7 ms·

I'm not a network engineer. But I've yet to see a good way to protect ipv6 network. I don't want my local webserver develop on to be exposed to the internet. It

by yarosv 5y ago

I'm not a network engineer. But I've yet to see a good way to protect ipv6 network. I don't want my local webserver develop on to be exposed to the internet. It's my understanding that default router configuration will do just that. I don't see a good way to deal with privacy issues. Ipv6 essentially gives a unique identifier for every computer in the household by default.

kazen44 5y ago
protecting ipv6 Networks works just the same as ipv4 networks. by using firewalling. NAT is not a security mechanism. most consumer routers seem to block any incoming traffic from the outside world by default anyways.
- yarosv 5y ago
  I'm not trying to be aggressive here. But what's the actual end user difference between NAT and firewalled ipv6 for me and my local network then? I assume I could route now than one addresses for a specific port. On the other hand I have to pay for domain record to access my local resource without a struggle. Should I use ipv6 at home when my doesn't have one? I honestly struggle to find good information on the protocol that's decades old. It's either to deep for me to care for my needs or too shallow to understand why and how should I just it. Scaremongering is what I find on the internet. And no real benefits for me to update my hardware or find ISP that has ipv6.
  - nezgar 5y ago
    I can kind of relate to the feeling of IPv6 being "new and scary" to back in 1995 when I barely grasped IPv4 routing... everything becomes clear eventually with experience and exposure... hopefully eventually I'll understand more IPv6 concepts with time. I "want to believe". :) But I do fully get that firewall without NAT is perfectly fine (great) in an IPv6 world - but may be necessary in simpler multi-ISP routing scenarios...
  - api 5y ago
    The difference is that traversal protocols like UDP hole punching work deterministically almost 100% of the time in an IPv6 environment but are flaky in an IPv4 NAT environment. It also means that you never experience port exhaustion on large networks, which is a problem for large IPv4 NAT deployments.
deleted 5y ago
[deleted]
jagger27 5y ago
I haven't seen a single IPv6 network configured to behave like that by default. Just because it has a globally unique address doesn't mean it's reachable.
merlyn 5y ago
You'd setup your firewall to protect your IPv6 network. This policy says do this, firewall defaults to no traffic pass. Same as you have now. IPv6 privacy extension (been around for many many years, and default on at least MacOS and others for many iterations), gives you a new IPv6 address every time period, and rotates through them transparently.
- mercora 5y ago
  just want to make it clear, usually you are assigned a prefix which you can announce to your network and then nodes will pick random addresses from that prefix. its still easy to determine the packets came from your network just not clear from which device exactly much like current NAT setups lets say...
  - api 5y ago
    That's true for IPv4 too. I've had the same IPv4 from my ISP for months. The truth is that if you are not tunneling over some kind of VPN or using onion routing your IP is public, period.
  - ale42 5y ago
    ... unless your ISP would change your prefix regularly (like every day), like it's now the case for those who have a public dynamic IPv4. If they give you a static IPv6 prefix, it's like giving you a static IPv4 now, i.e. something ISPs would probably want to monetize as a premium service. So I'm pretty sure we'll end up with regularly changing prefixes... which is probably good for privacy.
    - ac29 5y ago
      Anecdotal, but I manage connections from AT&T and Comcast and both have had stable IPV6 prefixes since they were installed multiple years ago.
    - kaliszad 5y ago
      In most countries, the ISP is legally obliged to keep records at which point in time has a customer had an address. Usually a court can order an ISP to hand over those records. In other cases, the police, secret service, copyright lawyers etc. can talk directly to the ISP.
p_l 5y ago
New home routers (the kind that ISPs give out to clients) with IPv6 support include default deny firewall on externally-initiated connections, precisely for that reason. If you think NAT gave you any privacy benefits... at best it made for easy "household mapping" of people.

by yarosv 5y ago

kazen44 5y ago

protecting ipv6 Networks works just the same as ipv4 networks. by using firewalling. NAT is not a security mechanism. most consumer routers seem to block any incoming traffic from the outside world by default anyways.

yarosv 5y ago
I'm not trying to be aggressive here. But what's the actual end user difference between NAT and firewalled ipv6 for me and my local network then? I assume I could route now than one addresses for a specific port. On the other hand I have to pay for domain record to access my local resource without a struggle. Should I use ipv6 at home when my doesn't have one? I honestly struggle to find good information on the protocol that's decades old. It's either to deep for me to care for my needs or too shallow to understand why and how should I just it. Scaremongering is what I find on the internet. And no real benefits for me to update my hardware or find ISP that has ipv6.
- nezgar 5y ago
  I can kind of relate to the feeling of IPv6 being "new and scary" to back in 1995 when I barely grasped IPv4 routing... everything becomes clear eventually with experience and exposure... hopefully eventually I'll understand more IPv6 concepts with time. I "want to believe". :) But I do fully get that firewall without NAT is perfectly fine (great) in an IPv6 world - but may be necessary in simpler multi-ISP routing scenarios...
- api 5y ago
  The difference is that traversal protocols like UDP hole punching work deterministically almost 100% of the time in an IPv6 environment but are flaky in an IPv4 NAT environment. It also means that you never experience port exhaustion on large networks, which is a problem for large IPv4 NAT deployments.

deleted 5y ago

[deleted]

jagger27 5y ago

I haven't seen a single IPv6 network configured to behave like that by default. Just because it has a globally unique address doesn't mean it's reachable.

merlyn 5y ago

You'd setup your firewall to protect your IPv6 network. This policy says do this, firewall defaults to no traffic pass. Same as you have now. IPv6 privacy extension (been around for many many years, and default on at least MacOS and others for many iterations), gives you a new IPv6 address every time period, and rotates through them transparently.

mercora 5y ago
just want to make it clear, usually you are assigned a prefix which you can announce to your network and then nodes will pick random addresses from that prefix. its still easy to determine the packets came from your network just not clear from which device exactly much like current NAT setups lets say...
- api 5y ago
  That's true for IPv4 too. I've had the same IPv4 from my ISP for months. The truth is that if you are not tunneling over some kind of VPN or using onion routing your IP is public, period.
- ale42 5y ago
  ... unless your ISP would change your prefix regularly (like every day), like it's now the case for those who have a public dynamic IPv4. If they give you a static IPv6 prefix, it's like giving you a static IPv4 now, i.e. something ISPs would probably want to monetize as a premium service. So I'm pretty sure we'll end up with regularly changing prefixes... which is probably good for privacy.
  - ac29 5y ago
    Anecdotal, but I manage connections from AT&T and Comcast and both have had stable IPV6 prefixes since they were installed multiple years ago.
  - kaliszad 5y ago
    In most countries, the ISP is legally obliged to keep records at which point in time has a customer had an address. Usually a court can order an ISP to hand over those records. In other cases, the police, secret service, copyright lawyers etc. can talk directly to the ISP.

p_l 5y ago

New home routers (the kind that ISPs give out to clients) with IPv6 support include default deny firewall on externally-initiated connections, precisely for that reason. If you think NAT gave you any privacy benefits... at best it made for easy "household mapping" of people.