but all inbound ports to them are closed unless a device asks; and traffic flowing between those devices can only be seen by other devices intentionally put into that same VLAN, not by other "tenants" who happen to be sharing the same pipes.
jeroenhd 3y ago
> A lot of people expect a stateful firewall blocking incoming connections on their local network. Totally! That's why that's the default setting for almost every router out there. > Applying the same NAT system that is used for IPv4 to IPv6 is probably the best way to get this layer of security. No? The default firewall rules will work just fine. > So maybe keeping the stateful firewall by default is the best option. Agreed. That's why routers ship with fully-closed firewalls for both IPv4 and IPv6. Incoming connections need firewall exceptions, either manually or through UPnP depending on how you've configured your network. In fact, because of NAT issues like NAT slipstreaming, an IPv6 firewall is even more closed off than any IPv4 firewall that needs to let through FTP(S), SIP, and many other protocols depending on both sides of the connection using IPv4 as designed.

derefr 3y ago

> Applying the same NAT system that is used for IPv4 to IPv6 is probably the best way to get this layer of security. ...why? Routers have (stateful) firewalls, entirely separate from their NAT-ing abilities. You can still have the firewall without the NAT. (And the protocols that IoT devices rely on, like UPnP, are technically protocols for manipulating firewall rules, not NAT port-forwarding rules; so they still work fine without NAT in place.) > But how many Internet of Shit devices are there in the average household that probably shouldn't be trusted? I'm not sure about IPv4, but in IPv6 a given single logical interface can acquire multiple IPv6 addresses — meaning that your laptop or phone will have both a public global IPv6 address, and a link-local fe80:: IPv6 address. And things like multicast, DHCP discovery, etc. will only be attempted or accepted through that link-local address. Now imagine a router that combines that firewall rule, with a bit of logic to automatically assign devices that join the AP, to separate VLANs, depending on their MAC address vendor part. So laptops and phones go on the "home" VLAN, while IoT devices go on the "sandboxed" VLAN. Where these VLANs are peered, but with stateful firewall rules between them: "sandboxed" devices don't get to speak to "home" devices, unless the "home" device speaks to them first; and multicast packets from "home" devices won't reach "sandboxed" devices. In other words, a home-network gateway-router should have all the same defaults that an IaaS-tenant VPC does: nodes on the network have public-routable IPs; but all inbound ports to them are closed unless a device asks; and traffic flowing between those devices can only be seen by other devices intentionally put into that same VLAN, not by other "tenants" who happen to be sharing the same pipes.

jeroenhd 3y ago

> A lot of people expect a stateful firewall blocking incoming connections on their local network. Totally! That's why that's the default setting for almost every router out there. > Applying the same NAT system that is used for IPv4 to IPv6 is probably the best way to get this layer of security. No? The default firewall rules will work just fine. > So maybe keeping the stateful firewall by default is the best option. Agreed. That's why routers ship with fully-closed firewalls for both IPv4 and IPv6. Incoming connections need firewall exceptions, either manually or through UPnP depending on how you've configured your network. In fact, because of NAT issues like NAT slipstreaming, an IPv6 firewall is even more closed off than any IPv4 firewall that needs to let through FTP(S), SIP, and many other protocols depending on both sides of the connection using IPv4 as designed.