Hacker News Reader

Comment by miyuru | Hacker News Reader

Don't you have any firewalls? My ISPs router blocks inbound connections by default on both address types.

Many internet users don't even know what the word firewall means. And there are a lot of devices with unpatched software. Obviously NAT shouldn't be seen as a firewall, but for many consumers it's pretty much the only line of defense.

I don't know if ISPs without NATs automatically deploy firewalls, but would hope so. IPV6 is harder to scan, but once you know a device's IP address (e.g. from web logs), it'd be easy to exploit older devices.

One example, AT&T cellular gives you an ipv6 address besides v4, and it's still behind a NAT (not just a firewall). Though I'm glad my home ISP lets me decide that for myself.

I have firewalls but don't trust them to have safe defaults. Or more like, I don't trust every random router, including ones that each member of my extended family will inevitably call me about, to have safe firewall defaults until I test it myself.

I reasonably trust, not 100% but pretty well, that my boss's or grandma's PC with ip 192.168.1.3 on NAT (not even routable from the WAN) will not receive inbound TCP/UDP. That would take effort.

Following this logic, don't trust your grandma's router to have UPnP and NAT-PMP disabled by default too. NAT becomes effectively unsecure with them.

This argument is so overused we might as well add it to ipv6-excuses.txt.

Upnp is where the shred of doubt comes from. Only a shred because the PC very likely won't use it, and nowadays few routers have it by default. And the solution is, upnp shouldn't exist.

>nowadays few routers have it by default

And nowadays few routers have IPv6 firewall disabled by default... Do you see how fragile your argument is now?

Enough routers still have ipv6 firewall disabled by default, in which case, every port on every networked device is exposed. Upnp, I'm less worried about being enabled, and even if it is, Windows won't map SMB to itself.

In the long term with our world of cheap crappy routers, it's also much easier for upnp to die off than for ipv6 firewalls to become ubiquitously strong. Both of those are extra features that take effort to do right. So is NAT, but a broken NAT doesn't expose hosts.

My grandparent's crappy ISP-sponsored router from ~2017 (maybe 2016), TP-Link C1200 v1, had the IPv6 firewall enabled by default. (It has UPnP enabled by default too... which I turned off promptly. They don't need it anyway.)

My own Asus router from 2016, RT-AC1200G+, also came with IPv6 firewall enabled.

Both routers are 8 years old at this point. And they are far from being a prosumer product. What router are you using that it doesn't come with IPv6 firewall enabled?

edit: Oh, and my friend's cheapo Netis router (quite an obscure brand IMO) also had IPv6 firewall enabled out of the box.

>ipv6 firewalls to become ubiquitously strong

They don't need to be strong, the firewalls just have to be stateful so that they can drop unsolicited packets. It's that simple. Any other more sophisticated attacks would have made your NAT equally vulnerable as well.

Additionally, stateful firewalls have been available since decades ago. They are not exactly black magic.

I'll have to check the one I have at home when I get home. Airport Extreme is one example I remember not having ipv6 firewalling by default, even though it has it for v4.

It's important to test this. I own an MSI router where the firewall is completely broken for IPV6. They even made the mistake of listening for DNS and HTTP (admin tool) on the external interface.

IPv6 is still confusing for many developers

Exactly, even if my router says "ipv6 firewall enabled," I still can't trust that they did it right. I would rather go full NAT (which on most routers equals disabling IPv6) than have to pen-test my router.

"Full NAT" doesn't even make sense. Do you mean symmetric NAT or something in that vein?

>which on most routers equals disabling IPv6

Turning on NAT on IPv4 certainly does not entail turning off IPv6. Just _what_ exactly are you sprouting? It's not the first time you have made beginner mistakes like this.

Reply on news.ycombinator.com