4 ms·

It is an inadvertent firewall. It doesn’t allow unsolicited connections to whatever software is running is running on all of the crap in your house. IPv6 requi

It is an inadvertent firewall. It doesn’t allow unsolicited connections to whatever software is running is running on all of the crap in your house. IPv6 requires a stateful firewall on the router to provide the same protection. Then if you turn that on, it kinda defeats the point.

hnlmorg 1y ago
NAT requires a stateful firewall too. In fact all router firewalls are stateful otherwise you’d have to have large ranges of ports permanently open to incoming connections. So you don’t actually need anything different nor special to have the same level of security with IPv6 vs IPv4 + NAT.
- kortilla 1y ago
  > NAT requires a stateful firewall too. Yes, you’re repeating what I’m saying. NAT forced router vendors to implement stateful connection tracking and it increased the security of everything behind them. > So you don’t actually need anything different nor special to have the same level of security with IPv6 vs IPv4 + NAT. This isn’t how it played out in practice though. Huge swaths of home routers had no firewall at all when you enabled IPv6 support because it would have taken slightly extra work to enable the v6 conn tracking.
unethical_ban 1y ago
Having a default deny policy for traffic to your network doesn't defeat the point of IPv6 or direct routing.
homebrewer 1y ago
I think enough consumer routers run upnp servers out of the box that relying on NAT as a firewall is very unreliable. Have a look at upnp state table on your router, you might be surprised at things that have poked holes for the whole world to hammer at without you noticing.
- kortilla 1y ago
  UPNP is not enabled by default on my router nor has it been on the last few. I think that was common like 15 years ago before all of the gaming consoles figured out how to do STUN on their own.
Dagger2 1y ago
It's an imaginary firewall. NAT won't stop unsolicited connections in to your network -- if anything, its entire purpose is to do the exact opposite of that. If you actually want to block inbound connections when you're doing NAT, you need the stateful firewall anyway. At that point, pretty much the only thing NAT is doing for your security is making it harder to understand what's going on.

hnlmorg 1y ago

NAT requires a stateful firewall too. In fact all router firewalls are stateful otherwise you’d have to have large ranges of ports permanently open to incoming connections. So you don’t actually need anything different nor special to have the same level of security with IPv6 vs IPv4 + NAT.

kortilla 1y ago
> NAT requires a stateful firewall too. Yes, you’re repeating what I’m saying. NAT forced router vendors to implement stateful connection tracking and it increased the security of everything behind them. > So you don’t actually need anything different nor special to have the same level of security with IPv6 vs IPv4 + NAT. This isn’t how it played out in practice though. Huge swaths of home routers had no firewall at all when you enabled IPv6 support because it would have taken slightly extra work to enable the v6 conn tracking.

unethical_ban 1y ago

Having a default deny policy for traffic to your network doesn't defeat the point of IPv6 or direct routing.

homebrewer 1y ago

I think enough consumer routers run upnp servers out of the box that relying on NAT as a firewall is very unreliable. Have a look at upnp state table on your router, you might be surprised at things that have poked holes for the whole world to hammer at without you noticing.

kortilla 1y ago
UPNP is not enabled by default on my router nor has it been on the last few. I think that was common like 15 years ago before all of the gaming consoles figured out how to do STUN on their own.

Dagger2 1y ago

It's an imaginary firewall. NAT won't stop unsolicited connections in to your network -- if anything, its entire purpose is to do the exact opposite of that. If you actually want to block inbound connections when you're doing NAT, you need the stateful firewall anyway. At that point, pretty much the only thing NAT is doing for your security is making it harder to understand what's going on.