Hacker News Reader

Comment by wmf | Hacker News Reader

Instead of NAT traversal IPv6 is going to require firewall traversal.

Absolutely. I'll say it again and again, I like NATs, especially for home setups. They help hiding devices from the public that never need to be accessible outside of a LAN. And you can never trust home router firewalls to be configured correctly. If all devices had their unique IP address, we'd see much larger botnets out there.

If your router's firewall is set to not allow incoming traffic to an IP behind it, then the IP isn't going to be accessible, and it doesn't matter who knows the IP. This is much simpler than NAT.

Your device also isn't hidden too much if a NAT router lets it have the ability to make outgoing connections - it's just less convenient to access.

You might see more attacks targeting specific internal IPs if NAT never existed more but it doesn't necessarily follow that NAT is preventing or reducing botnets. Dos/DDoS attacks can be focused a your router with or without NAT.

You don't need any traversal services for that though. You can set up port forwarding as needed on you router if something requires special access.

Problems start with NATs that you can't control.

IPv6 space is too big to scan, a /64 network is already a big problem. Botnets require vuln device to have internet connectivity, they don't need to have inbound connections. Most of them use udp/dns etc. for control.

Reply on news.ycombinator.com