Comment by nobody9999

Comment by nobody9999 10 months ago

>I don't think we can ever return to "every node being a peer" in any case, not when any typical network will have a firewall that denies incoming connections.

Forgive me if I'm missing something here, but how is that any different WRT IPv4 vs. IPv6?

In both cases, except for those services one wishes to expose to the Internet (assuming one has a use-case for that), all incoming connections should be blocked, IPv4 or IPv6.

Or are you arguing that NAT masquerade confers some sort of security benefit on one's network that precludes the necessity of blocking incoming connections?

I'd argue that NAT (N:1 or 1:1) doesn't provide any security benefit. Nor does IPv4+NAT reduce the complexity of firewall rules as compared with IPv6.

In fact, I'd posit that NAT makes things more complicated and not less. That said, you can use NAT/NPT[0] with IPv6 (along with ULA/SLAAC) if you really want.

As such, I'd say that IPv6 provides the best and worst of IPv4, plus additional benefits.

IF we ever get completely off IPv4, that will be a good day.

[0] https://en.wikipedia.org/wiki/Network_address_translation#NA...

LegionMammal978 10 months ago

I don't think I'm disagreeing with you regarding firewalls: what I was trying to say is that "every node being a peer" isn't a good argument against NAT, since these days it holds neither in IPv4 nor in IPv6, now that everything has a firewall in front of it.

> In fact, I'd posit that NAT makes things more complicated and not less.

Sure, it clearly adds some iota of additional work, but I've never seen it as being the worst thing in the world. I'm young enough to have never witnessed the legendary paradise of globally-reachable static IPs for everything, so it seems more like "just the way things are". And yet there is widespread hatred against the existence of NAT, and I can't tell if it's primarily ideological, or if NAT is causing real practical difficulties for many setups. (Though at least the issues with CGNAT are easy to see. And also with broken NAT implementations.)

Meanwhile, one might argue that things like SLAAC in IPv6 can similarly add conceptual difficulties compared to IPv4. E.g., "How do I identify some particular device in my network, if its link-local IP is changing on a regular basis?" (To which the answer is something DNS-like, I guess?) So switching a network's internal operations from NATted IPv4 to NATless IPv6, with all of its different mechanisms, would seem like more of a tradeoff than an unequivocal win.

Reply View 2 replies

throw0101a 10 months ago

> I don't think I'm disagreeing with you regarding firewalls: what I was trying to say is that "every node being a peer" isn't a good argument against NAT, since these days it holds neither in IPv4 nor in IPv6, now that everything has a firewall in front of it.
In residential environments you can do whole bunch with UPNP/PCP, but with IPv4 you have the added complexity of STUN, TURN, and ICE:
* https://community.cisco.com/t5/collaboration-knowledge-base/...
* https://medium.com/@ecosmobtechnologies/webrtc-best-practice...
With IPv6 you simply punch a whole and and the two clients simply talking to each other with their GUAs.
(In more tightly controlled environments (e.g., work), firewall policies and hole punching are dictated by IT.)
> Meanwhile, one might argue that things like SLAAC in IPv6 can similarly add conceptual difficulties compared to IPv4. E.g., "How do I identify some particular device in my network, if its link-local IP is changing on a regular basis?"
If a device gets its address via DHCP(v4), how do you identify it? SLAAC is for dynamic environments, but if you want static services, configure IPv6 statically.
At least with IPv6 you don't need DHCP infrastructure (and complexities like IP helpers configured on routers) to get going.

Reply View | 1 reply
- LegionMammal978 10 months ago
  
  > With IPv6 you simply punch a whole and and the two clients simply talking to each other with their GUAs.
  Eh, I wouldn't call it that simple. With an IPv6 firewall, TCP hole-punching is still difficult to impossible depending on how strict the connection tracking is (necessitating something TURN-like), and UDP hole-punching still requires some timing trickery. It's useful to keep a connection open with a STUN server regardless, in case that influences the firewall. All that NAT does is add a few more possible failure points, depending on how the router sets up mappings.
  In the end, these are just hacks on hacks regardless, since we're never going to have reliable UPnP or similar on every network.
  > If a device gets its address via DHCP(v4), how do you identify it?
  I manage its assigned IPv4 address from the router, which itself presumably identifies it by MAC address. Doing it centrally from the router is often easier than trying to change the device's own settings.
  Regarding static IPv6, can you still have static addresses within a network, while using rotating privacy addresses for outside connections? I've always been somewhat unnerved by the idea of each device in a network having a persistent address that can be separately tracked.
  
  Reply View | 0 replies