3 ms·

> If I know my office network is one prefix, and I know my friend's house is another prefix, and I know my cellular carrier in my city is usually this prefix, I

by M95D 6mo ago

> If I know my office network is one prefix, and I know my friend's house is another prefix, and I know my cellular carrier in my city is usually this prefix, I can greatly limit the scope of access. But it's still private use, not a public service. The fact that you access it from the internet side doesn't make it public. What you are describing here is in stark contradiction with your claimed easy to use IPv6. Why go through all this trouble if you wanted something easy to use as you describe IPv6? > So now I have to remember the port for local and the port for remote along with different IP addresses for both, or I can just use the normal service port and the same IP address either way, and have one DNS entry for that IP address and it works anywhere I want it to. No, you remember just your global DNS name which would be independent of ISP, geo location or router used, and work with dynamic allocated IPs too, and remember or bookmark a port number for each service. Reflection in the router would make that combination (name+port) work from inside the LAN too. >> But let me know how much you like it after your first cryptolocker. > Entirely a tangential, unrelated point once you understand how things like "firewalls" actually work. Oh, I know how they work, at least in Linux, I do. It's a 1 (one!) wrong setting away from exposing everything using IPv6 inside the LAN. > For instance, AWS S3 [...] And yet its generally seen as a very secure place to store things Do you really belive that? Really? > Or I want to connect back to my media server from a friend's streaming device...where are my bookmarks? OMG! And let his favorite cloud providers index my music collection?? No thank you! I ask for the 3.5 jack cable and connect my phone. Or BT pairing code.

vel0city 6mo ago
> The fact that you access it from the internet side doesn't make it public A service I'm using its public IP for, routing through public network connections over the public internet, but somehow its not public networking its private networking despite private networks not really being involved. Got it. Having firewall rules suddenly makes it private networking, somehow. > remember or bookmark a port number for each service Or just don't, because I've got quintillions of public IP addresses just lying around. I can even have multiple instances of the same service running on the same box all running the same standard port numbers because I can just grab yet another IP address all day long. Why limit myself to having to memorize weird ports when I can just use the standard ones?
- M95D 6mo ago
  > A service I'm using its public IP for, routing through public network connections over the public internet, but somehow its not public networking its private networking despite private networks not really being involved. Got it. Having firewall rules suddenly makes it private networking, somehow. It's a private service exposed to public networks when it shouldn't be. That's not how it's done. You are taking risks. I'm sure others would agree with me if this article wasn't this old. > Why limit myself to having to memorize weird ports when I can just use the standard ones? For the reasons I explained before, mainly LAN security and DNS not working with dynamic IP allocations. But, go ahead, have it your way. Each of us have our own priorities in life. Convenience is a valid choice. Keep those offline backups updated.
  - vel0city 6mo ago
    > That's not how it's done. Its not how it was done because of NAT. You just couldn't have done it that way for a long time. We don't need NAT anymore. > For the reasons I explained before, mainly LAN security and DNS not working with dynamic IP allocations But once again, its not actually changing the security characteristics at all compared to choosing weird ports and having to deal with reflection issues. The service is still opened either way, just one requires you to choose other ports.

by M95D 6mo ago

vel0city 6mo ago

> The fact that you access it from the internet side doesn't make it public A service I'm using its public IP for, routing through public network connections over the public internet, but somehow its not public networking its private networking despite private networks not really being involved. Got it. Having firewall rules suddenly makes it private networking, somehow. > remember or bookmark a port number for each service Or just don't, because I've got quintillions of public IP addresses just lying around. I can even have multiple instances of the same service running on the same box all running the same standard port numbers because I can just grab yet another IP address all day long. Why limit myself to having to memorize weird ports when I can just use the standard ones?

M95D 6mo ago
> A service I'm using its public IP for, routing through public network connections over the public internet, but somehow its not public networking its private networking despite private networks not really being involved. Got it. Having firewall rules suddenly makes it private networking, somehow. It's a private service exposed to public networks when it shouldn't be. That's not how it's done. You are taking risks. I'm sure others would agree with me if this article wasn't this old. > Why limit myself to having to memorize weird ports when I can just use the standard ones? For the reasons I explained before, mainly LAN security and DNS not working with dynamic IP allocations. But, go ahead, have it your way. Each of us have our own priorities in life. Convenience is a valid choice. Keep those offline backups updated.
- vel0city 6mo ago
  > That's not how it's done. Its not how it was done because of NAT. You just couldn't have done it that way for a long time. We don't need NAT anymore. > For the reasons I explained before, mainly LAN security and DNS not working with dynamic IP allocations But once again, its not actually changing the security characteristics at all compared to choosing weird ports and having to deal with reflection issues. The service is still opened either way, just one requires you to choose other ports.