4 ms·

That changed (ahm.. will change) with ipv6. I was surprised to see that I can reach residential ipv6 lan hosts directly from the server. No firewalls, no nat. T

That changed (ahm.. will change) with ipv6. I was surprised to see that I can reach residential ipv6 lan hosts directly from the server. No firewalls, no nat. This remains true even with abusive isps that only give out /64 blocks. That said, I agree that peer to peer will never be seemless thanks mostly to said abusive isps.

theamk 2y ago
I sure hope not, this will bring in a new era for internet worms. If some ISPs are not currently firewalling all incoming IPv6 connections, it's a major security risk. I hope some security researcher raises boise about that soon, and the firewalls will go closed by default.
- 1oooqooq 2y ago
  it kinda of already begun
  - modeless 2y ago
    Has there been a big ipv6 worm? I thought that the defense against worms was that scanning the address space was impractical due to the large size.
    - 1oooqooq 2y ago
      i don't think they scan the entire space. but even before that there were ones abusing bonjour/upnp which is what chrome will bring back with this feature.
- immibis 2y ago
  My home router seems to have a stateful firewall and so does my cellphone in tethering mode - I don't know whether that one's implemented on the phone (under my control) or the network. Firewalling goes back in the control of the user in most cases - the other day we on IRC told someone how to unblock port 80 on their home router.
apitman 2y ago
IPv6 isn't going to happen. Most people's needs are met by NAT for clients and SNI routing for servers. We ran out of IPv4 addresses years ago. If it was actually a problem it would have happened then. It makes me said for the p2p internet but it's true.
- justahuman74 2y ago
  > If it was actually a problem It became a problem precisely the moment AWS starting charging for ipv4 addresses. "IPv4 will cost our company X dollars in 2026, supporting IPv6 by 2026 will cost Y dollars, a Z% saving" There's now a tangible motivator for various corporate systems to at least support ipv6 everywhere - which was the real ipv6 impediment. Residential ISP appear to be very capable of moving to v6, there are lots of examples of that happening in their backends, and they've demonstrated already that they're plenty capable of giving end users boxes the just so happen to do ipv6.
  - apitman 2y ago
    Yes and setting up a single IPv4 VPS as load balancer with SNI routing in front of IPv6-only instances solves that. Most people are probably using ELB anyway
- immibis 2y ago
  What do you mean not going to happen? It's already happening. It's about 45% of internet packets.
  - paulddraper 2y ago
    Not happening for 55%. Try to connect to github.com over IPv6.
    - remram 2y ago
      It doesn't work now so it's never going to work?
kelnos 2y ago
> I was surprised to see that I can reach residential ipv6 lan hosts directly from the server. No firewalls, no nat No NAT, sure, that's great. But no firewalls? That's not great. Lots of misconfigured networks waiting for the right malware to come by...

theamk 2y ago

I sure hope not, this will bring in a new era for internet worms. If some ISPs are not currently firewalling all incoming IPv6 connections, it's a major security risk. I hope some security researcher raises boise about that soon, and the firewalls will go closed by default.

1oooqooq 2y ago
it kinda of already begun
- modeless 2y ago
  Has there been a big ipv6 worm? I thought that the defense against worms was that scanning the address space was impractical due to the large size.
  - 1oooqooq 2y ago
    i don't think they scan the entire space. but even before that there were ones abusing bonjour/upnp which is what chrome will bring back with this feature.
immibis 2y ago
My home router seems to have a stateful firewall and so does my cellphone in tethering mode - I don't know whether that one's implemented on the phone (under my control) or the network. Firewalling goes back in the control of the user in most cases - the other day we on IRC told someone how to unblock port 80 on their home router.

apitman 2y ago

IPv6 isn't going to happen. Most people's needs are met by NAT for clients and SNI routing for servers. We ran out of IPv4 addresses years ago. If it was actually a problem it would have happened then. It makes me said for the p2p internet but it's true.

justahuman74 2y ago
> If it was actually a problem It became a problem precisely the moment AWS starting charging for ipv4 addresses. "IPv4 will cost our company X dollars in 2026, supporting IPv6 by 2026 will cost Y dollars, a Z% saving" There's now a tangible motivator for various corporate systems to at least support ipv6 everywhere - which was the real ipv6 impediment. Residential ISP appear to be very capable of moving to v6, there are lots of examples of that happening in their backends, and they've demonstrated already that they're plenty capable of giving end users boxes the just so happen to do ipv6.
- apitman 2y ago
  Yes and setting up a single IPv4 VPS as load balancer with SNI routing in front of IPv6-only instances solves that. Most people are probably using ELB anyway
immibis 2y ago
What do you mean not going to happen? It's already happening. It's about 45% of internet packets.
- paulddraper 2y ago
  Not happening for 55%. Try to connect to github.com over IPv6.
  - remram 2y ago
    It doesn't work now so it's never going to work?

kelnos 2y ago

> I was surprised to see that I can reach residential ipv6 lan hosts directly from the server. No firewalls, no nat No NAT, sure, that's great. But no firewalls? That's not great. Lots of misconfigured networks waiting for the right malware to come by...