Hacker News Reader

Comment by spookthesunset | Hacker News Reader

> port forwarding

Well, you are gonna have to replace port forwarding with firewall rules instead. At least for me, I really don't excited about my parents or in-laws internal networks being wide open to the internet. Thus their entire subnet would need to sit behind a "default deny" firewall. And if they need to expose some service to the internet, they'd need to punch a hole in the firewall--which is exactly the same dance you'd have to play with port forwarding.

The only thing IPv6 brings to the table for consumers is each device gets a globally routable address. But that doesn't mean each device can or should be be reachable from outside the router. One way or another client software will not get away from having to open ports on the router.

View on HN

The difference is that with a firewall, you open the port and that's that. With port forwarding, you get whatever port happens to be available. If done manually, you have to tell the other sode which port to use. If done automatically (like upnp), you need to do that every time your port changes.

There is no difference of opening a port in a firewall or a NAT (well, as long as there is a single machine that wants to listen on that port, at least).

And some kind of UPnP will still be required even if your internal network were using ISP-assigned IPv6 addresses for protocols that want to open multiple connections, like VoIP conferencing, bit torrent etc.

Of course, if you have an internal network where you actually communicate between your various machines, you won't want to use ISP-assigned publicly routable IPs, since those can change at any time, so you'll also need some kind of network address translation at the edge.

> well, as long as there is a single machine that wants to listen on that port, at least

Well yes, most networks have more than one machine and multiple users might want to run the same service.

> you'll also need some kind of network address translation at the edge.

Not at all, each machine gets two addresses - one routable from the ISP and one non-routable from the router. Internal services simply use the non-routable ones.

> And if they need to expose some service to the internet, they'd need to punch a hole in the firewall--which is exactly the same dance you'd have to play with port forwarding.

The difference being, with IPv4 only one machine in the house can have a port open. You don't just open a port, you choose _which_ single machine gets the port. Sometimes you can't open a port on a machine because the port's already taken.

With IPv6 any/every machine can have the same port open at the same time.

One of these scenarios is obviously just broken.

The setup you describe, a default deny firewall, is in fact how consumer routers operate. It's not something you need to configure yourself - router manufacturers do this by default, as recommended by RFC 6092. The idea that IPv6 home networks are "wide open to the internet" is a myth.

Reply on news.ycombinator.com