3 ms·

> They're services I wish to consume outside my home Like I said, not public. > Damn near everything expects to be HTTPS/443 So let it. Forward your own chos

by M95D 6mo ago

> They're services I wish to consume outside my home Like I said, not public. > Damn near everything expects to be HTTPS/443 So let it. Forward your own chosen port to 443 of the machine with the service. > Public just means I have the option to allowing that traffic or not. Nope. That's not what it means. > So I change having easy to remember names for weird odd ports [...] Easy to remember names comes from some DNS service, which can't work unless your public IP address stays the same and you can run your own public NS and can receive recursion from your main NS provider. In most parts of the world, I think, IP changes every time you restart the router, even IPv6. So what you have there isn't exactly typical for home users. That one extra service and complication that you don't actually need. I don't have to remember anything HTTP(S). No ports, no IPs, no names, nothing. I use bookmarks. > Wouldn't it be nice to have the option to not have to rely on such things and just be able to connect to things directly? Wouldn't it be nice if there were no bad guys on the internet, no bots, and no zero days? > ipv6 is awesome. For Google and for you, maybe. But let me know how much you like it after your first cryptolocker. I suppose your backup storage is also public on the internet?

vel0city 6mo ago
> Like I said, not public. Outside the home, in other words in networks other than at home. Potentially without VPNs. Accessible from other public IP addresses, potentially limited scopes of those. It seems you're thinking that allowing the traffic from other public networks is an all or nothing thing. That either you allow all public network traffic or none of it. That's just not true. If I know my office network is one prefix, and I know my friend's house is another prefix, and I know my cellular carrier in my city is usually this prefix, I can greatly limit the scope of access. It doesn't have to be an all or nothing, either its open to every single other device or only local devices, I can define exactly which networks or devices I want to allow the traffic from or not. If I wanted to just let my friend's network audio receiver to connect to my music server, I can add it's public ip address and allow that traffic. No VPNs, no tunnels, no proxies, no non-standard port assignments, just directly allowing it to talk to the music server. All through the public internet, but still locking down my music server to just local traffic and his remote network audio receiver. That's all still "public" networking. > In most parts of the world, I think, IP changes every time you restart the router, even IPv6. Often not with IPv6, prefixes stay pretty consistent usually. Not always true, but often true. I've had the same prefix for many, many years at multiple locations and multiple providers without having any kind of payment for static IP addresses. > So let it. Forward your own chosen port to 443 of the machine with the service. So now I have to remember the port for local and the port for remote along with different IP addresses for both, or I can just use the normal service port and the same IP address either way, and have one DNS entry for that IP address and it works anywhere I want it to. > But let me know how much you like it after your first cryptolocker. Entirely a tangential, unrelated point once you understand how things like "firewalls" actually work. > I suppose your backup storage is also public on the internet My most important backups are offline and offsite. But for other stuff, yes, it has a publicly routable IP address. Its not generally accessible publicly though. There are these things called "firewalls", they're really quite neat. One should also think about authn/authz as well next time you're working on your storage solutions as well, it'll do a lot to prevent cryptolocker issues you're so worried about. For instance, AWS S3 is all technically accessible publicly. Its locked down by policies, not by NAT limitations. And yet its generally seen as a very secure place to store things, assuming one has the right policies in place. It doesn't take it being behind a NAT to be secure, because if that's the major part of your security posture preventing your stuff from getting cryptolocker'd you're doing things very, very wrong. > I use bookmarks Ok, and you hop on someone else's computer and...where are my bookmarks? Oops! Or I want to connect back to my media server from a friend's streaming device...where are my bookmarks? Oops! And once again I bring up things like game consoles and other P2P applications which just work far better with actual publicly routable IP addresses directly. Strict NAT configurations will often cripple these services and good luck trying to have multiple consoles operating at once. CGNAT makes online gaming for some of these consoles just completely unusable, but if we just supported IPv6 it would have no problems.
- M95D 6mo ago
  > If I know my office network is one prefix, and I know my friend's house is another prefix, and I know my cellular carrier in my city is usually this prefix, I can greatly limit the scope of access. But it's still private use, not a public service. The fact that you access it from the internet side doesn't make it public. What you are describing here is in stark contradiction with your claimed easy to use IPv6. Why go through all this trouble if you wanted something easy to use as you describe IPv6? > So now I have to remember the port for local and the port for remote along with different IP addresses for both, or I can just use the normal service port and the same IP address either way, and have one DNS entry for that IP address and it works anywhere I want it to. No, you remember just your global DNS name which would be independent of ISP, geo location or router used, and work with dynamic allocated IPs too, and remember or bookmark a port number for each service. Reflection in the router would make that combination (name+port) work from inside the LAN too. >> But let me know how much you like it after your first cryptolocker. > Entirely a tangential, unrelated point once you understand how things like "firewalls" actually work. Oh, I know how they work, at least in Linux, I do. It's a 1 (one!) wrong setting away from exposing everything using IPv6 inside the LAN. > For instance, AWS S3 [...] And yet its generally seen as a very secure place to store things Do you really belive that? Really? > Or I want to connect back to my media server from a friend's streaming device...where are my bookmarks? OMG! And let his favorite cloud providers index my music collection?? No thank you! I ask for the 3.5 jack cable and connect my phone. Or BT pairing code.
  - vel0city 6mo ago
    > The fact that you access it from the internet side doesn't make it public A service I'm using its public IP for, routing through public network connections over the public internet, but somehow its not public networking its private networking despite private networks not really being involved. Got it. Having firewall rules suddenly makes it private networking, somehow. > remember or bookmark a port number for each service Or just don't, because I've got quintillions of public IP addresses just lying around. I can even have multiple instances of the same service running on the same box all running the same standard port numbers because I can just grab yet another IP address all day long. Why limit myself to having to memorize weird ports when I can just use the standard ones?

