3 ms·

Although the ipv6 addresses are all technically globally routable, my (ISP-provided) router defaults to not routing new incoming connections through to addresse

by mappu 13y ago

Although the ipv6 addresses are all technically globally routable, my (ISP-provided) router defaults to not routing new incoming connections through to addresses on the LAN. Outgoing TCP connections work fine. So in effect you get the same security as NAT.

simoncion 13y ago
That's (IMO) pretty terrible default behavior. 1) Is it easy for a somewhat technical person to change? 2) If you don't mind telling, who's your ISP?
- mappu 13y ago
  It's definitely not ideal (blocking end-to-end routing defeats a lot of the point of IPv6) but i understand the security POV. It is straightforward to change, about the same complexity as forwarding a port was on IPv4 (click around in web ui for a minute or two). The router is an AVM FritzBox 7340, the ISP is Snap (New Zealand). I have no idea if this setting is common or not for IPv6 deployments.
  - simoncion 13y ago
    Thank you very much for the information. I, too understand why that would be the default configuration. It's very good to hear that it's not a pain to change. Do you know if you can set that FritzBox up to just act as a DSL->Ethernet bridge and pass through packets to another device that does all the routing? (Sorry if that doesn't make sense. I'm not a professional network nerd, so my terminology might be confused.)
- wmf 13y ago
  There's an IETF standard that says IPv6 home routers should have a default deny firewall. http://tools.ietf.org/html/rfc6092#page-15 http://tools.ietf.org/html/rfc6092#page-15 Some people are trying to get it changed: http://tools.ietf.org/html/draft-v6ops-vyncke-balanced-ipv6-security-01#section-3.1 http://tools.ietf.org/html/draft-v6ops-vyncke-balanced-ipv6-...
  - simoncion 13y ago
    Both of those are Informational documents, not Standards. :) Documents like this one are Standards: http://tools.ietf.org/html/rfc2616 http://tools.ietf.org/html/rfc2616 Given the quality of MSFT's and Apple's firewalls, and the ease of use of MSFT's (I assume Apple's is easy to use, but I have no direct experience), I cannot agree that a default DENY firewall policy is a good default configuration. We'd be back in the world where consumers would need something uPnP to manage firewall rules on their router. I can agree that refusing to route requests to things like port 445/tcp is reasonable.

by mappu 13y ago

simoncion 13y ago

That's (IMO) pretty terrible default behavior. 1) Is it easy for a somewhat technical person to change? 2) If you don't mind telling, who's your ISP?

mappu 13y ago
It's definitely not ideal (blocking end-to-end routing defeats a lot of the point of IPv6) but i understand the security POV. It is straightforward to change, about the same complexity as forwarding a port was on IPv4 (click around in web ui for a minute or two). The router is an AVM FritzBox 7340, the ISP is Snap (New Zealand). I have no idea if this setting is common or not for IPv6 deployments.
- simoncion 13y ago
  Thank you very much for the information. I, too understand why that would be the default configuration. It's very good to hear that it's not a pain to change. Do you know if you can set that FritzBox up to just act as a DSL->Ethernet bridge and pass through packets to another device that does all the routing? (Sorry if that doesn't make sense. I'm not a professional network nerd, so my terminology might be confused.)
wmf 13y ago
There's an IETF standard that says IPv6 home routers should have a default deny firewall. http://tools.ietf.org/html/rfc6092#page-15 http://tools.ietf.org/html/rfc6092#page-15 Some people are trying to get it changed: http://tools.ietf.org/html/draft-v6ops-vyncke-balanced-ipv6-security-01#section-3.1 http://tools.ietf.org/html/draft-v6ops-vyncke-balanced-ipv6-...
- simoncion 13y ago
  Both of those are Informational documents, not Standards. :) Documents like this one are Standards: http://tools.ietf.org/html/rfc2616 http://tools.ietf.org/html/rfc2616 Given the quality of MSFT's and Apple's firewalls, and the ease of use of MSFT's (I assume Apple's is easy to use, but I have no direct experience), I cannot agree that a default DENY firewall policy is a good default configuration. We'd be back in the world where consumers would need something uPnP to manage firewall rules on their router. I can agree that refusing to route requests to things like port 445/tcp is reasonable.