4 ms·

This makes exactly zero sense. So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? How does that wo

This makes exactly zero sense. So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? How does that work? At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP.

Arnavion 3y ago
>So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Of course. Unless you add rules to allow incoming traffic, say a rule to allow incoming traffic for $LAN_MACHINE1_IP:$PORT/tcp, to cross from WAN to LAN. >At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. The reason the scenario in my previous comment doesn't work has nothing to do with NAT. The reason such a packet would be dropped is because the firewall has a rule to filter bogons on the WAN interface. More generally, your home network firewall will have a default rule to block all incoming traffic on WAN unless explicitly allowed via additional rules, and that applies to both IPv4 and IPv6. >WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP. Well if you trust your ISP so much then I assume you just have your firewall turned off always, right?
lxgr 3y ago
> So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Yes! > How does that work? Stateful firewalling. It's much simpler than NAT masquerading tables. Just imagine a NAT, but with all address and port mappings being the identity function.
- djha-skin 3y ago
  Have you set this up or are you speaking from your reading experience
  - lxgr 3y ago
    It's the default for all home routers I've ever used.
icedchai 3y ago
It's a stateful firewall. New, incoming connections are denied. Outgoing or established connections are permitted.
throw0101c 3y ago
> So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? How does that work? With a default-deny rule in a stateful firewall? Publicly addressable ≠ publicly reachable.

Arnavion 3y ago

>So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Of course. Unless you add rules to allow incoming traffic, say a rule to allow incoming traffic for $LAN_MACHINE1_IP:$PORT/tcp, to cross from WAN to LAN. >At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. The reason the scenario in my previous comment doesn't work has nothing to do with NAT. The reason such a packet would be dropped is because the firewall has a rule to filter bogons on the WAN interface. More generally, your home network firewall will have a default rule to block all incoming traffic on WAN unless explicitly allowed via additional rules, and that applies to both IPv4 and IPv6. >WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP. Well if you trust your ISP so much then I assume you just have your firewall turned off always, right?

lxgr 3y ago

> So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Yes! > How does that work? Stateful firewalling. It's much simpler than NAT masquerading tables. Just imagine a NAT, but with all address and port mappings being the identity function.

djha-skin 3y ago
Have you set this up or are you speaking from your reading experience
- lxgr 3y ago
  It's the default for all home routers I've ever used.

icedchai 3y ago

It's a stateful firewall. New, incoming connections are denied. Outgoing or established connections are permitted.

throw0101c 3y ago

> So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? How does that work? With a default-deny rule in a stateful firewall? Publicly addressable ≠ publicly reachable.