5 ms·

In the era of IPv6 you can't assume that your device is implicitly firewalled for incoming connections. My smartphone currently has a public IPv6 address from

by retrac 3y ago

In the era of IPv6 you can't assume that your device is implicitly firewalled for incoming connections. My smartphone currently has a public IPv6 address from my relative's home wifi network.

tomrod 3y ago
Oh I didn't realize that. How can that be identified and locked down?
- thfuran 3y ago
  IPv6 is intended to always use public addresses. If you have an ipv6 address, it's probably public. But that doesn't necessarily mean there's no firewall.
- mulmen 3y ago
  You can go to https://whatismyipaddress.com/ https://whatismyipaddress.com/ and get your public IP then paste it at https://ipspy.net/nmap https://ipspy.net/nmap to port scan yourself.
  - codetrotter 3y ago
    Your link does not report my public IPv6 address. Only my public IPv4 address. Here is a service that will show you both your public IPv4 and your public IPv6 address. https://whatismyipaddress.com/ https://whatismyipaddress.com/
    - mulmen 3y ago
      Ah, thanks. I don't have an IPv6 address so I couldn't check. Still, that's the only nmap-in-a-website I'm aware of. There are probably others. Does the nmap scan work on IPv6? That site might actually only be IPv4...
      - codetrotter 3y ago
        I tried the online scan that you linked with my IPv6 address. At the end it said Nmap done: 0 IP addresses (0 hosts up) scanned in 2.20 seconds Even though it claims to support IPv6 Also the site spent a whole lot of time showing progress bars and stuff. Whereas when I run Nmap from one of my servers on the internet against my public home IPv6 address % nmap -6 -A -T4 2a0c:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx I get: Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-16 17:43 CEST Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 2.23 seconds So in conclusion yeah, that site you linked was not able to scan IPv6 I think better than that online version of Nmap is to run Nmap from another computer on another IPv6 enabled network against your own public home IPv6 address. Assuming you have additional computers like a server or a VPS, etc. Same way I did. Another possible alternative is to use shodan.io and check what they have found in their past scans for your IP address. Seems that shodan requires creating an account now in order to use it. Not sure if it did before. I remember testing shodan.io a few years ago but don’t remember if I had to create an account then.
        mr_mitm 3y ago
        It might just be that your host is blocking all IPv6 probes, as nmap reports, in which case your host would already be in your desired configuration. Also I'd be extremely surprised if Shodan had anything on your IPv6 address.
        codetrotter 3y ago
        Notice the difference of their output: Nmap done: 0 IP addresses (0 hosts up) scanned in 2.20 seconds And mine: Nmap done: 1 IP address (0 hosts up) scanned in 2.23 seconds And note that 0 IP addresses scanned is exactly what you get if you run nmap with an IPv6 address as target but without the -6 flag. They probably are doing just that; running nmap without the -6 flag. But let's try something else. % host google.com google.com has address 142.250.184.14 google.com has IPv6 address 2a00:1450:4003:808::200e google.com mail is handled by 10 smtp.google.com. % nmap -6 -A -T4 2a00:1450:4003:808::200e Starting Nmap 7.80 ( https://nmap.org ) at 2023-07-16 16:53 BST Nmap scan report for mad06s10-in-x0e.1e100.net (2a00:1450:4003:808::200e) Host is up (0.032s latency). Not shown: 998 filtered ports PORT STATE SERVICE VERSION 80/tcp open http gws [...] Nmap done: 1 IP address (1 host up) scanned in 76.10 seconds And now try putting 2a00:1450:4003:808::200e into their web tool and see what they report. At the moment their website will get 0 addresses scanned for that as well. Nmap done: 0 IP addresses (0 hosts up) scanned in 1.58 seconds
  - backendanon 3y ago
    I prefer https://www.whatsmyip.org/ https://www.whatsmyip.org/
- vel0city 3y ago
  Firewalls. In the network path. On the device. They control what packets get allowed or denied.
irdc 3y ago
But have you actually tested connecting to it from outside the network? Just because something has a public IPv6 address doesn't mean there isn't a firewall somewhere in between. It just means there's no NAT.
Roark66 3y ago
I wish we lived "in the era of ipv6". Unfortunately one of the biggest mobile providers in my country (and the only one available to me at reasonable speed) has no ipv6 setup. Also, they NAT their entire network. So, to have any way to connect back to my home network I have to run a permanent vpn to a server in aws and connect to that.

