3 ms·

I would recommend just disabling ipv6 completely. There is zero need for every machine on the internet to be able to know your computer exists. 15 years ago I h

I would recommend just disabling ipv6 completely. There is zero need for every machine on the internet to be able to know your computer exists. 15 years ago I had a different opinion, I thought the technology was superior and really well thought out. Today, when Silicon Valley wholesale selling your personal life away for advertisers, I recommend doing the exact opposite of whatever they tell you to do. In this case, those pushing ipv6 the hardest are the Googles/Facebooks/etc.

ndriscoll 2y ago
Every computer on the Internet is not able to know my computer exists. My router allows established (i.e. originally outgoing) connections/flows and drops anything else without even an ICMP reply, same as ipv4. If I want to run a service though, then I just add a rule to allow traffic on that port to my computer's stable address. ipv6 and global addressability allows p2p services to work, which is necessary to get away from centralized service providers like google/facebook/etc.
- patrakov 2y ago
  > If I want to run a service though, then I just add a rule to allow traffic on that port to my computer's stable address. Problem: in most consumer firewalls, and even in OpenWrt, there are simply no words to express this. I don't know what my IPv6 prefix would be next time my modem reconnects, therefore, I don't know which IPv6 address my computer would then get. However, firewall configuration tools are built under the assumption that static IPs are the only existing ones. I just cannot write "the delegated prefix from the WAN plus :d63d:7eff:fed9:0a39".
  - ndriscoll 2y ago
    I agree that is an obvious missing functionality. It's never affected me because anywhere I've lived I've always ended up with stable prefixes/addresses (both ipv4 and v6) for years, but it's obviously something consumer firewalls need. Fortunately that's a much easier problem to fix (replace or update the one device) than trying to get everyone to use ipv6 in the first place.
  - tcfhgj 2y ago
    The most widespread consumer routers in Germany handle this without any issues.
    - patrakov 2y ago
      Can you share a screenshot of the relevant firewall rule that allows access to one port on one IPv6 address behind the router and doesn't break when the ISP assigns a different delegated prefix?
      - tcfhgj 2y ago
        a bit late: https://ibb.co/XFtZg8T https://ibb.co/XFtZg8T Have been using this for years
        patrakov 2y ago
        Better late than never. Thanks! And indeed, this looks like a well-thought-out (with an explicit field for the IPv6 interface ID, as opposed to the full address) approach to IPv6 forwarding and firewalling.

ndriscoll 2y ago

Every computer on the Internet is not able to know my computer exists. My router allows established (i.e. originally outgoing) connections/flows and drops anything else without even an ICMP reply, same as ipv4. If I want to run a service though, then I just add a rule to allow traffic on that port to my computer's stable address. ipv6 and global addressability allows p2p services to work, which is necessary to get away from centralized service providers like google/facebook/etc.

patrakov 2y ago
> If I want to run a service though, then I just add a rule to allow traffic on that port to my computer's stable address. Problem: in most consumer firewalls, and even in OpenWrt, there are simply no words to express this. I don't know what my IPv6 prefix would be next time my modem reconnects, therefore, I don't know which IPv6 address my computer would then get. However, firewall configuration tools are built under the assumption that static IPs are the only existing ones. I just cannot write "the delegated prefix from the WAN plus :d63d:7eff:fed9:0a39".
- ndriscoll 2y ago
  I agree that is an obvious missing functionality. It's never affected me because anywhere I've lived I've always ended up with stable prefixes/addresses (both ipv4 and v6) for years, but it's obviously something consumer firewalls need. Fortunately that's a much easier problem to fix (replace or update the one device) than trying to get everyone to use ipv6 in the first place.
- tcfhgj 2y ago
  The most widespread consumer routers in Germany handle this without any issues.
  - patrakov 2y ago
    Can you share a screenshot of the relevant firewall rule that allows access to one port on one IPv6 address behind the router and doesn't break when the ISP assigns a different delegated prefix?
    - tcfhgj 2y ago
      a bit late: https://ibb.co/XFtZg8T https://ibb.co/XFtZg8T Have been using this for years
      - patrakov 2y ago
        Better late than never. Thanks! And indeed, this looks like a well-thought-out (with an explicit field for the IPv6 interface ID, as opposed to the full address) approach to IPv6 forwarding and firewalling.