by M95D 6mo ago

vel0city 6mo ago

> Like I said, not public. Outside the home, in other words in networks other than at home. Potentially without VPNs. Accessible from other public IP addresses, potentially limited scopes of those. It seems you're thinking that allowing the traffic from other public networks is an all or nothing thing. That either you allow all public network traffic or none of it. That's just not true. If I know my office network is one prefix, and I know my friend's house is another prefix, and I know my cellular carrier in my city is usually this prefix, I can greatly limit the scope of access. It doesn't have to be an all or nothing, either its open to every single other device or only local devices, I can define exactly which networks or devices I want to allow the traffic from or not. If I wanted to just let my friend's network audio receiver to connect to my music server, I can add it's public ip address and allow that traffic. No VPNs, no tunnels, no proxies, no non-standard port assignments, just directly allowing it to talk to the music server. All through the public internet, but still locking down my music server to just local traffic and his remote network audio receiver. That's all still "public" networking. > In most parts of the world, I think, IP changes every time you restart the router, even IPv6. Often not with IPv6, prefixes stay pretty consistent usually. Not always true, but often true. I've had the same prefix for many, many years at multiple locations and multiple providers without having any kind of payment for static IP addresses. > So let it. Forward your own chosen port to 443 of the machine with the service. So now I have to remember the port for local and the port for remote along with different IP addresses for both, or I can just use the normal service port and the same IP address either way, and have one DNS entry for that IP address and it works anywhere I want it to. > But let me know how much you like it after your first cryptolocker. Entirely a tangential, unrelated point once you understand how things like "firewalls" actually work. > I suppose your backup storage is also public on the internet My most important backups are offline and offsite. But for other stuff, yes, it has a publicly routable IP address. Its not generally accessible publicly though. There are these things called "firewalls", they're really quite neat. One should also think about authn/authz as well next time you're working on your storage solutions as well, it'll do a lot to prevent cryptolocker issues you're so worried about. For instance, AWS S3 is all technically accessible publicly. Its locked down by policies, not by NAT limitations. And yet its generally seen as a very secure place to store things, assuming one has the right policies in place. It doesn't take it being behind a NAT to be secure, because if that's the major part of your security posture preventing your stuff from getting cryptolocker'd you're doing things very, very wrong. > I use bookmarks Ok, and you hop on someone else's computer and...where are my bookmarks? Oops! Or I want to connect back to my media server from a friend's streaming device...where are my bookmarks? Oops! And once again I bring up things like game consoles and other P2P applications which just work far better with actual publicly routable IP addresses directly. Strict NAT configurations will often cripple these services and good luck trying to have multiple consoles operating at once. CGNAT makes online gaming for some of these consoles just completely unusable, but if we just supported IPv6 it would have no problems.

M95D 6mo ago
> If I know my office network is one prefix, and I know my friend's house is another prefix, and I know my cellular carrier in my city is usually this prefix, I can greatly limit the scope of access. But it's still private use, not a public service. The fact that you access it from the internet side doesn't make it public. What you are describing here is in stark contradiction with your claimed easy to use IPv6. Why go through all this trouble if you wanted something easy to use as you describe IPv6? > So now I have to remember the port for local and the port for remote along with different IP addresses for both, or I can just use the normal service port and the same IP address either way, and have one DNS entry for that IP address and it works anywhere I want it to. No, you remember just your global DNS name which would be independent of ISP, geo location or router used, and work with dynamic allocated IPs too, and remember or bookmark a port number for each service. Reflection in the router would make that combination (name+port) work from inside the LAN too. >> But let me know how much you like it after your first cryptolocker. > Entirely a tangential, unrelated point once you understand how things like "firewalls" actually work. Oh, I know how they work, at least in Linux, I do. It's a 1 (one!) wrong setting away from exposing everything using IPv6 inside the LAN. > For instance, AWS S3 [...] And yet its generally seen as a very secure place to store things Do you really belive that? Really? > Or I want to connect back to my media server from a friend's streaming device...where are my bookmarks? OMG! And let his favorite cloud providers index my music collection?? No thank you! I ask for the 3.5 jack cable and connect my phone. Or BT pairing code.
- vel0city 6mo ago
  > The fact that you access it from the internet side doesn't make it public A service I'm using its public IP for, routing through public network connections over the public internet, but somehow its not public networking its private networking despite private networks not really being involved. Got it. Having firewall rules suddenly makes it private networking, somehow. > remember or bookmark a port number for each service Or just don't, because I've got quintillions of public IP addresses just lying around. I can even have multiple instances of the same service running on the same box all running the same standard port numbers because I can just grab yet another IP address all day long. Why limit myself to having to memorize weird ports when I can just use the standard ones?