4 ms·

>Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. Don't forget the context: we were talking about "remo

>Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. Don't forget the context: we were talking about "removing NAT as an extra goal of IPv6," not "does it matter when was NAT invented". So here I am reiterating my point again: It was never an extra goal, considering that IPv6 was designed in an era when NAT never predominated the internet. >What's the big problem with NAT existing anyway, Oooh no biggie other than breaking all sorts of P2P communication? It's so bad that we have to implement literal hacks like TURN and STUN on top of the hack that is NAT itself. Or maybe we can talk about how it broke all sorts of protocols so badly that we to this day need application-level gateways[1] to help those protocols transverse NAT? Or let's have some time to talk about how inefficient NAT is. You should know it requires computing power to track each connection flow and to maintain a state table for those flows. >So it seems like ipv6 is about pushing default-allow behaviors onto network operators. Again this is pretty separate from the address space crisis. What are you talking about? Default-allow and default-deny are both firewall rules. Even NAT (the "full-cone" or "endpoint-independent" ones) is prone to this, if a port is open everyone can connect to you through the IP:port. I would say removal of NAT and addressing space is closely intertwined, but alas you seem to have pretty amateurish understanding of it. Also, just in case you bring up your IPv4.1 again: all address space enlarging efforts will inevitably face incompatibility issues. [1]: https://en.wikipedia.org/wiki/Application-level_gateway https://en.wikipedia.org/wiki/Application-level_gateway

hot_gril 3y ago
IPv6 with default-deny firewalls in most places would break P2P communication too. No application would be able to rely on both users having open listening ports. You ok with that? I keep hearing this have your cake and eat it too kind of argument. "It supports P2P" and "just default-deny if you're worried about security" do not mix. We get one or the other as the assumed default. IPv4 + NAT is the default-deny. IPv6 seems to be about default-allow even if that's not inherent to it.
- orangeboats 3y ago
  >IPv6 with default-deny firewalls in most places would break P2P communication too. That's why you have the PCP protocol to help you setup a hole in your firewall, you default-deny until some host in your network says "I can handle port 12345". If your router doesn't support that, in the worst case scenario you can fallback to manually setting up firewall entries much like NAT. Sure, PCP works in NAT cases too, but not always - especially in double-NAT or CGNAT scenarios. And we already know how prevalent CGNAT is, don't we? I don't know where do you live in, but here all ISPs have deployed CGNAT. By the way that's one of the disadvantages of having NAT, you are forced into a centralized architecture where the central node in the ISP (the CGNAT device) decides what kind of niceties you could get. IPv6, the ISP only carries traffic around and it does not meddle with layer 4 activities.

hot_gril 3y ago

IPv6 with default-deny firewalls in most places would break P2P communication too. No application would be able to rely on both users having open listening ports. You ok with that? I keep hearing this have your cake and eat it too kind of argument. "It supports P2P" and "just default-deny if you're worried about security" do not mix. We get one or the other as the assumed default. IPv4 + NAT is the default-deny. IPv6 seems to be about default-allow even if that's not inherent to it.

orangeboats 3y ago
>IPv6 with default-deny firewalls in most places would break P2P communication too. That's why you have the PCP protocol to help you setup a hole in your firewall, you default-deny until some host in your network says "I can handle port 12345". If your router doesn't support that, in the worst case scenario you can fallback to manually setting up firewall entries much like NAT. Sure, PCP works in NAT cases too, but not always - especially in double-NAT or CGNAT scenarios. And we already know how prevalent CGNAT is, don't we? I don't know where do you live in, but here all ISPs have deployed CGNAT. By the way that's one of the disadvantages of having NAT, you are forced into a centralized architecture where the central node in the ISP (the CGNAT device) decides what kind of niceties you could get. IPv6, the ISP only carries traffic around and it does not meddle with layer 4 activities.