4 ms·
Citation "IPv6 was designed to restore the end-to-end model of communications with all nodes on networks using globally unique addresses. But considering this,
by menotyou 3y ago
Citation "IPv6 was designed to restore the end-to-end model of communications with all nodes on networks using globally unique addresses. But considering this, IPv6 may imply privacy concerns due to greater visibility on the Internet."
- AndyMcConachie 3y agoThe IETF has never gotten off its anti-NAT high horse.
- mikecoles 3y agoNAT is horrible.
- BrianGragg 3y agoLeaned on heavily to protect cheap IOT devices. Could you imagine the bot armies if every IOT device was NOT behind a NAT?
- Zen1th 3y agoNAT shouldn't be used as a replacement for a firewall. So the answer was always to set up a firewall.
- deleted 3y ago[deleted]
- Dalewyn 3y agoThe virtues of NAT lie more in their nature of being blanket blacklist firewalls by default. This can indeed be replaced with firewalls on each IPv6 client, but you have to concede that just putting a router between your computer and modem adds a ton of security for very little effort or know-how. But NAT in itself is a workaround for IPv4 limitations with significant problems, which has become permanent because there's nothing as permanent as temporary solutions.
- Symbiote 3y agoEvery IPv6 router for home or small business use is initially configured with a default-deny firewall. The same for every router supplied by an ISP. This is so basic that any argument against it needs some strong evidence. You can search "IPv6 pinhole" and find plenty of documentation from router manufacturers and ISPs on this.
- briffle 3y agoNAT is not a firewall. NAT is a 'hack' that some firewalls use. My university only used routable IP addresses, but due to the wonders of firewalls, you could not connect to the HP printers in the library over the internet. Even though it had a routable IP.
- throw0101b 3y ago> Could you imagine the bot armies if every IOT device was NOT behind a NAT? Why? Firewalls have been around since before 1994, when Cheswick and Bellovin literally published the book on firewalls: * https://en.wikipedia.org/wiki/Firewalls_and_Internet_Security https://en.wikipedia.org/wiki/Firewalls_and_Internet_Securit...
- jiggawatts 3y agoEverybody looks like they're riding on a high horse when you're lying in the gutter.
- throw0101b 3y ago> The IETF has never gotten off its anti-NAT high horse. You say this like it's a bad thing. Why should it be necessary to have to deal with all the extraneous infrastructure of STUN/TURN/ICE just for basic connectivity? * https://en.wikipedia.org/wiki/STUN https://en.wikipedia.org/wiki/STUN * https://en.wikipedia.org/wiki/Interactive_Connectivity_Establishment https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab... You have your stateful firewall that does default-deny, only allowing in packets that are replies to internally-initiated sessions. If you need to do hole punching you have UPnP or PCP (which also allows for authentication of requests): * https://en.wikipedia.org/wiki/Internet_Gateway_Device_Protocol https://en.wikipedia.org/wiki/Internet_Gateway_Device_Protoc... * https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol
- rmwaite 3y agoNAT is a terrible hack
- midasuni 3y agoYet many implementations don’t do it and still do nat, and stateful network firewalls pretty much mean it’s meaningless anyway.
- ajsnigrutin 3y agoThe only difference is, that you're not "protected" by nat, so packets going back to you, can go back to you (but this is solved by a simple firewall installed by default on pretty much any ipv6 enabled CPE). With ipv6 privacy extensions, your IP address changes every few minutes (withoin the same /64 network) so it's not a lot different (privacy wise) than today, wher that whole network would be hidden behind a single IPv4 address.
- aPoCoMiLogin 3y agoNAT doesn't protect anything, firewall does that
- Gigachad 3y agoEvery consumer router I have seen blocks all incoming connections on ipv6 by default in pretty much the same way nat does. The only difference being that the UI allows multiple devices to listen on the same port now.
- dale_glass 3y agoIPv6 is actually better for privacy. First, the IPv4 address space is tiny. Say, a PING packet is 84 bytes, so pinging the entire IPv4 address space will take you all of 336GB of traffic each way (not even accounting for the reserved parts). That can be done in the space of an hour in a decent connection. So things can and are being trivially found by brute force. If a vulnerability is found in something interesting you can bet that by tomorrow lots of nefarious people figured out who can be broken into. Second, IPv6 has the privacy extensions, which means that even if somebody knows your address today, this has a very limited lifetime to it. Privacy extensions regularly randomize your IP address. Under IPv6 even normal people can get more address space than can be reasonably scanned. This makes it harder to identify machines permanently, makes it harder to figure out how many machines there are and makes brute force scanning extremely impractical.
- ectospheno 3y agoThe privacy is real. Moved to only binding ssh to ipv6 addresses on the internet. Cleanest ssh logs you will ever see. Basically invisible.