Re:Reasons for servers to support IPv6
by justsomehnguy on Saturday January 29, 2022 @12:07PM
(#30128003)
>Firewalls are fine but having the ability to make machines unroutable is even more powerful, no?
For the whole world there is absolutely no difference betwen routable address, non-routable address or even an absense of the machine... behind a firewall with drop all on a public interface.
Your statement doesn’t address the point you are responding to so it makes me think you completely missed the point you are replying to.
You are correct in theory. What you don’t seem to be taking into consideration are firewall vulnerabilities or other unknown things that could happen that make it different from a practical standpoint.
I started an ISP from the ground in 1996. I’ve seen a lot of weird stuff. You seem to just hand waive it away like firewalls are this perfect bastion of security.
Maybe you have more experience than I do?
where do you think the NAT and associated connection tracking is occurring exactly?
Anything smaller than a IPv6 /48 is effectively unroutable. Your ISP has to route smaller blocks, like /64s, privately (because only /48s hit public bgp). And then you have to route the /64 they assign you privately once again.
No. There is no difference between the two from a security point.
While I get that firewalls are probably safe like 99.99% of the time… I’ve gotta say, I just don’t trust software to not have vulns of some sort that someone important already knows how to break. So eg for a corporate network I would be hesitant to do this, for my personal network not so much (unlikely that a 3 letter agency gives a shit about what I do).
Additionally. Firewall changes can sometimes fail for whatever reasons so you might have accidentally exposed a node publicly for some time.
Making those nodes not reachable from the internet seems prudent. It’s like your office building has a public address but your office assignments don’t need to be public.