← Back to context

Comment by johnmaguire

24 days ago

> the NAT-by-default of IPv4

IPv4 is not NAT-by-default. The reality of the world we live in today is that most home networks have a NAT, because you need multiple devices behind a single IP.

That said, I agree: it's quite unknowable how many services I've turned on on local machines with the expectation that a router firewall sat between me and potential clients.

But that doesn't go away with IPv6 - the NAT does, the router doesn't, and the firewall shouldn't either. For example, the default UniFi firewall rules for IPv6 are: 1. Allow Established/Related Traffic (outbound return traffic), 2. Block Invalid Traffic, 3. Block All Other Traffic

You must explicitly open a firewall rule for inbound IPv6 traffic. NAT is not the firewall.

12 comments

johnmaguire

Reply
cyberax  24 days ago

> NAT is not the firewall.

NAT _is_ a firewall. And a much safer one than IPv6 firewalls, because NAT will fail safe if misconfigured.

  • johnmaguire  24 days ago

    NAT is not a firewall: all it does is rewrite packets, it does not drop them.

    • jonathanlydall  24 days ago

      The article actually remarks on this kind of argument.

      While you are technically correct about NAT not being a firewall, it is in practice a widely used front-line defense which even if not “perfect”, it has indisputably proven to be quite effective against a lot of malicious activity.

      Against highly determined malicious actors you will of course want a proper firewall, but for 99% of people, NAT is enough to keep from being bothered by run of the mill malicious actors.

      Kind of like physical home security, a lot of it is very easy to bypass, but it’s good enough for the common threats.

      4 replies →

    • tyingq  24 days ago

      You have to squint a little and see they mean that most consumer routers don't map inbound unsolicited packets to anything internal unless the user specifically configured it to. Which is basically a firewall.

      2 replies →