News for hackers. Stuff that matters.
Re:IPv6 Is Hard by johnea on Sunday February 16, 2025 @02:08PM (#43070698)
I don't disagree, but I would point out that one upside to every LAN being behind NAT, is that those LANs are also inherently firewalled.

This is dependent on the firewall features of the NAT router, but at least its something, and the router provides one centralized point of protection from interent traffic.

In IPv6 typically every machine on a LAN is directly connected to the internet with a public IP address. Every one of those machines now needs a full strength internet firewall.

This complicates some intra-LAN communications, and removes the feature of having the LAN be a walled garden, mostly isolated from the interent.

Re:IPv6 Is Hard by KAMSPioneer on Sunday February 16, 2025 @02:22PM (#43070815)
Or you can implement a firewall on your gateway device with a default drop policy for inbound traffic. Essentially the same behavior as NAT in terms of unsolicited (usually malicious) inbound traffic, but without the downsides of one-to-many NAT.

Which is, coincidentally, exactly how it works if your LAN is made up of devices with publicly-routable IPv4 addresses as well, which happens in business/academic/military networks all the time.

Re:IPv6 Is Hard by aboardRat4 on Sunday February 16, 2025 @08:43PM (#43073975)
But most users are not business academic military.

They just want to watch some reels.

Re:IPv6 Is Hard by KAMSPioneer on Monday February 17, 2025 @01:47AM (#43075958)
And? Most consumer routers also implement a stateful firewall with deny-by-default inbound policy. My point is that NAT isn't a security feature, and that firewalls in edge network equipment is table stakes these days.
Re:IPv6 Is Hard by aboardRat4 on Monday February 17, 2025 @03:19AM (#43076521)
>Most consumer routers also implement a stateful firewall with deny-by-default inbound policy.

No they don't.

Most ISP boxes only implement the bare minimum of functions to make sure that youtube is available to the users. Which includes NAT, because otherwise youtube does not work, and does not include anything else.

Re:IPv6 Is Hard by KAMSPioneer on Monday February 17, 2025 @05:58AM (#43077521)
Well, that's news to me. I don't use consumer routers myself, but I know lots of folks who do. Now, I won't say that I go investigating their home networks, but IPv6 is rather prevalent among the discount ISPs where I live, and I know of at least two coworkers who have an IPv6 firewall by default with their router.

Anyway, NAT is costlier than a firewall. It uses more memory, it requires rewriting packets on-the-fly, and typically if you're using embedded Linux (I'll assume that the vast majority of consumer devices for this are) then you're already using `iptables` or `nftables` to get NAT functionality. It is comparatively to set default inbound/forward drop policies.

But yes, I should have said "in my experience," since it's true that I only know the networking equipment of a few people in a small country with limited IPv6 rollout (my ISP does not provide it).