3 ms·

IPv6 with default-deny firewalls in most places would break P2P communication too. No application would be able to rely on both users having open listening port

IPv6 with default-deny firewalls in most places would break P2P communication too. No application would be able to rely on both users having open listening ports. You ok with that? I keep hearing this have your cake and eat it too kind of argument. "It supports P2P" and "just default-deny if you're worried about security" do not mix. We get one or the other as the assumed default. IPv4 + NAT is the default-deny. IPv6 seems to be about default-allow even if that's not inherent to it.

orangeboats 3y ago
>IPv6 with default-deny firewalls in most places would break P2P communication too. That's why you have the PCP protocol to help you setup a hole in your firewall, you default-deny until some host in your network says "I can handle port 12345". If your router doesn't support that, in the worst case scenario you can fallback to manually setting up firewall entries much like NAT. Sure, PCP works in NAT cases too, but not always - especially in double-NAT or CGNAT scenarios. And we already know how prevalent CGNAT is, don't we? I don't know where do you live in, but here all ISPs have deployed CGNAT. By the way that's one of the disadvantages of having NAT, you are forced into a centralized architecture where the central node in the ISP (the CGNAT device) decides what kind of niceties you could get. IPv6, the ISP only carries traffic around and it does not meddle with layer 4 activities.