Comment by inigyou
4 days ago
It's literally impossible to avoid long addresses being long or short addresses running out. One of those is a worse problem.
4 days ago
It's literally impossible to avoid long addresses being long or short addresses running out. One of those is a worse problem.
The length isn’t the only thing that makes the ergonomics suck. The lack of backwards compatibility sucks. The “you don’t have to use NAT anymore” is great theoretically, but it renders a lot of casual network maintainers mental model of network security obsolete without a clear and simple alternative. The shorthand is not intuitive (though it’s not CIDR-level counterintuitive). Really, there’s way too much about working in IPv6 that’s not intuitive with even very solid IPv4 network knowledge.
So yeah, having to relearn a bunch of basic network knowledge that worked just fine for decades is a PITA, and I’m 100% positive a design process that focused more on the people that need to configure networks could have yielded a much friendlier, and therefore a much easier to adopt standard.
Instead of forwarding a port to a specific machine on the NAT page, you allow incoming traffic on that port to that machine on the firewall page. You'll want to add a stable IP to the host (in addition to the SLAAC rotating privacy IP if it already has one. One interface can have multiple addresses). That's pretty much it, except now you can allow the same port to multiple machines, where previously you could only forward to one (helpful for gaming, voip, etc. Wherever p2p works well). Firewall should already default deny incoming traffic just like ipv4.
That sounds easy, but I think you just inadvertently demonstrated the quagmire that many seem to perceive.
Suppose I've got a machine on the LAN and I want to open it up to the world on port 1025 with IPv6.
This can't happen with SLAAC? It has to be a new address? Does the ISP pick the prefix for that address? And one can't centrally-manage that address (because people keep saying that DHCPv6 isn't worth stuffing around with)? What happens when the router fails over to a backup ISP? How does dynamic DNS fit in with all of this?
Those questions don't really exist with IPv4, wherein: One can just set up a static DHCP assignment, forward port 1025, and [optionally] set up dynamic DNS -- and this all happens within the confines of a single home router.
1 reply →
you fling around words like "network maintainers" quite casually, dont you? :)
its really extremely simple, just dont NAT, is that really so hard? just because you dont NAT, doesnt mean you have to let the traffic pass through, that is also an extremely simple concept, no?
Fling it around?
There are a shitload of people who maintain networks, like home or small business networks, that aren’t network administrators. Most of those people are not prepared to have their Chinese WiFi cameras, myriad smart appliances, and heck, even home computers easily individually accessible from the internet. It’s an extremely simple concept, no?
14 replies →