11 ms·

Thankfully, even though the Mastodon post that triggered this made the usual mistake of implying that disabling NAT results in "exposed" LAN devices (NAT has no

• BonoboIO 2y ago
  What benefits has ipv6 beside that ipv4 addresses for public servers are in short supply?
  • mlyle 2y ago
    Really easy prefix delegations on consumer/small business links without configuration. End-to-end connectivity, rather than having to think at all about what will one day be a "public server." Avoiding of crummy CGNAT. No more collisions between private addresses when a company is acquired or networks otherwise merge. Avoiding most of the annoyances of DHCP. There's more, but these are the ones that really resonate with me.
  • 9x39 2y ago
    Little for a typical web client, but p2p connection setup in theory should get better in a world with less NATs.
  • nijave 2y ago
    On Spectrum and AT&T in the U.S. I tend to see a little better latency, on average, on IPv6 (2-4ms). Not sure the exact reason
  • jeroenhd 2y ago
    If you live in a country rich enough that every ISP customer gets a dedicated IPv4 address you won't see many of the downsides of deploying IPv4 these days. If you don't, you'll get tired of Cloudflare's "checking if your connection is secure" becomes pretty tiring pretty quickly. Even in rich countries, CG-NAT is starting to get used more and more as prices for IP ranges go up. CGNAT also affects people trying to do something silly like "open a port" for a Minecraft server or a VPN back home, which is impossible without a public address. Outside of CGNAT, just about any protocol works better without standard IPv4 NAT. Xbox and PlayStation have invented their own terminology (what the fuck is a "type 2 NAT" anyway) and have written custom code to work around the different ways in which NAT fucks up your connection. Linux and BSD based routers will do deep packet inspection to figure out if you're trying to do FTP or SIP or H363 and rewrite traffic on the fly while opening holes in the firewall just so you can use basic internet functionality. This has also led to an attack dubbed "NAT slipstreaming" where generations of routers will allow Javascript running in your browser to open any port on your device to the outside, or even any port on any device in your network, despite what your router's firewall may say. For larger networks (with more than ±250 devices), you get a working connection without having to figure out what a DHCP pool is. And lastly, while this will probably differ by ISP, my experience is that IPv6 has significantly less latency than IPv4, on the order of 4ms versus 20ms.
    • avhception 2y ago
      In Germany, the TV-cable based ISP all have started deploying CGNAT. If you live in a densely populated area with many Vodafone customers, their CGNAT gateways tend to be overloaded, so in peak hours you sometimes experience packet loss. Of course Vodafone won't admit that it's a structural problem instead of isolated cases. At one point, I was forced to use a shitty DSL provider, "e-on highspeed" (formerly "Innogy") because they had exclusive rights to the VDSL DSLAM in my area. For a while, they didn't even offer IPv6 alongside the CGNAT v4. And when they did, it broke randomly (remote gateway dead). By the way, does anybody have a clue on how to get SLAAC addresses into local DNS? I can't create static records because my current ISP keeps changing my assigned prefix. I'm still on v4 for my local fileservers and stuff like that because of this problem.
  • GoblinSlayer 2y ago
    No need to pay Big Tech to do anything like videochat.
  • kalleboo 2y ago
    Cost. IPv4 is so expensive to support that one ISP out there is literally giving people Apple TVs with IPv6 support to replace IPv4-only Roku devices https://daringfireball.net/linked/2023/03/06/roku-apple-tv https://daringfireball.net/linked/2023/03/06/roku-apple-tv
  • throw0101d 2y ago
    > What benefits has ipv6 beside that ipv4 addresses for public servers are in short supply? What more benefits do you need? It's a major issue for many folks, especially if you (a) didn't manage to get in early on the IPv4 land rush, or (b) aren't a mega-corp with money to buy a whole bunch of addresses: > Our [American Indian] tribal network started out IPv6, but soon learned we had to somehow support IPv4 only traffic. It took almost 11 months in order to get a small amount of IPv4 addresses allocated for this use. In fact there were only enough addresses to cover maybe 1% of population. So we were forced to create a very expensive proxy/translation server in order to support this traffic. > We learned a very expensive lesson. 71% of the IPv4 traffic we were supporting was from ROKU devices. 9% coming from DishNetwork & DirectTV satellite tuners, 11% from HomeSecurity cameras and systems, and remaining 9% we replaced extremely outdated Point of Sale(POS) equipment. So we cut ROKU some slack three years ago by spending a little over $300k just to support their devices. * https://community.roku.com/t5/Features-settings-updates/It-s-2022-and-still-no-IPv6/m-p/854673/highlight/true#M35732 https://community.roku.com/t5/Features-settings-updates/It-s... * https://news.ycombinator.com/item?id=35047624 https://news.ycombinator.com/item?id=35047624 Do you think we'd have as much mobile/smartphone connectivity without IPv6? T-Mobile US went to IPv6-only on handsets because of exhaustion, and they're only one carrier (in the US).
• Gee101 2y ago
  While technically true I think with Nat enabled it disables access from the Internet by default even if a firewall is misconfigured.
  • Arnavion 2y ago
    If your firewall is disabled, an incoming v4 packet on the WAN interface with destination IP = a NAT'ed LAN device's address like 192.168.1.2 could cross over to the LAN interface and reach said LAN device. It is the firewall's job to filter such bogons.
    • magicalhippo 2y ago
      How would the package get routed my way unless the attacker hooked up right outside my network?
