6 ms·

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don'

• doubled112 6mo ago
  I recently changed ISPs and have IPv6 for the first time. I mostly felt the same way, but have learned to get over it. Some things took some getting used to. An "ip address show" is messy with so many addresses. Those public IPs are randomized on most devices, so one is created and more static but goes mostly unused. The randomly generated IPs aren't useful inbound for long. I don't think you could brute force scan that kind of address space, and the address used to connect to the Internet will be different in a few hours. Having a public address doesn't worry me. At home I have a firewall at the edge. It is set to block everything incoming. Hosts have firewalls too. They also block everything. Back in the day, my PC got a real public IP too. NAT really is nice for keeping internal/external separate mentally. I'm lucky enough my current ISP does not rotate my IPv6 range. This, ironically, means I no longer need dynamic DNS. My IPv4 address changes daily. A residential account usually gets a /56, what are you talking about? Nowhere near a /48! (I'm just being funny here...) There are reasons to need direct connectivity that aren't hosting a server. Voice and video calls no longer need TURN/STUN. A bunch of workarounds required for online gaming become unnecessary. Be creative.
  • bornfreddy 6mo ago
    > Having a public address doesn't worry me. At home I have a firewall at the edge. It is set to block everything incoming. Concern is privacy, not security. Publicly addressable machine is a bit worse for security (IoT anyone?), but it is a lot worse for privacy.
    • Guvante 6mo ago
      You already have a public IP address the only difference is if you have a rotating IP address which is orthogonal to IPv6. The only difference is most ISPs rotate IPv4 but not IPv6. Heck IPv6 allows more rotation of IPs since it has larger address spaces.
      • bombcar 6mo ago
        IPv6 can "leak" MAC addresses of connected devices "behind the firewall" if you don't have the privacy extensions / random addresses in use. There are a number of footguns for privacy with IPv6 that you need to know enough to avoid.
        • craftkiller 6mo ago
          Privacy extensions are enabled by default on OSX, windows, android, and iOS: https://ipv6.net/guide/mastering-ipv6-a-complete-guide-chapter-6-privacy-extensions-hiding-in-plain-sight-with-ipv6/ https://ipv6.net/guide/mastering-ipv6-a-complete-guide-chapt... On Linux, I think the defaults are left up to the distros so there is a chance of a privacy footgun there. Hopefully most distros follow the example set by Apple and Microsoft (a sentence I never thought I would write...)
          • bombcar 6mo ago
            They are now - I'm not sure when they implemented them but I know Windows at least would do some really stupid stuff very early on.
            • Guvante 6mo ago
              Aren't we talking about now? No one is saying we should have activated IPv6 in its first iteration.
        • zekica 6mo ago
          All desktop/mobile OSes today use "Stable privacy addresses" for inbound traffic (only if you are hosting something long-term) and "Temporary addresses" for outbound traffic and P2P (video/voice calls, muliplayer games...) that change quickly (old ones are still assigned to not break long-lived connections but are not used for new ones).
• t0mas88 6mo ago
  IPv4 is not holding back home setups, nobody cares about NAT at home. The place where it hurts is small VPSs, from AWS to mom and pop hosters, the cost of addresses is becoming significant compared to low cost VPSs.
  • lxgr 6mo ago
    > nobody cares about NAT at home. Only because most people don't know how NAT is hurting them, and because corporations have spent incredible resources on hacking around the problem for when peer to peer is required (essentially only for VoIP latency optimization and gaming). NAT hurts peer to peer applications much more than cloud services, which are client-server by nature and as such indeed don't care that only outgoing connections are possible.
    • LegionMammal978 6mo ago
      Even in a NAT-less world, the common advice is to use a firewall rule that disallows incoming connections by default. (And I'd certainly be worried if typical home routers were configured otherwise.) So either way, you'd need the average person to mess with their router configuration, if they want to allow incoming P2P connections without hole-punching tricks. At best, the lack of NAT might save you an address-discovery step.
      • lxgr 6mo ago
        > the common advice is to use a firewall rule that disallows incoming connections by default. That's good advice! But firewall hole punching is also significantly easier (and guaranteed to work) compared to NAT hole punching. Address discovery is part of it, but there are various ways to implement a NAT (some inherently un-hole-punch-able) and only really one sane way to do a firewall. > you'd need the average person to mess with their router configuration, At least with IPv6, that firewall is likely to exist in the CPE, which sophisticated users can then ideally open ports in (or which can implement UPnP/NAT-PMP or whatever the current name for the "open this port now!!" protocol of the decade is); for CG-NAT, it's often outright impossible.
      • 6mo ago
• Guvante 6mo ago
  NAT only matters in so far as you don't technically need a firewall to block incoming traffic since if it fails a NAT lookup you know to drop the traffic. But from a security standpoint you can just do the same tracking for the same result. That is just technically a firewall at that point.
