5 ms·

NAT is the main reason slowing down (or preventing) IPV6 adoption.

hot_gril 3y ago
NAT is a nice feature for home and office. Safe default-deny behavior, clearly separated LAN. I'd even want it with ipv6.
- miyuru 3y ago
  Don't you have any firewalls? My ISPs router blocks inbound connections by default on both address types.
  - hot_gril 3y ago
    I have firewalls but don't trust them to have safe defaults. Or more like, I don't trust every random router, including ones that each member of my extended family will inevitably call me about, to have safe firewall defaults until I test it myself. I reasonably trust, not 100% but pretty well, that my boss's or grandma's PC with ip 192.168.1.3 on NAT (not even routable from the WAN) will not receive inbound TCP/UDP. That would take effort.
    - orangeboats 3y ago
      Following this logic, don't trust your grandma's router to have UPnP and NAT-PMP disabled by default too. NAT becomes effectively unsecure with them. This argument is so overused we might as well add it to ipv6-excuses.txt.
      - hot_gril 3y ago
        Upnp is where the shred of doubt comes from. Only a shred because the PC very likely won't use it, and nowadays few routers have it by default. And the solution is, upnp shouldn't exist.
        orangeboats 3y ago
        >nowadays few routers have it by default And nowadays few routers have IPv6 firewall disabled by default... Do you see how fragile your argument is now?
        hot_gril 3y ago
        Enough routers still have ipv6 firewall disabled by default, in which case, every port on every networked device is exposed. Upnp, I'm less worried about being enabled, and even if it is, Windows won't map SMB to itself. In the long term with our world of cheap crappy routers, it's also much easier for upnp to die off than for ipv6 firewalls to become ubiquitously strong. Both of those are extra features that take effort to do right. So is NAT, but a broken NAT doesn't expose hosts.
        orangeboats 3y ago
        My grandparent's crappy ISP-sponsored router from ~2017 (maybe 2016), TP-Link C1200 v1, had the IPv6 firewall enabled by default. (It has UPnP enabled by default too... which I turned off promptly. They don't need it anyway.) My own Asus router from 2016, RT-AC1200G+, also came with IPv6 firewall enabled. Both routers are 8 years old at this point. And they are far from being a prosumer product. What router are you using that it doesn't come with IPv6 firewall enabled? edit: Oh, and my friend's cheapo Netis router (quite an obscure brand IMO) also had IPv6 firewall enabled out of the box. >ipv6 firewalls to become ubiquitously strong They don't need to be strong, the firewalls just have to be stateful so that they can drop unsolicited packets. It's that simple. Any other more sophisticated attacks would have made your NAT equally vulnerable as well. Additionally, stateful firewalls have been available since decades ago. They are not exactly black magic.
        hot_gril 3y ago
        I'll have to check the one I have at home when I get home. Airport Extreme is one example I remember not having ipv6 firewalling by default, even though it has it for v4.
  - dx034 3y ago
    Many internet users don't even know what the word firewall means. And there are a lot of devices with unpatched software. Obviously NAT shouldn't be seen as a firewall, but for many consumers it's pretty much the only line of defense. I don't know if ISPs without NATs automatically deploy firewalls, but would hope so. IPV6 is harder to scan, but once you know a device's IP address (e.g. from web logs), it'd be easy to exploit older devices.
    - hot_gril 3y ago
      One example, AT&T cellular gives you an ipv6 address besides v4, and it's still behind a NAT (not just a firewall). Though I'm glad my home ISP lets me decide that for myself.
  - tonymet 3y ago
    It's important to test this. I own an MSI router where the firewall is completely broken for IPV6. They even made the mistake of listening for DNS and HTTP (admin tool) on the external interface. IPv6 is still confusing for many developers
    - hot_gril 3y ago
      Exactly, even if my router says "ipv6 firewall enabled," I still can't trust that they did it right. I would rather go full NAT (which on most routers equals disabling IPv6) than have to pen-test my router.
      - orangeboats 3y ago
        "Full NAT" doesn't even make sense. Do you mean symmetric NAT or something in that vein? >which on most routers equals disabling IPv6 Turning on NAT on IPv4 certainly does not entail turning off IPv6. Just _what_ exactly are you sprouting? It's not the first time you have made beginner mistakes like this.
- Dagger2 3y ago
  NAT isn't a nice feature, it's a necessary evil to deal with address exhaustion in v4 and causes many problems of its own. Using it in v6 makes no sense. It doesn't have a "default deny" behavior -- NAT doesn't block connections at all. It doesn't separate your LAN either, that's done by having a router. If you want those things then NAT isn't the thing you want.
  - hot_gril 3y ago
    You're right that in a technical sense, NAT isn't block connections, more like it allows connections in the first place that would otherwise not be possible. But that's the best part. It's very hard for a misconfigured NAT to result in devices being exposed, unlike a true firewall, which is actively blocking connections to devices that would otherwise be totally reachable. NAT is sucky in plenty of server-side situations and is thus avoided, but in homes and offices, yeah I wouldn't want it any other way.
    - Dagger2 3y ago
      It's sucky in homes and offices too. It's not hard to test if your firewall is working. Using NAT to avoid that is not the sensible approach.

