5 ms·

I'm just wondering about how much will actually change with IPv6. I already have native IPv6 at home and it seems that my home router (a FritzBox) has a statefu

by skrause 12y ago

I'm just wondering about how much will actually change with IPv6. I already have native IPv6 at home and it seems that my home router (a FritzBox) has a stateful firewall enabled for all IPv6 connections. I can manually exclude individual addresses from firewalling, but that's about it. At first glance that looks like the right solution: People keep saying that instead of the NAT hack you should have native IPv6 with firewalling for the same or better level or protection. But doesn't a stateful IPv6 firewall introduce the same problems as NAT? Won't I still have to use keepalive packets or protocols like PCP to actually use P2P? Of course real P2P is easily possible with IPv6 by simply opening up everything. But what are our options for having both security by default in home networks and no need for those workarounds we have in NAT now?

simmons 12y ago
At least with IPv6 we won't have the mess of translation, requiring p2p apps to perform public address determination (and possibly port guessing). But you're right, the central problem remains.
zurn 12y ago
> But doesn't a stateful IPv6 firewall introduce the same problems as NAT? Depends on what it does and how it's configured. If the whole internet ends up running with default-deny stateful IPv6 firewalls, then that's a setback, but you still have global addressibility if not reachability. > Won't I still have to use keepalive packets or protocols like PCP to actually use P2P? Even IPv6 + PCP is a real improvement. Default-allow on the consumer routers + host based firewalls would be much better though.
- MrBuddyCasino 12y ago
  > Default-allow on the consumer routers I remember the time of 56k modems. Port scans were fun back then. Sucked, would not dial-up again. Host based firewalls: for some reason this sends the networking neckbeards into rage mode, god knows why. I'd say its slightly weaker than blocking everything on the router.
  - api 12y ago
    In practice neither is strong. I worked in infosec for a while. Nearly every real-world threat we saw came in via HTTP, IMAP/POP3, or some other "pull" mechanism. Firewall might as well not have even been there. Anyone who thinks "firewall == security" is terribly out of date. I'd say the only thing firewalls still provide protection against is pure remote vulnerabilities in common system services. Those still appear occasionally, but are more rare than they used to be. With better service isolation, coding standards, and authentication they'll become even rarer.

by skrause 12y ago

simmons 12y ago

At least with IPv6 we won't have the mess of translation, requiring p2p apps to perform public address determination (and possibly port guessing). But you're right, the central problem remains.

zurn 12y ago

> But doesn't a stateful IPv6 firewall introduce the same problems as NAT? Depends on what it does and how it's configured. If the whole internet ends up running with default-deny stateful IPv6 firewalls, then that's a setback, but you still have global addressibility if not reachability. > Won't I still have to use keepalive packets or protocols like PCP to actually use P2P? Even IPv6 + PCP is a real improvement. Default-allow on the consumer routers + host based firewalls would be much better though.

MrBuddyCasino 12y ago
> Default-allow on the consumer routers I remember the time of 56k modems. Port scans were fun back then. Sucked, would not dial-up again. Host based firewalls: for some reason this sends the networking neckbeards into rage mode, god knows why. I'd say its slightly weaker than blocking everything on the router.
- api 12y ago
  In practice neither is strong. I worked in infosec for a while. Nearly every real-world threat we saw came in via HTTP, IMAP/POP3, or some other "pull" mechanism. Firewall might as well not have even been there. Anyone who thinks "firewall == security" is terribly out of date. I'd say the only thing firewalls still provide protection against is pure remote vulnerabilities in common system services. Those still appear occasionally, but are more rare than they used to be. With better service isolation, coding standards, and authentication they'll become even rarer.