Hacker News Reader

Comment by ge0rg | Hacker News Reader

Direct Client Connections (DCC) became infeasible about 20 years ago with the proliferation of NAT routers. The workarounds (connection tracking and rewriting) never arrived for the masses.

View on HN

I think IPv6 was designed to not need NAT, so once we get IPv6 we will see cool new protocols again. Only problem is we developers make software insecure by listening on all IP's instead of just private. And without a password! Having your security camera or what not accessible from the Internet should really be opt-in. It's our own fault that everything is NAT:ed, and that the only open ports in the firewall are 80,443. We need more peer pressure between developers in order to make things secure by default, and not allow insecure by convenience.

Default IPv4 (for consumers) is a single IP with masq/NAT. Then with user authorization add port forwarding as needed.

Default IPv6 (for consumers) is block all incoming (except for traffic related to outgoing). Then with user authorization add allow rules as needed.

So basically no difference between IPv4 vs IPv6.

If you default firewall on IPv6 is allow all... buy a better router/firewall.

We would not need a router or firewall. Probably not a wifi either. All stationary devices will be wired in. And mobiles would use 6G or 7G. Where I live (sweden) you can already get 10Gbe. Now imagine the possibilities. For example VR with less then a ms latency to closest datacenter. Where your device is just a thin client. Microsoft are already planning to build a DC near major cities, hopefully they are up to something cool.

Reply on news.ycombinator.com