News for hackers. Stuff that matters.

A comment on The Ripe NCC Has Run Out of IPv4 Addresses. Parent comment

Re:The Ripe NCC Has Run Out of IPv4 Addresses by jacquesm on Monday November 25, 2019 @12:45PM (#21630677)
You're technically correct but in practice ever since NAT has been a thing routers have stopped passing on incoming connections to the machines behind it unless specifically - and usually laboriously - configured to do so. This is also why NAT is considered hostile to a peer-to-peer internet, which prompted this very good article:

https://www.fourmilab.ch/documents/digital-imprimatur/

by John Walker, of Autodesk fame.

The router has a public IP and everything behind it has a local one. That you can do NAT in different contexts and that technically you could have NAT without the firewall functionality doesn't change that this is 99.9% of all NAT applications.

A bit more text about this concept:

https://security.stackexchange.com/questions/176744/why-is-n...

[ Parent | on HN ]
Re:The Ripe NCC Has Run Out of IPv4 Addresses by ATsch on Monday November 25, 2019 @01:33PM (#21631218)
I think this distinction is very important, for the following reason: Once you've acknowledged that firewalls are technically optional, but used in 99% of cases, there's no reason to say why home routers wouldn't come out of the box with IPv6 firewalls in 99% of cases too.

And this is in fact what we see in the real world with IPv6 deployments. Roughly 50% of my country has IPv6, and every single provider provisions it with sensible default firewall rules.

[ Parent | on HN ]
Re:The Ripe NCC Has Run Out of IPv4 Addresses by zAy0LfpBZLC8mAC on Monday November 25, 2019 @03:06PM (#21632203)
By that same logic, NAT provides internet connectivity. 99.9% of all NAT applications come with an internet uplink. Therefore, you need NAT for internet access. Not.
[ Parent | on HN ]