5 ms·

IPv6 is still pretty useless to most people... Actually for me it complicates my firewall rules and don't bring any benefits (yeah down-vote me and don't reply

IPv6 is still pretty useless to most people... Actually for me it complicates my firewall rules and don't bring any benefits (yeah down-vote me and don't reply ...)

johnklos 3y ago
I'll downvote you AND I'll reply. It complicates firewall rules? How about pass everything out, keeping state, and block everything in, for all of your fragile devices that can't help but run services you can't turn off? There. Your IPv6 firewalling is done. Is that complicated? You can't see any benefits? Ok. So what does that have to do with HN being available over IPv6?
- apapapa 3y ago
  Because you can access a website on both ipv4 and IPv6 doesn't really make IPv6 all that useful because you could disable it and still be able to access the same resource using ipv4...
  - orangeboats 3y ago
    >IPv6 is still pretty useless to most people My, the luxury of not being put under a CGNAT.
tsimionescu 3y ago
I don't understand what you mean by complicating firewall rules,except maybe that you now need to use IPv6 addresses instead of IPv4 addresses in some of the rules. It's not like NAT without a firewall gave any security in 2024.
- geraldhh 3y ago
  there is no nat w/o a "firewall" and yes, it will be more secure
  - jeroenhd 3y ago
    Actually, unless you disable all application layer gateways in your NAT, your IPv4 firewall can be bypassed quite easily. I don't know of any IPv4 NAT implementations where the ALG don't override the firewall (because that's the point of them). If you configure NAT+firewall you're going to be somewhat resistant to configuration mistakes, but you can do the same thing on IPv6 if you really want to. However, for most consumer devices, all you get is "NAT instead if a firewall WITH NAT bypass methods so you can still use SIP and FTP".
  - cesarb 3y ago
    > there is no nat w/o a "firewall" Actually, there is! People normally don't notice because NAT is usually co-located with a stateful firewall (since both need connection tracking to work, unless it's the rarer 1:1 NAT). But you can run NAT with firewall disabled, and in that case, it's possible in some cases for a device on the outside to access a device on the inside. For instance, suppose a NAT router with 192.168.0.x/24 on the inside, and 192.0.2.1/24 on the outside. A malicious device at 192.0.2.2, on the same level 2 network as the router, wants to attack a host inside the NAT. The malicious device can send a packet with IPv4 destination address 192.168.0.x and the Ethernet destination address of the 192.0.2.1 router; if that router has its stateful firewall disabled, it will accept the packet and route it to the target device. That is: what "protects" devices on a NAT without a firewall is not the NAT, but the use of non-globally-routeable addresses within the NAT, since a packet from the outside won't find a route to your NAT router; but if someone manages to route the packet to your NAT router anyway, it'll be accepted unless a firewall rule blocks it. (If you want non-globally-routeable IPv6 addresses, you can use ULA addresses, which have similar properties to the IPv4 private addresses.)
    - geraldhh 3y ago
      true, un-statefull nat's exist but their usefullness is limited
      - Dagger2 3y ago
        The post you replied to was talking about stateful NAT. Stateful NAT doesn't firewall either. If you do what they described, you'll be able to connect in just fine unless there's a separate firewall blocking it.
- apapapa 3y ago
  More rules equals more complexity....
rnhmjoj 3y ago
Yeah, sure: managing both IPv4 and IPv6 on the same network is painful. Thankfully you can disable IPv4 locally and set up NAT64 on the router: most people won't even notice the change.
mkl 3y ago
"Pretty useless" is nonsense; Google works on IPv6, and 41% of Google's users access it via IPv6 [1]. "Most people" is also not true: most internet users use Google [2] (those not accessing it via IPv6 probably can't). [1] https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html [2] https://www.statista.com/statistics/216573/worldwide-market-share-of-search-engines/ https://www.statista.com/statistics/216573/worldwide-market-...
- apapapa 3y ago
  Because you can access a website on both ipv4 and IPv6 doesn't really make IPv6 all that useful because you could disable it and still be able to access the same resource using ipv4...
  - ivlad 3y ago
    By that logic, you can disable IPv4 and still access the site via IPv6. IPv4 is useless. Also, running dual-stacked servers I can confirm, all scans come via IPv4, so not only it is useless, it’s actually less secure to use it.
    - apapapa 3y ago
      By that measure, port 22 is useless because you can change it....
  - patmorgan23 3y ago
    How about all of the people who wouldn't be able to access the Internet because their country doesn't have enough v4 address. Or who's internet connection is better/faster because they're no longer behind a CG-NAT. (Think mobile carriers, developing countries, China, India, etc)