      • Arnavion 2y ago
        You've answered your own question.
        • chgs 2y ago
          Such a rare occurrence. Nat alone doesn’t protect you from 100% of threats. Neither does a firewall btw. But it does add an extra layer of safety.
          • deleted 2y ago
            [deleted]
        • mrshadowgoose 2y ago
          In what realistic scenario would a regular individual need to worry about such a threat scenario?
      • ffsm8 2y ago
        Just by sending the packet. That's essentially how NAT hole punching works. It doesn't work on all routers, but most do just route the packet. You just need to know the exact configuration of the network and send the correct packet through a valid port and it goes through https://en.m.wikipedia.org/wiki/Hole_punching_(networking) https://en.m.wikipedia.org/wiki/Hole_punching_(networking)
• ironhaven 2y ago
  Just checked my Steamdeck and from the kde desktop settings ipv6 was entirely disabled. I just re-enabled ipv6 to let it auto configure an address and got ipv6 connectivity.
• pbreit 2y ago
  I wonder if we could have just done something simple like add a block to ipv4? Like 255.255.255.255.255
  • blueflow 2y ago
    IP packets are like a C struct that only have 4 bytes allocated per address. If you want to have more space, you need to change that struct, and that's what IPv6 does. Together with a new Ethertype so the different structs can be reliably differentiated.
  • mkl 2y ago
    No, too much software and hardware relies on fitting the IP address into 32 bits. That means the only way to increase the number of addresses is in a way a clean break, so we might as well increase the number to a ludicrous size, far beyond what we can imagine practically exceeding, like IPv6's 128 bits.
• datadeft 2y ago
  > disabling NAT results in "exposed" LAN devices "In theory, theory and practice are the same. In practice, they are not." NAT was used as a blocking method for all incoming connections for SOHO networks for decades.
  • blueflow 2y ago
    It cannot work reliably, that's why Hole Punching is a thing.
    • mschuster91 2y ago
      It's enough to keep the Shodan skiddies at bay. I distinctly 'member the modem/ISDN era and trolls shooting off unpatched machines of other gamers. In ye olde days remote RCE exploits were a regular issue...
    • vachina 2y ago
      If you don’t punch there’s no hole.
      • throw0101d 2y ago
        > If you don’t punch there’s no hole. Good luck gaming then, or using BitTorrent (and probably other services). All consumer CPEs support PCP/UPnP for 'dynamic punching'. And if the app in question doesn't use PCP/UPnP, then you have to stand up an entire STUN/TURN/ICE infrastructure.
        • LargoLasskhyfv 2y ago
          One does NOT play with https://en.wikipedia.org/wiki/Phencyclidine https://en.wikipedia.org/wiki/Phencyclidine !1!!
        • vachina 2y ago
          Yes they all support punching holes, in fact, I’m punching holes right now, otherwise I won’t be able to reply. But if you don’t punch, then there’s no hole. Your TCP stack is unlikely to accidentally punch port 3398 when you’re browsing hn.
• jl6 2y ago
  Having a publicly routable address absolutely does “expose” your network, which at the very least has the potential to generate load on your firewall (your problem) that would otherwise be absorbed by the NAT device (your ISP’s problem). Assuming the firewall is configured correctly in the first place, which is by no means guaranteed in consumer/SOHO settings.
  • blueflow 2y ago
    The NAT device itself also is a firewall and can enforce policies comparable to what NAT would do. I had the impression that this is the default behavior in 2024. In my Fritz!Box, i have to configure IPv6 ports the same way i used to forward ports for IPv4.
  • scrapheap 2y ago
    I don't know about your network, but for me that NAT device is sat on my network and so very much my problem :D
  • kmbfjr 2y ago
    Assuming CGNAT, sure, it is the ISPs problem. But that just underscores the utility of IPv6 where defective CGNAT results in a hair pulling experience for the customer. Things don't get forwarded, and there isn't a thing you can do about it except call the ISP (provided you were able to troubleshoot it to that point in the first place). If NAT is done on the router, then it gets to make a decision on every packet regardless.
  • zamadatix 2y ago
    "NAT Device" = "Firewall" (in this context) = "What you'd normally have with a public address plus the translation part". There tends to be conflation that somehow you need an additional device to filter you've not had in place before. In order to do NAT a device has to be at the edge of your network (your device or the ISPs) which tracks connection states to automatically translate outbound ones and allow the reverse mappings through while that is open. Getting rid of NAT simply means dropping the "translate" part from that device. The conntrack and allow outbound initiated connection part remains. Instead of port forwards for inbounds you just have inbound allows. There is no big swap of security roles between devices or special additional configuration needed, just the independent removal of the translation configuration from the device.
• vundercind 2y ago
  > usual mistake of implying that disabling NAT results in "exposed" LAN devices (NAT has nothing to do with it, that's the firewall's job) However technically correct from a certain point of view you may be, I was supporting home users for a small ISP in the very early 2000s and you’re wrong in any way that matters. In practice NAT on its own made remote attacks on home networked devices far harder.
  • nulbyte 2y ago
    NAT didn't make remote attacks harder, the default inbound deny rule did. NAT is not the firewall itself, it's just one of the things the firewall can do. Telephone companies are also ISPs, and they are and continue to be quite inept when it comes to securing their own networks, so NAT without a default inbound deny rule is not secure. This matters in a very meaningful way. Have you seen how many enterprising but clueless consumers click random buttons until whatever they are trying to do works? They often don't know or care about other ramifications until it's too late.