• qalmakka 6mo ago
  NAT is arguably a very broken solution.IPv4 isn't meant to be doing address translation, period. NAT creates all sorts of issues because in the end you're still pretending all communications are end to end, just with a proxy. We had to invent STUN and all sorts of hole punching techniques just to make things work decently, but they are lacking and have lots of issues we can't fix without changing IPv4. I do see why some people may like it, but it isn't a security measure and there are like a billion different ways to have better, more reliable security with IPv6. The "I don't want my devices to have public, discoverable IPs" is moot when you have literally billions of addresses assigned to you. with the /48 your ISP is supposed to assign you you may have 4 billion devices connected, each one with a set of 281 trillion unique addresses. You could randomly pick an IP per TCP/UDP connection and not exhaust them in _centuries_. The whole argument is kind of moot IMHO, we have ways to do privacy on top of IPv6 that don't require fucking up your network stack and having rendezvous servers setting that up. We may also argue that NAT basically forces you to rely on cloud services - even doing a basic peer to peer VoIP call is a poor experience as soon as you have 2 layers of NAT. We had to move to centralised services because IPv4 made hosting your own content extremely hard, causing little interest in symmetrical DSL/fiber, leading to less interest into ensuring peer to peer connections between consumers are fast enough, which lead to the rise of cloud and so on. I truly believe that the Internet would be way different today if people could just access their computers from anywhere back in the '00s without having to know networking
  • zekica 6mo ago
    And the worst part about CGNAT is that you have two bad solutions: Either EIM/EIF (preferably with hairpinning) where you can practically do direct connections but you have to limit users to a really low number of "connections" breaking power users. Or EDM/EDF where users have a higher number of "connections" but it's completely impossible to do direct connections (at least not in any video/voice calling system).
• Sanzig 6mo ago
  Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for your setup, but it can be a huge headache for some users, especially users on CGNAT. How many years of human effort have gone towards unnecessary NAT workarounds? With IPv6, if you want a peer-to-peer connection between firewalled peers, you do a quick UDP hole punch and you're done - since everything has a unique IP, you don't even need to worry about remapping port numbers. Your ISP shouldn't be rotating your /64, although unfortunately many do since they are still IPv4-brained when it comes to prefix assignment. Best practice is to assign a static /56 per customer, although admittedly this isn't always followed. And if you don't need a /48... don't use it? 99.99% of home customers will just automatically use the first /64 in the block, and that's totally fine. There's a ton of address space available, there's no drawback to giving every customer a /56 or even a /48.
  • iamnothere 6mo ago
    I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. I don’t want a static address either (although static addresses should be freely available to those who want them). Having a rotating IP provides a small privacy benefit. People who have upset other people during an online gaming session will understand; revenge DDoS is not unheard of in the gaming world.
    • ac29 6mo ago
      > I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. This feels like a strawman. If you are making the sort of change that accidentally disables your IPv6 firewall completely, you could accidentally make a change that exposed IPv4 devices as well (accidentally enabling DMZ, or setting up port forwarding incorrectly for example).
• knorker 6mo ago
  So run fc00::/7 addresses with IPv6 NAT. That addresses all of your concerns, and you have that option.
  • justsomehnguy 6mo ago
    But that doesn't allow to bitch about it so - no.
  • iso1631 6mo ago
    Sure you can do that So what's the point in ipv6?
    • zekica 6mo ago
      You can do fc00::/7 in addition to public addresses so your lights don't have public address while your phone does.
    • knorker 6mo ago
      I mean, so many reasons. Not the least of which is carrier grade NAT is out. And that alone implies so much cost savings, performance increase, and home user flexibility . I'm struggling to assume good faith on your question, since it's so strange. I feel like I need to start from scratch explaining the internet, since asking this question reveals a lack of knowledge about everything networking.
      • iso1631 6mo ago
        I don't have CG Nat, I choose a proper ISP. Opening a hole in my ipv6 firewall or forwarding a port in in my ipv4 firewall is effectively the same thing, I define the policy (allow traffic arriving on $address on tcp/1234 to this server on vlan 12) and it goes live. Away from home, like I am at the moment, I vpn all my traffic back home, to work, or to a mullvad endpoint. Neither the hotel wifi nor tethering off my phone gives me a working ipv6 address (anything other than an fe80::) anyway. All my workflows work on ipv4 only. Some workflows (especially around the corporate laptop) don't work on ipv6 only - maybe that's a zscaler thing, maybe its a windows thing. As such the only choice is ipv4 with ipv6 as a nice to have, or ipv4 only. Personally I prefer the smaller attack surface of a single network protocol. Sounds like ipv6 is a good solution for people who choose ISPs with CGNat. It doesn't matter to me if I vpn home via my ipv6 endpoint or my ipv4 endpoint, I expose a very minimal set of services. I guess if I wanted to host more than 4 servers on the same port at home it would be handy, as my ISP will only allow me to have 4 public IPs without paying for more. I don't host anything other than my wireguard endpoint and some UDP forwards which I specific redirect to where I want to go (desktop, laptop, server) - another great feature of nat, but yes nat66 can do that too. But where's the killer feature of ipv6. Is it just CGNat on poor ISPs?
• UltraSane 6mo ago
  NAT is a horrible, HORRIBLE hack that makes everything in networking much more complicated. IP networking is very elegant when everyone is using globally unique addresses and a ugly mess when Carrier NAT is used.
• bigstrat2003 6mo ago
  NAT demonstrably does not work fine. We have piles of ugly hacks (STUN, etc) that exist only because NAT does. If you really want to keep NAT then nothing stops you from running it on IPv6, but the rest of us shouldn't suffer because of your network design goals.
• blueflow 6mo ago
  > I like NAT I'm in favor of having society overrule you. NAT is a horrible kludge and not okay. Never was.
• throwaway27448 6mo ago
  How is a public address any worse than NAT? You can always choose to not respond.
• zdp7 6mo ago
  Maybe you don't need the addresses, but there are other advantages. If we made the move, I suspect we could give you the experience you want and the one I want. I personally do want to host my own services. My phone is configured to send my pictures to Google and my personal NAS. Centralized services mean you have to trust that provider. These days I don't. I intend to leave centralized services so I know my content isn't training AI or the doorbell isn't spying on me or my neighbors. But, no instead we should force everyone to share the same IP addresses and run less efficient routing.