Hacker News Reader

Comment by stingraycharles | Hacker News Reader

“Block everything” works as long as you aren’t actually opening any services on the local network.

If I want to open up a device with a single port, I should open that in the firewall. But wait, my IPv6 addresses aren’t stateful, so they can change any time.

And then suddenly someone decides to just open port 80 and 443 on the main router, and bam! I’ve just opened up those ports for _all_ IPv6 clients in my LAN.

You think all those IP cameras and ring doorbells were vulnerable when they are behind a NAT? Just wait what happens when they all get assigned public IPv6 addresses.

I’m not saying that these problems are unsolvable. But I think it’s important to at least recognize that, yes, this is different than how we did things with NAT, and you now have more tools to shoot yourself in the foot with.

View on HN

> you now have more tools to shoot yourself in the foot with

And the tools for managing IPv6 firewall rules suck on "SMB grade" stuff like ubiquiti and are virtually non-existant on any consumer grade router. If I have to SSH into the router and treat it like a "real" router to set up IPv6 firewall rules... it is never gonna fly for anybody who isn't proficient with "real" routers (i.e. >99% of the world).

Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default).

IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6.

Honestly I just don't really see IPv6 replacing IPv4. It introduces too many problems and offers too little benefit. Whatever actually replaces IPv4 will either need to be 10x better than IPv4 in every way or be a completely transparent migration that works with IPv4 "but with more addresses".

> Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default).

Comcasts cable modem also doesn't have any firewall for IPv4... it's a cable modem, it passes packets.

Your CPE (customer premises endpoint) is where the firewall lives.

> IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6.

Most newer consumer gear that does IPv6 blocks all in-bound traffic on IPv6, just like it does on IPv4.

> Comcasts cable modem also doesn't have any firewall for IPv4... it's a cable modem, it passes packets.

Most of the new stuff comcast ships is an "all in one" device that acts as an access point, a router and a cable modem. You can buy third party cable modems that do what you describe but what comcast gives you is much more fancy.

You should almost always buy a 'dumb' cable modem and have your own router that you manage behind it. These devices are commonly behind on firmware and may have completely insecure settings that you'll never have insight into.

Having an outdated firmware (which could be solved by mandatory updates from the ISP, which appears to be the direction AT&T is going) is still much better than having no firewall at all. An incredible minority of people, who “manage” their household internet access are aware of any of this.

If your firewall has exploitable outdated firmware, I might argue it's worse than no firewall because now you potentially have malicious code living on your network. Whereas if you don't have a firewall (on a home network) there generally isn't anything someone could get into anyway. "Oh I see port 22 is open." Great, there's nothing to SSH into anyway, who cares?

Surprisingly, it probably does have a firewall. Cable modems are really odd devices.

That said, the relevant part is the router (which may be part of the same physical device these days), and that part certainly does have both a v4 and a v6 firewall, configured securely for both.

> And the tools for managing IPv6 firewall rules suck on "SMB grade" stuff like ubiquiti and are virtually non-existant on any consumer grade router. If I have to SSH into the router and treat it like a "real" router to set up IPv6 firewall rules... it is never gonna fly for anybody who isn't proficient with "real" routers (i.e. >99% of the world).

Umm, the IPv6 firewall interface is exactly the same as the IPv4 firewall interface on UniFi[1].

1. https://i.imgur.com/waISjwe.png

You should use one of your PDs as a DMZ not putting your externally exposed web server in the same subnet as your IOT or other outbound only devices. If you're hosting a lot of things™ you should be using a static DMZ, same as you would on IPv4.

For the more general user case ("I want to host a game session with my friend") I'm not sure if there is something like UPnP for dynamically registering allowed ports without needing to actually do any NAT work but that would certainly seem useful.

Reply on news.ycombinator.com