IPv6 is still pretty useless to most people... Actually for me it complicates my firewall rules and don't bring any benefits (yeah down-vote me and don't reply ...)

johnklos 3y ago

I'll downvote you AND I'll reply. It complicates firewall rules? How about pass everything out, keeping state, and block everything in, for all of your fragile devices that can't help but run services you can't turn off? There. Your IPv6 firewalling is done. Is that complicated? You can't see any benefits? Ok. So what does that have to do with HN being available over IPv6?

apapapa 3y ago
Because you can access a website on both ipv4 and IPv6 doesn't really make IPv6 all that useful because you could disable it and still be able to access the same resource using ipv4...
- orangeboats 3y ago
  >IPv6 is still pretty useless to most people My, the luxury of not being put under a CGNAT.

tsimionescu 3y ago

I don't understand what you mean by complicating firewall rules,except maybe that you now need to use IPv6 addresses instead of IPv4 addresses in some of the rules. It's not like NAT without a firewall gave any security in 2024.

geraldhh 3y ago
there is no nat w/o a "firewall" and yes, it will be more secure
- jeroenhd 3y ago
  Actually, unless you disable all application layer gateways in your NAT, your IPv4 firewall can be bypassed quite easily. I don't know of any IPv4 NAT implementations where the ALG don't override the firewall (because that's the point of them). If you configure NAT+firewall you're going to be somewhat resistant to configuration mistakes, but you can do the same thing on IPv6 if you really want to. However, for most consumer devices, all you get is "NAT instead if a firewall WITH NAT bypass methods so you can still use SIP and FTP".
- cesarb 3y ago
  > there is no nat w/o a "firewall" Actually, there is! People normally don't notice because NAT is usually co-located with a stateful firewall (since both need connection tracking to work, unless it's the rarer 1:1 NAT). But you can run NAT with firewall disabled, and in that case, it's possible in some cases for a device on the outside to access a device on the inside. For instance, suppose a NAT router with 192.168.0.x/24 on the inside, and 192.0.2.1/24 on the outside. A malicious device at 192.0.2.2, on the same level 2 network as the router, wants to attack a host inside the NAT. The malicious device can send a packet with IPv4 destination address 192.168.0.x and the Ethernet destination address of the 192.0.2.1 router; if that router has its stateful firewall disabled, it will accept the packet and route it to the target device. That is: what "protects" devices on a NAT without a firewall is not the NAT, but the use of non-globally-routeable addresses within the NAT, since a packet from the outside won't find a route to your NAT router; but if someone manages to route the packet to your NAT router anyway, it'll be accepted unless a firewall rule blocks it. (If you want non-globally-routeable IPv6 addresses, you can use ULA addresses, which have similar properties to the IPv4 private addresses.)
  - geraldhh 3y ago
    true, un-statefull nat's exist but their usefullness is limited
    - Dagger2 3y ago
      The post you replied to was talking about stateful NAT. Stateful NAT doesn't firewall either. If you do what they described, you'll be able to connect in just fine unless there's a separate firewall blocking it.
apapapa 3y ago
More rules equals more complexity....

rnhmjoj 3y ago

Yeah, sure: managing both IPv4 and IPv6 on the same network is painful. Thankfully you can disable IPv4 locally and set up NAT64 on the router: most people won't even notice the change.

mkl 3y ago

"Pretty useless" is nonsense; Google works on IPv6, and 41% of Google's users access it via IPv6 [1]. "Most people" is also not true: most internet users use Google [2] (those not accessing it via IPv6 probably can't). [1] https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html [2] https://www.statista.com/statistics/216573/worldwide-market-share-of-search-engines/ https://www.statista.com/statistics/216573/worldwide-market-...

apapapa 3y ago
Because you can access a website on both ipv4 and IPv6 doesn't really make IPv6 all that useful because you could disable it and still be able to access the same resource using ipv4...
- ivlad 3y ago
  By that logic, you can disable IPv4 and still access the site via IPv6. IPv4 is useless. Also, running dual-stacked servers I can confirm, all scans come via IPv4, so not only it is useless, it’s actually less secure to use it.
  - apapapa 3y ago
    By that measure, port 22 is useless because you can change it....
- patmorgan23 3y ago
  How about all of the people who wouldn't be able to access the Internet because their country doesn't have enough v4 address. Or who's internet connection is better/faster because they're no longer behind a CG-NAT. (Think mobile carriers, developing countries, China, India, etc)