Hacker News Reader

Comment by yorwba | Hacker News Reader

You don't need a NAT for that, it's a job for a firewall. You could have each poorly secured device with their own IP, but still not reachable from the outside.

View on HN

Except NAT is dead simple, and requires basically zero configuration of the CPE from the end-user perspective. Yeah, it complicates (though seldom completely breaks) a host of important applications, but it's hard to think you could replace it with a firewall with an off the shelf configuration and have it work any better.

It's not dead simple, it just seems that way because the router already comes configured for it. If you had a router already configured with a default firewall, that would seem dead simple, too.

If it comes pre-configured with the same behavior as NAT (no unsolicited ingress), what does that really solve over using NAT?

When you get multiple devices that require the same inbound ports (game consoles are a good example) you can open the same port for each device.

And NAT is required for networks that are behind too few IPv4 IP's.

With IPv6, users can put their devices out on the wild-west open internet without needing any kind of NAT or firewall for protection.

The large number of open access points in the wild points out the danger here -- most consumers know nothing about network security and will set up their home network with dozens of IoT devices all on the public internet behind their ISP's non-firewalling router because they can, and everything works.

It is unlikely that ISPs are going to provide CPE that doesn't firewall incoming connections by default, even if it issues devices on the LAN real public IPv6 addresses.

About as unlikely as ISP's providing Wifi routers that default to open with no WPA password as used to be common?

They'll do whatever makes support easiest until they are forced to do otherwise by regulation or bad press.

The first (2010-vintage Apple Airport Extreme) and second (2017-vintage TP-Link something something) I'd done IPv6 with behaved this way by default if you enabled IPv6. I don't see why Comcast or AT&T would likely do worse. Sure they could, but this is not the likely scenario.

Then I imagine you don't have much experience with Comcast or AT&T if you don't see why they'd do worse than Apple.

The default configuration for many firewalls (software, at least) approximates "allow all outgoing connections but no incoming". Assuming all your connections pass through the same box (which they usually will, for a home network), there's no reason why it shouldn't have such a firewall even if it's otherwise a router that doesn't do NAT.

Denying the ISPs trivial inspection into the structure of home networks, OTOH, is a major benefit and maybe a concrete downside to adopting IPv6 locally.

It is the firewall. How many typical consumers have a dedicated firewall?

All those consumer gateway boxen that do NAT can also do firewalling. The ones supporting IPv6 even tend to present the same (or similar) UI for "create firewall allow rule" and "create static port/host mapping".

I agree -- but they don't. Let's imagine that the Internet started with IPv6 and NAT never became the standard. How many legacy routers would there be floating around with no built-in firewall? How would that affect the security landscape?

Everyone seems to misunderstand that I am not advocating for what should be/should have been, but instead providing the benefits of how things played out given the reality of the world.

Reply on news.ycombinator.com