Hacker News Reader

Comment by kikoreis | Hacker News Reader

Except NAT is dead simple, and requires basically zero configuration of the CPE from the end-user perspective. Yeah, it complicates (though seldom completely breaks) a host of important applications, but it's hard to think you could replace it with a firewall with an off the shelf configuration and have it work any better.

View on HN

It's not dead simple, it just seems that way because the router already comes configured for it. If you had a router already configured with a default firewall, that would seem dead simple, too.

If it comes pre-configured with the same behavior as NAT (no unsolicited ingress), what does that really solve over using NAT?

When you get multiple devices that require the same inbound ports (game consoles are a good example) you can open the same port for each device.

The default configuration for many firewalls (software, at least) approximates "allow all outgoing connections but no incoming". Assuming all your connections pass through the same box (which they usually will, for a home network), there's no reason why it shouldn't have such a firewall even if it's otherwise a router that doesn't do NAT.

Denying the ISPs trivial inspection into the structure of home networks, OTOH, is a major benefit and maybe a concrete downside to adopting IPv6 locally.

And NAT is required for networks that are behind too few IPv4 IP's.

With IPv6, users can put their devices out on the wild-west open internet without needing any kind of NAT or firewall for protection.

The large number of open access points in the wild points out the danger here -- most consumers know nothing about network security and will set up their home network with dozens of IoT devices all on the public internet behind their ISP's non-firewalling router because they can, and everything works.

It is unlikely that ISPs are going to provide CPE that doesn't firewall incoming connections by default, even if it issues devices on the LAN real public IPv6 addresses.

About as unlikely as ISP's providing Wifi routers that default to open with no WPA password as used to be common?

They'll do whatever makes support easiest until they are forced to do otherwise by regulation or bad press.

The first (2010-vintage Apple Airport Extreme) and second (2017-vintage TP-Link something something) I'd done IPv6 with behaved this way by default if you enabled IPv6. I don't see why Comcast or AT&T would likely do worse. Sure they could, but this is not the likely scenario.

Then I imagine you don't have much experience with Comcast or AT&T if you don't see why they'd do worse than Apple.

Reply on news.ycombinator.com