3 ms·

Going further still, forget all the NAT breakage and require all devices to actually use the privacy extensions described in RFC 4941 17 years ago. A router cou

Going further still, forget all the NAT breakage and require all devices to actually use the privacy extensions described in RFC 4941 17 years ago. A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers. There are reasons you might want your desktop to have the same address for a long time. I can't think of any reason why I'd want that for a light bulb.

bb88 3y ago
NAT is broken by design. And CG-NAT can't do any kind of port forwarding on the routers. And adding more NAT is just breaking more networks. RFC 4941 is currently old enough to be taking it's SAT's and preparing itself for college... :)
- kstrauser 3y ago
  I’m thrilled to have good end-to-end connectivity to the degree I’m willing to configure my firewall for it. When I hear people in other threads talking about the “security advantages” of NAT, I imagine someone filling their car’s engine with walnuts and talking about how it protects them from speeding tickets.
  - adriancr 3y ago
    That's the thing, you don't have good end-to-end connectivity if you configure the firewall as you should and block everything similar to what NAT does. After which, you have a question, how can you configure end-to-end connectivity securely?, which host(s) do you open up ports towards?
    - bb88 3y ago
      You don't have good end-to-end connectivity with NAT, right? With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet.
      - adriancr 3y ago
        > You don't have good end-to-end connectivity with NAT, right? I do, I have a public IPv4 that I manage as I wish. Open ports on firewall and forward where needed. No issues so far. > With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet. Where are you from and what provider are you using? That is just a crappy provider, you should switch to competition and get a separate IP with no CG-NAT. (never had CG-NAT on home connection, although I avoided providers that did that) If you're a student in a uni campus/dorms you won't really have an option and it is what it is, it used to be CG-NAT 15-20 years ago too. Even with IPv6 they'd likely firewall everything off and the range would have bad reputation.
labcomputer 3y ago
> A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers. So… I’m not saying you don’t want to do that, but I do want to expand on this a bit: 4941 is not the only way to avoid having your MAC address in your IPv6 address. In fact RFC 3972 (from 2005! Almost old enough to buy beer!) describes a method for stable “cryptographic” addresses which enable the host to attest to the address’s authenticity in ND. That’s a really powerful feature because it means that another host can’t impersonate you like they can with ARP on v4. RFC 3972 is what macOS uses for the “non temporary” address (the one ifconfig labels “secured”). One of the things everyone should know about 3972 addresses is that a host will generate different addresses on different prefixes (so you can’t correlate a host moving between networks like you could with a MAC-derived address). It is expected and normal that a host should have at least two “non temporary” addresses: a link local one, plus one generated by 3972 (or DHCPv6 or some other mechanism), in addition to one or more 4941 temporary addresses. One way to block MAC-derived addresses without breaking e2e connectivity is to add a firewall rule blocking addresses with “FFFE” in the middle.

bb88 3y ago

NAT is broken by design. And CG-NAT can't do any kind of port forwarding on the routers. And adding more NAT is just breaking more networks. RFC 4941 is currently old enough to be taking it's SAT's and preparing itself for college... :)

kstrauser 3y ago
I’m thrilled to have good end-to-end connectivity to the degree I’m willing to configure my firewall for it. When I hear people in other threads talking about the “security advantages” of NAT, I imagine someone filling their car’s engine with walnuts and talking about how it protects them from speeding tickets.
- adriancr 3y ago
  That's the thing, you don't have good end-to-end connectivity if you configure the firewall as you should and block everything similar to what NAT does. After which, you have a question, how can you configure end-to-end connectivity securely?, which host(s) do you open up ports towards?
  - bb88 3y ago
    You don't have good end-to-end connectivity with NAT, right? With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet.
    - adriancr 3y ago
      > You don't have good end-to-end connectivity with NAT, right? I do, I have a public IPv4 that I manage as I wish. Open ports on firewall and forward where needed. No issues so far. > With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet. Where are you from and what provider are you using? That is just a crappy provider, you should switch to competition and get a separate IP with no CG-NAT. (never had CG-NAT on home connection, although I avoided providers that did that) If you're a student in a uni campus/dorms you won't really have an option and it is what it is, it used to be CG-NAT 15-20 years ago too. Even with IPv6 they'd likely firewall everything off and the range would have bad reputation.

labcomputer 3y ago

> A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers. So… I’m not saying you don’t want to do that, but I do want to expand on this a bit: 4941 is not the only way to avoid having your MAC address in your IPv6 address. In fact RFC 3972 (from 2005! Almost old enough to buy beer!) describes a method for stable “cryptographic” addresses which enable the host to attest to the address’s authenticity in ND. That’s a really powerful feature because it means that another host can’t impersonate you like they can with ARP on v4. RFC 3972 is what macOS uses for the “non temporary” address (the one ifconfig labels “secured”). One of the things everyone should know about 3972 addresses is that a host will generate different addresses on different prefixes (so you can’t correlate a host moving between networks like you could with a MAC-derived address). It is expected and normal that a host should have at least two “non temporary” addresses: a link local one, plus one generated by 3972 (or DHCPv6 or some other mechanism), in addition to one or more 4941 temporary addresses. One way to block MAC-derived addresses without breaking e2e connectivity is to add a firewall rule blocking addresses with “FFFE” in the middle.