Comment by spookthesunset | Hacker News Reader

Comment by spookthesunset | Hacker News Reader

Parent Full thread

> you now have more tools to shoot yourself in the foot with

And the tools for managing IPv6 firewall rules suck on "SMB grade" stuff like ubiquiti and are virtually non-existant on any consumer grade router. If I have to SSH into the router and treat it like a "real" router to set up IPv6 firewall rules... it is never gonna fly for anybody who isn't proficient with "real" routers (i.e. >99% of the world).

Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default).

IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6.

Honestly I just don't really see IPv6 replacing IPv4. It introduces too many problems and offers too little benefit. Whatever actually replaces IPv4 will either need to be 10x better than IPv4 in every way or be a completely transparent migration that works with IPv4 "but with more addresses".

> Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default).

Comcasts cable modem also doesn't have any firewall for IPv4... it's a cable modem, it passes packets.

Your CPE (customer premises endpoint) is where the firewall lives.

> IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6.

Most newer consumer gear that does IPv6 blocks all in-bound traffic on IPv6, just like it does on IPv4.

> Comcasts cable modem also doesn't have any firewall for IPv4... it's a cable modem, it passes packets.

Most of the new stuff comcast ships is an "all in one" device that acts as an access point, a router and a cable modem. You can buy third party cable modems that do what you describe but what comcast gives you is much more fancy.

You should almost always buy a 'dumb' cable modem and have your own router that you manage behind it. These devices are commonly behind on firmware and may have completely insecure settings that you'll never have insight into.

Having an outdated firmware (which could be solved by mandatory updates from the ISP, which appears to be the direction AT&T is going) is still much better than having no firewall at all. An incredible minority of people, who “manage” their household internet access are aware of any of this.

If your firewall has exploitable outdated firmware, I might argue it's worse than no firewall because now you potentially have malicious code living on your network. Whereas if you don't have a firewall (on a home network) there generally isn't anything someone could get into anyway. "Oh I see port 22 is open." Great, there's nothing to SSH into anyway, who cares?

Surprisingly, it probably does have a firewall. Cable modems are really odd devices.

That said, the relevant part is the router (which may be part of the same physical device these days), and that part certainly does have both a v4 and a v6 firewall, configured securely for both.

> And the tools for managing IPv6 firewall rules suck on "SMB grade" stuff like ubiquiti and are virtually non-existant on any consumer grade router. If I have to SSH into the router and treat it like a "real" router to set up IPv6 firewall rules... it is never gonna fly for anybody who isn't proficient with "real" routers (i.e. >99% of the world).

Umm, the IPv6 firewall interface is exactly the same as the IPv4 firewall interface on UniFi[1].

1. https://i.imgur.com/waISjwe.png

Reply on news.ycombinator.com