3 ms·

Having a publicly routable address absolutely does “expose” your network, which at the very least has the potential to generate load on your firewall (your prob

by jl6 2y ago

Having a publicly routable address absolutely does “expose” your network, which at the very least has the potential to generate load on your firewall (your problem) that would otherwise be absorbed by the NAT device (your ISP’s problem). Assuming the firewall is configured correctly in the first place, which is by no means guaranteed in consumer/SOHO settings.

blueflow 2y ago
The NAT device itself also is a firewall and can enforce policies comparable to what NAT would do. I had the impression that this is the default behavior in 2024. In my Fritz!Box, i have to configure IPv6 ports the same way i used to forward ports for IPv4.
scrapheap 2y ago
I don't know about your network, but for me that NAT device is sat on my network and so very much my problem :D
kmbfjr 2y ago
Assuming CGNAT, sure, it is the ISPs problem. But that just underscores the utility of IPv6 where defective CGNAT results in a hair pulling experience for the customer. Things don't get forwarded, and there isn't a thing you can do about it except call the ISP (provided you were able to troubleshoot it to that point in the first place). If NAT is done on the router, then it gets to make a decision on every packet regardless.
zamadatix 2y ago
"NAT Device" = "Firewall" (in this context) = "What you'd normally have with a public address plus the translation part". There tends to be conflation that somehow you need an additional device to filter you've not had in place before. In order to do NAT a device has to be at the edge of your network (your device or the ISPs) which tracks connection states to automatically translate outbound ones and allow the reverse mappings through while that is open. Getting rid of NAT simply means dropping the "translate" part from that device. The conntrack and allow outbound initiated connection part remains. Instead of port forwards for inbounds you just have inbound allows. There is no big swap of security roles between devices or special additional configuration needed, just the independent removal of the translation configuration from the device.
throw0101a 2y ago
> Having a publicly routable address absolutely does “expose” your network, which at the very least has the potential to generate load on your firewall (your problem) that would otherwise be absorbed by the NAT device (your ISP’s problem). How is one your problem and the other your ISP's? In both cases the bits are coming down your connection and hitting the CPE. Whether the CPE does only SPI firewalling or SPIFW+NAT seems to be irrelevant to me, as the same thing happens: packet's header tuple is examined, a state table is looked at, and the packet is passed or dropped depending on the contents.
- jl6 2y ago
  I’m talking about CGNAT, where the bits do not enter your premises.

by jl6 2y ago

blueflow 2y ago

The NAT device itself also is a firewall and can enforce policies comparable to what NAT would do. I had the impression that this is the default behavior in 2024. In my Fritz!Box, i have to configure IPv6 ports the same way i used to forward ports for IPv4.

scrapheap 2y ago

I don't know about your network, but for me that NAT device is sat on my network and so very much my problem :D

kmbfjr 2y ago

Assuming CGNAT, sure, it is the ISPs problem. But that just underscores the utility of IPv6 where defective CGNAT results in a hair pulling experience for the customer. Things don't get forwarded, and there isn't a thing you can do about it except call the ISP (provided you were able to troubleshoot it to that point in the first place). If NAT is done on the router, then it gets to make a decision on every packet regardless.

zamadatix 2y ago

"NAT Device" = "Firewall" (in this context) = "What you'd normally have with a public address plus the translation part". There tends to be conflation that somehow you need an additional device to filter you've not had in place before. In order to do NAT a device has to be at the edge of your network (your device or the ISPs) which tracks connection states to automatically translate outbound ones and allow the reverse mappings through while that is open. Getting rid of NAT simply means dropping the "translate" part from that device. The conntrack and allow outbound initiated connection part remains. Instead of port forwards for inbounds you just have inbound allows. There is no big swap of security roles between devices or special additional configuration needed, just the independent removal of the translation configuration from the device.

throw0101a 2y ago

> Having a publicly routable address absolutely does “expose” your network, which at the very least has the potential to generate load on your firewall (your problem) that would otherwise be absorbed by the NAT device (your ISP’s problem). How is one your problem and the other your ISP's? In both cases the bits are coming down your connection and hitting the CPE. Whether the CPE does only SPI firewalling or SPIFW+NAT seems to be irrelevant to me, as the same thing happens: packet's header tuple is examined, a state table is looked at, and the packet is passed or dropped depending on the contents.

jl6 2y ago
I’m talking about CGNAT, where the bits do not enter your premises.