Comment by X-Istence | Hacker News Reader

Comment by X-Istence | Hacker News Reader

Parent Full thread

> Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default).

Comcasts cable modem also doesn't have any firewall for IPv4... it's a cable modem, it passes packets.

Your CPE (customer premises endpoint) is where the firewall lives.

> IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6.

Most newer consumer gear that does IPv6 blocks all in-bound traffic on IPv6, just like it does on IPv4.

> Comcasts cable modem also doesn't have any firewall for IPv4... it's a cable modem, it passes packets.

Most of the new stuff comcast ships is an "all in one" device that acts as an access point, a router and a cable modem. You can buy third party cable modems that do what you describe but what comcast gives you is much more fancy.

You should almost always buy a 'dumb' cable modem and have your own router that you manage behind it. These devices are commonly behind on firmware and may have completely insecure settings that you'll never have insight into.

Having an outdated firmware (which could be solved by mandatory updates from the ISP, which appears to be the direction AT&T is going) is still much better than having no firewall at all. An incredible minority of people, who “manage” their household internet access are aware of any of this.

If your firewall has exploitable outdated firmware, I might argue it's worse than no firewall because now you potentially have malicious code living on your network. Whereas if you don't have a firewall (on a home network) there generally isn't anything someone could get into anyway. "Oh I see port 22 is open." Great, there's nothing to SSH into anyway, who cares?

Surprisingly, it probably does have a firewall. Cable modems are really odd devices.

That said, the relevant part is the router (which may be part of the same physical device these days), and that part certainly does have both a v4 and a v6 firewall, configured securely for both.

Reply on news.ycombinator.com