3 ms·

>nowadays few routers have it by default And nowadays few routers have IPv6 firewall disabled by default... Do you see how fragile your argument is now?

hot_gril 3y ago
Enough routers still have ipv6 firewall disabled by default, in which case, every port on every networked device is exposed. Upnp, I'm less worried about being enabled, and even if it is, Windows won't map SMB to itself. In the long term with our world of cheap crappy routers, it's also much easier for upnp to die off than for ipv6 firewalls to become ubiquitously strong. Both of those are extra features that take effort to do right. So is NAT, but a broken NAT doesn't expose hosts.
- orangeboats 3y ago
  My grandparent's crappy ISP-sponsored router from ~2017 (maybe 2016), TP-Link C1200 v1, had the IPv6 firewall enabled by default. (It has UPnP enabled by default too... which I turned off promptly. They don't need it anyway.) My own Asus router from 2016, RT-AC1200G+, also came with IPv6 firewall enabled. Both routers are 8 years old at this point. And they are far from being a prosumer product. What router are you using that it doesn't come with IPv6 firewall enabled? edit: Oh, and my friend's cheapo Netis router (quite an obscure brand IMO) also had IPv6 firewall enabled out of the box. >ipv6 firewalls to become ubiquitously strong They don't need to be strong, the firewalls just have to be stateful so that they can drop unsolicited packets. It's that simple. Any other more sophisticated attacks would have made your NAT equally vulnerable as well. Additionally, stateful firewalls have been available since decades ago. They are not exactly black magic.
  - hot_gril 3y ago
    I'll have to check the one I have at home when I get home. Airport Extreme is one example I remember not having ipv6 firewalling by default, even though it has it for v4.

hot_gril 3y ago

Enough routers still have ipv6 firewall disabled by default, in which case, every port on every networked device is exposed. Upnp, I'm less worried about being enabled, and even if it is, Windows won't map SMB to itself. In the long term with our world of cheap crappy routers, it's also much easier for upnp to die off than for ipv6 firewalls to become ubiquitously strong. Both of those are extra features that take effort to do right. So is NAT, but a broken NAT doesn't expose hosts.

orangeboats 3y ago
My grandparent's crappy ISP-sponsored router from ~2017 (maybe 2016), TP-Link C1200 v1, had the IPv6 firewall enabled by default. (It has UPnP enabled by default too... which I turned off promptly. They don't need it anyway.) My own Asus router from 2016, RT-AC1200G+, also came with IPv6 firewall enabled. Both routers are 8 years old at this point. And they are far from being a prosumer product. What router are you using that it doesn't come with IPv6 firewall enabled? edit: Oh, and my friend's cheapo Netis router (quite an obscure brand IMO) also had IPv6 firewall enabled out of the box. >ipv6 firewalls to become ubiquitously strong They don't need to be strong, the firewalls just have to be stateful so that they can drop unsolicited packets. It's that simple. Any other more sophisticated attacks would have made your NAT equally vulnerable as well. Additionally, stateful firewalls have been available since decades ago. They are not exactly black magic.
- hot_gril 3y ago
  I'll have to check the one I have at home when I get home. Airport Extreme is one example I remember not having ipv6 firewalling by default, even though it has it for v4.