3 ms·

The thing I like about NAT is that it is essentially an ISP side stateful firewall. I would migrate to the ipv6 globally addressed mode immediately if my ISP ha

The thing I like about NAT is that it is essentially an ISP side stateful firewall. I would migrate to the ipv6 globally addressed mode immediately if my ISP had a checkbox "disallow all incoming connections".

fc417fc802 2y ago
It's funny. They'll block things I don't want them to block (email, http server, ...) but not unsolicited inbound IPv6 connections.
kstrauser 2y ago
Your router almost certainly has that option.
- PhilipRoman 2y ago
  Of course, it's probably the default everywhere, but with NAT the traffic never reaches me in the first place.
  - kstrauser 2y ago
    Interesting. My ISP passes both IPv4 and IPv6 inbound, expecting you to block them yourself.
  - ianburrell 2y ago
    NAT is done on your router. There is no difference with IPv6 firewall except doesn't do NAT. Are you thinking about CGNAT which is done by the ISP? That results in double NAT which causes problems.
    - PhilipRoman 2y ago
      You're right, I was thinking of CGNAT. My ISP definitely does it (they have far more users than IP allocations) and my router does NAT as well, so I guess I have a double NAT.
yjftsjthsd-h 2y ago
> I would migrate to the ipv6 globally addressed mode immediately if my ISP had a checkbox "disallow all incoming connections". Does your router not already do that by default?
- PhilipRoman 2y ago
  As another commenter already clarified, I meant CGNAT on the ISP side. I don't believe any ISP currently offers an equivalent firewall on their side.
lxgr 2y ago
ISP side? Hopefully not, or rather, only if you're behind one of those awful CG-NATs (and I'm not aware of any that let you actually configure port forwarding, although my knowledge here might be outdated; fortunately I haven't had to deal one in a long time). Otherwise, it's usually your CPE doing the NATting. It sounds like you want an ISP-provided stateful firewall though, upstream of your (metered, slow) connection, which I'd agree would be a great feature to have!

fc417fc802 2y ago

It's funny. They'll block things I don't want them to block (email, http server, ...) but not unsolicited inbound IPv6 connections.

kstrauser 2y ago

Your router almost certainly has that option.

PhilipRoman 2y ago
Of course, it's probably the default everywhere, but with NAT the traffic never reaches me in the first place.
- kstrauser 2y ago
  Interesting. My ISP passes both IPv4 and IPv6 inbound, expecting you to block them yourself.
- ianburrell 2y ago
  NAT is done on your router. There is no difference with IPv6 firewall except doesn't do NAT. Are you thinking about CGNAT which is done by the ISP? That results in double NAT which causes problems.
  - PhilipRoman 2y ago
    You're right, I was thinking of CGNAT. My ISP definitely does it (they have far more users than IP allocations) and my router does NAT as well, so I guess I have a double NAT.

yjftsjthsd-h 2y ago

> I would migrate to the ipv6 globally addressed mode immediately if my ISP had a checkbox "disallow all incoming connections". Does your router not already do that by default?

PhilipRoman 2y ago
As another commenter already clarified, I meant CGNAT on the ISP side. I don't believe any ISP currently offers an equivalent firewall on their side.

lxgr 2y ago

ISP side? Hopefully not, or rather, only if you're behind one of those awful CG-NATs (and I'm not aware of any that let you actually configure port forwarding, although my knowledge here might be outdated; fortunately I haven't had to deal one in a long time). Otherwise, it's usually your CPE doing the NATting. It sounds like you want an ISP-provided stateful firewall though, upstream of your (metered, slow) connection, which I'd agree would be a great feature to have!