Context:
People have been asking for IPv6 Support on GitHub since years (probably a decade by now)
... and someone even got so annoyed that they decided to setup a dedicated website for checking this: https://isgithubipv6.live/
this post was submitted on 09 Jun 2024
806 points (98.0% liked)
Programmer Humor
19623 readers
507 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
You'd better hope that you can NAT ipv6 because if you aren't behind a CGNAT and then your LAN is completely exposed without a NAT you're very likely going to have devices exploited.
NATs on people's boundary has been doing pretty much all of the heavy lifting for everyone's security at home.
The word you are looking for is firewall not NAT.
NAT does not provide security whatsoever. If the NAT mapped your (internal IP, internal port) to a certain (external IP, external port) and you do not have a firewall enabled, everyone can reach your device by simply connecting to that (external IP, external port).
I haven't seen routers that do not come with IPv6 firewalls enabled by default.
to be fair thats the setup most people run when they open ports.
No the word I'm looking for is the NAT. It was not designed for security but coincidentally it is doing the heavy lifting for home network security because it is dropping packets from connections originating from outside the network, barring of course, forwarded ports and DMZ hosts because the router has no idea where to route them.
Consumer router firewalls are generally trash, certainly aren't layer 7 firewalls protecting from all the SMB, printer, AD, etc etc vulnerabilities and definitely are not doing the heavy lifting.
By and large automated attacks are not thwarted by the firewall but by the one-way NAT.
[Citation needed]
They are literally piggybacking on the netfilter module of Linux. I don't see how that's trash
They are not layer 7 firewalls for the network which are going to be where most the majority of attacks are concentrated. No citation needed unless you believe they are layer 7 firewalls or using something like Snort.
Added some clarification in my first sentence so it makes a bit of sense.
Wait, why are we talking about Layer 7 when NAT and firewalls are Layer 4 at best?
Because, as I said:
The NAT doesn't have to operate at layer 7 to be effective for this because
The point is that the SPI firewalls are not protecting against the majority of the attacks we've seen for decades now from botnets and other arbitrary sources of attacks, except, perhaps targeted DDoSing which isn't the big problems for most home networks. They must worry about having their OS' and software exploited and owned in the background, which doesn't get much of an assist from a router's firewall.
Obviously, this is however true for the NAT since the NAT are going to drop connections originating from outside the network attempting to communicate with that software to exploit it
How is this "dropping packets" not applicable to firewalls, then? You are not just going to casually connect to my IPv6 device as we're speaking. The default-deny firewall in my router does the heavy lifting... just like what NAT did.
Honestly, it just sounds like you need to brush up on networking knowledge. Repeat after me: NAT is not security.
Are you saying that everyone's router's firewall drops all packets from connections that originate from outside of your network?
It's a stateful firewall. It simply drops unsolicited packets.
So, really, you were "correcting" me for you and your specific setup at the very beginning because your router's firewall has a deny rule for all inbound connections because I must have been confusing what a NAT and what a firewall is because I must have been talking about your specific configuration on your specific devices.
Holy. Fucking. Shit.
Oh come on, are you seriously suggesting that default-deny is not the norm??
Holy. Fucking. Shit. Indeed.
Having a NAT on a consumer router is indeed the norm. I don't even see how you could say it is not.
I never said NAT = security. As a matter of fact, I even said
But hey, strawmanning didn't stop your original comment to me either, so why stop there?
I never even implied the opposite.
Right, because masquerade is NAT....specifically Source NAT.
I'm just going to go ahead an unsubscribe from this conversation.
Were I really strawmanning you? Is "I never even implied the opposite" really true? Quote:
Yeah, my "specific setup"... which can be found in virtually all routers today.