News for hackers. Stuff that matters.

A comment on Reasons for servers to support IPv6. Parent comment

Re:Reasons for servers to support IPv6 by imoverclocked on Saturday January 29, 2022 @07:25PM (#30132165)
You can simply not route a specific range, no firewall needed.

NAT, on its own, doesn't provide security. At best, it provides obscurity. At worst, it breaks security [2]. NAT needs a properly configured firewall to provide security [1]. In this sense, NAT vs a Firewall is a false dichotomy.

[1] https://tailscale.com/blog/how-nat-traversal-works/

[2] https://www.computerworld.com/article/2556611/nat-traversal-...

edit: formatting

[ Parent | on HN ]
Re:Reasons for servers to support IPv6 by tsimionescu on Saturday January 29, 2022 @08:28PM (#30132749)
I wasn't claiming NAT is adding security. A combined IPv4 NAT/firewall will not necessarily be less performant than an IPv6 firewall - that was my claim.

Also, GP claimed that certain services that don't work because of NAT would work on an IPv6 network. I was curious which services those might be, that don't work because of NAT but wouldn't be affected by a firewall.

[ Parent | on HN ]
Re:Reasons for servers to support IPv6 by Dagger2 on Sunday January 30, 2022 @08:34AM (#30137036)
If you're behind CGNAT then generally you won't be able to accept any inbound connections, so even things like a basic webserver aren't doable.
[ Parent | on HN ]