News for hackers. Stuff that matters.

A comment on Comcast’s Xfinity Internet Now the World’s Largest Native IPv6 Deployment. Parent comment

Re:Comcast’s Xfinity Internet Now the World’s Largest Native... by simoncion on Tuesday November 26, 2013 @07:03PM (#6805230)
That's (IMO) pretty terrible default behavior.

1) Is it easy for a somewhat technical person to change? 2) If you don't mind telling, who's your ISP?

[ Parent | on HN ]
Re:Comcast’s Xfinity Internet Now the World’s Largest Native... by wmf on Tuesday November 26, 2013 @09:07PM (#6805753)
There's an IETF standard that says IPv6 home routers should have a default deny firewall. http://tools.ietf.org/html/rfc6092#page-15 Some people are trying to get it changed: http://tools.ietf.org/html/draft-v6ops-vyncke-balanced-ipv6-...
[ Parent | on HN ]
Re:Comcast’s Xfinity Internet Now the World’s Largest Native... by simoncion on Tuesday November 26, 2013 @10:10PM (#6806053)
Both of those are Informational documents, not Standards. :) Documents like this one are Standards: http://tools.ietf.org/html/rfc2616

Given the quality of MSFT's and Apple's firewalls, and the ease of use of MSFT's (I assume Apple's is easy to use, but I have no direct experience), I cannot agree that a default DENY firewall policy is a good default configuration. We'd be back in the world where consumers would need something uPnP to manage firewall rules on their router.

I can agree that refusing to route requests to things like port 445/tcp is reasonable.

[ Parent | on HN ]
Re:Comcast’s Xfinity Internet Now the World’s Largest Native... by mappu on Tuesday November 26, 2013 @07:28PM (#6805349)
It's definitely not ideal (blocking end-to-end routing defeats a lot of the point of IPv6) but i understand the security POV. It is straightforward to change, about the same complexity as forwarding a port was on IPv4 (click around in web ui for a minute or two).

The router is an AVM FritzBox 7340, the ISP is Snap (New Zealand).

I have no idea if this setting is common or not for IPv6 deployments.

[ Parent | on HN ]
Re:Comcast’s Xfinity Internet Now the World’s Largest Native... by simoncion on Tuesday November 26, 2013 @07:36PM (#6805393)
Thank you very much for the information. I, too understand why that would be the default configuration. It's very good to hear that it's not a pain to change.

Do you know if you can set that FritzBox up to just act as a DSL->Ethernet bridge and pass through packets to another device that does all the routing? (Sorry if that doesn't make sense. I'm not a professional network nerd, so my terminology might be confused.)

[ Parent | on HN ]