NAT is a nice feature for home and office. Safe default-deny behavior, clearly separated LAN. I'd even want it with ipv6.

miyuru 3y ago
Don't you have any firewalls? My ISPs router blocks inbound connections by default on both address types.
- hot_gril 3y ago
  I have firewalls but don't trust them to have safe defaults. Or more like, I don't trust every random router, including ones that each member of my extended family will inevitably call me about, to have safe firewall defaults until I test it myself. I reasonably trust, not 100% but pretty well, that my boss's or grandma's PC with ip 192.168.1.3 on NAT (not even routable from the WAN) will not receive inbound TCP/UDP. That would take effort.
  - orangeboats 3y ago
    Following this logic, don't trust your grandma's router to have UPnP and NAT-PMP disabled by default too. NAT becomes effectively unsecure with them. This argument is so overused we might as well add it to ipv6-excuses.txt.
    - hot_gril 3y ago
      Upnp is where the shred of doubt comes from. Only a shred because the PC very likely won't use it, and nowadays few routers have it by default. And the solution is, upnp shouldn't exist.
      - orangeboats 3y ago
        >nowadays few routers have it by default And nowadays few routers have IPv6 firewall disabled by default... Do you see how fragile your argument is now?
        hot_gril 3y ago
        Enough routers still have ipv6 firewall disabled by default, in which case, every port on every networked device is exposed. Upnp, I'm less worried about being enabled, and even if it is, Windows won't map SMB to itself. In the long term with our world of cheap crappy routers, it's also much easier for upnp to die off than for ipv6 firewalls to become ubiquitously strong. Both of those are extra features that take effort to do right. So is NAT, but a broken NAT doesn't expose hosts.
        orangeboats 3y ago
        My grandparent's crappy ISP-sponsored router from ~2017 (maybe 2016), TP-Link C1200 v1, had the IPv6 firewall enabled by default. (It has UPnP enabled by default too... which I turned off promptly. They don't need it anyway.) My own Asus router from 2016, RT-AC1200G+, also came with IPv6 firewall enabled. Both routers are 8 years old at this point. And they are far from being a prosumer product. What router are you using that it doesn't come with IPv6 firewall enabled? edit: Oh, and my friend's cheapo Netis router (quite an obscure brand IMO) also had IPv6 firewall enabled out of the box. >ipv6 firewalls to become ubiquitously strong They don't need to be strong, the firewalls just have to be stateful so that they can drop unsolicited packets. It's that simple. Any other more sophisticated attacks would have made your NAT equally vulnerable as well. Additionally, stateful firewalls have been available since decades ago. They are not exactly black magic.
        hot_gril 3y ago
        I'll have to check the one I have at home when I get home. Airport Extreme is one example I remember not having ipv6 firewalling by default, even though it has it for v4.
- dx034 3y ago
  Many internet users don't even know what the word firewall means. And there are a lot of devices with unpatched software. Obviously NAT shouldn't be seen as a firewall, but for many consumers it's pretty much the only line of defense. I don't know if ISPs without NATs automatically deploy firewalls, but would hope so. IPV6 is harder to scan, but once you know a device's IP address (e.g. from web logs), it'd be easy to exploit older devices.
  - hot_gril 3y ago
    One example, AT&T cellular gives you an ipv6 address besides v4, and it's still behind a NAT (not just a firewall). Though I'm glad my home ISP lets me decide that for myself.
- tonymet 3y ago
  It's important to test this. I own an MSI router where the firewall is completely broken for IPV6. They even made the mistake of listening for DNS and HTTP (admin tool) on the external interface. IPv6 is still confusing for many developers
  - hot_gril 3y ago
    Exactly, even if my router says "ipv6 firewall enabled," I still can't trust that they did it right. I would rather go full NAT (which on most routers equals disabling IPv6) than have to pen-test my router.
    - orangeboats 3y ago
      "Full NAT" doesn't even make sense. Do you mean symmetric NAT or something in that vein? >which on most routers equals disabling IPv6 Turning on NAT on IPv4 certainly does not entail turning off IPv6. Just _what_ exactly are you sprouting? It's not the first time you have made beginner mistakes like this.
Dagger2 3y ago
NAT isn't a nice feature, it's a necessary evil to deal with address exhaustion in v4 and causes many problems of its own. Using it in v6 makes no sense. It doesn't have a "default deny" behavior -- NAT doesn't block connections at all. It doesn't separate your LAN either, that's done by having a router. If you want those things then NAT isn't the thing you want.
- hot_gril 3y ago
  You're right that in a technical sense, NAT isn't block connections, more like it allows connections in the first place that would otherwise not be possible. But that's the best part. It's very hard for a misconfigured NAT to result in devices being exposed, unlike a true firewall, which is actively blocking connections to devices that would otherwise be totally reachable. NAT is sucky in plenty of server-side situations and is thus avoided, but in homes and offices, yeah I wouldn't want it any other way.
  - Dagger2 3y ago
    It's sucky in homes and offices too. It's not hard to test if your firewall is working. Using NAT to avoid that is not the sensible approach.