Hacker News Reader

If you get IPv6 from your ISP you're usually not "behind NAT", even if your home router does NAT IPv4 or your ISP does CGNAT for IPv4.

View on HN

I am a blue collar layperson (who only understands IPv4's limitation as a lack of total available IP addresses) that disables IPv6 (at the router level) for this exact reason — I feel like I am losing the little bit of control that being "behind NAT" allows on a private IP range/network (e.g. firewall; port mapping).

Obviously I still use Windows 7 Pro 64-bit as my only Microsoft computer — also have an Ubuntu dual Xeon (for LLM/crypto) and several Apple Silicon products (for general browsing).

Do you have a gateway that doesn't do ipv6 firewalling (e.g. allow outgoing, only allow established incoming)? I was under the impression that even no-names manage to get that correct. Why would you need port mapping if not for NAT? Even with NAT, for home use I was always mapping port n to n.

You're misunderstanding the purpose of NAT, which is not a security boundary. Apple, for instance, has (or had) nearly all of their workstations on a public IP space.

You can still equally as effectively firewall and port map devices on public IPs as you can behind NAT -- and actually just a bit easier, since you're taking NAT out of the picture.

Reply on news.ycombinator.com