by retrac 3y ago

In the era of IPv6 you can't assume that your device is implicitly firewalled for incoming connections. My smartphone currently has a public IPv6 address from my relative's home wifi network.

tomrod 3y ago

Oh I didn't realize that. How can that be identified and locked down?

thfuran 3y ago
IPv6 is intended to always use public addresses. If you have an ipv6 address, it's probably public. But that doesn't necessarily mean there's no firewall.
mulmen 3y ago
You can go to https://whatismyipaddress.com/ https://whatismyipaddress.com/ and get your public IP then paste it at https://ipspy.net/nmap https://ipspy.net/nmap to port scan yourself.
- codetrotter 3y ago
  Your link does not report my public IPv6 address. Only my public IPv4 address. Here is a service that will show you both your public IPv4 and your public IPv6 address. https://whatismyipaddress.com/ https://whatismyipaddress.com/
  - mulmen 3y ago
    Ah, thanks. I don't have an IPv6 address so I couldn't check. Still, that's the only nmap-in-a-website I'm aware of. There are probably others. Does the nmap scan work on IPv6? That site might actually only be IPv4...
    - codetrotter 3y ago
      I tried the online scan that you linked with my IPv6 address. At the end it said Nmap done: 0 IP addresses (0 hosts up) scanned in 2.20 seconds Even though it claims to support IPv6 Also the site spent a whole lot of time showing progress bars and stuff. Whereas when I run Nmap from one of my servers on the internet against my public home IPv6 address % nmap -6 -A -T4 2a0c:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx I get: Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-16 17:43 CEST Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 2.23 seconds So in conclusion yeah, that site you linked was not able to scan IPv6 I think better than that online version of Nmap is to run Nmap from another computer on another IPv6 enabled network against your own public home IPv6 address. Assuming you have additional computers like a server or a VPS, etc. Same way I did. Another possible alternative is to use shodan.io and check what they have found in their past scans for your IP address. Seems that shodan requires creating an account now in order to use it. Not sure if it did before. I remember testing shodan.io a few years ago but don’t remember if I had to create an account then.
      - mr_mitm 3y ago
        It might just be that your host is blocking all IPv6 probes, as nmap reports, in which case your host would already be in your desired configuration. Also I'd be extremely surprised if Shodan had anything on your IPv6 address.
        codetrotter 3y ago
        Notice the difference of their output: Nmap done: 0 IP addresses (0 hosts up) scanned in 2.20 seconds And mine: Nmap done: 1 IP address (0 hosts up) scanned in 2.23 seconds And note that 0 IP addresses scanned is exactly what you get if you run nmap with an IPv6 address as target but without the -6 flag. They probably are doing just that; running nmap without the -6 flag. But let's try something else. % host google.com google.com has address 142.250.184.14 google.com has IPv6 address 2a00:1450:4003:808::200e google.com mail is handled by 10 smtp.google.com. % nmap -6 -A -T4 2a00:1450:4003:808::200e Starting Nmap 7.80 ( https://nmap.org ) at 2023-07-16 16:53 BST Nmap scan report for mad06s10-in-x0e.1e100.net (2a00:1450:4003:808::200e) Host is up (0.032s latency). Not shown: 998 filtered ports PORT STATE SERVICE VERSION 80/tcp open http gws [...] Nmap done: 1 IP address (1 host up) scanned in 76.10 seconds And now try putting 2a00:1450:4003:808::200e into their web tool and see what they report. At the moment their website will get 0 addresses scanned for that as well. Nmap done: 0 IP addresses (0 hosts up) scanned in 1.58 seconds
- backendanon 3y ago
  I prefer https://www.whatsmyip.org/ https://www.whatsmyip.org/
vel0city 3y ago
Firewalls. In the network path. On the device. They control what packets get allowed or denied.

irdc 3y ago

But have you actually tested connecting to it from outside the network? Just because something has a public IPv6 address doesn't mean there isn't a firewall somewhere in between. It just means there's no NAT.

Roark66 3y ago

I wish we lived "in the era of ipv6". Unfortunately one of the biggest mobile providers in my country (and the only one available to me at reasonable speed) has no ipv6 setup. Also, they NAT their entire network. So, to have any way to connect back to my home network I have to run a permanent vpn to a server in aws and connect to that.