Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If you have that mentality, we'll never get off IPv4. If that happens, ISPs won't have a choice but to implement Carrier Grade NAT. That's bad for a lot of reasons, but mostly because many homes share the same address. Implementing IPv6 means every device in the world has a unique, globally routable address with all ports open (no NAT).

That's pretty cool. However, we can only do this if we get over the chicken-and-egg problem, which is why it's important you enable IPv6 and encourage others to do so.



> Implementing IPv6 means every device in the world has a unique, globally routable address with all ports open (no NAT).

Not necessarily. I've configured my IPv6 firewall to block all the things except for specific ip:port pairs. I didn't feel like leaving my network totally open.


IPv6 gives you the ability to make that choice for yourself rather than having it foisted upon you.


Indeed, in this case (and I'd imagine in most cases). IPv6 also gives your ISP the ability to make that choice for you; some ISP's, for example, block ports 25 and 80.


You setting up firewall rules at your gateway has no influence on whether an address is routable or not.


If I want to pirate content, your Carrier Grade NAT looks quite attractive as a legal shield!


I'm not entirely sure if CGN will provide some legal protection for pirates but it might make it harder to pirate content as you cannot open ports on CGN meaning BitTorrent will have less seeds which slows downloads. Afaik, IPv6 will make piracy extremely easy as UPnP won't be a requirement. Want to share a file with some friends? You can quickly spin up a web server, send them the URL and it'll just work.


You still need UPnP or something, otherwise your IPv6 default firewall policy (allow out deny in) is going to block inbound connections.

Yes, it's easier to hole punch, but a webserver won't do that.

And if you're manually configuring a firewall, I'm not sure "allow port 80 <someIPv6>" is any easier than "forward port 80 to <someipv4>.

What am I missing?


I think you are missing a lot. For instance, I have IPv6 set up at home, at work and at some homes of friends and family. I have firewall rules setup such that traffic from subnets I know is generally allowed instead of allowing access to a single port for the general internet. I also have DNS set up with names like computername.sitename.mydomain.tld

That allows me and the people I know to connect to each other's machines in a way that wouldn't be possible with IPv4 and NAT. I can be at my brothers and type \\[fqdn] in explorer and it will just work. To me, that is the way the internet was meant to function from the beginning.


If you're able to configure firewall rules, you're well outside of any normal users able to make up a significant amount of P2P traffic. And to most users, port forwarding and configuring a firewall rule are nearly identical.

Truth is that for most users, NAT today is almost always synonymous with a firewall that has deny in, allow out policy.

10+ years ago, a lot of folks often connected their machines to the Internet in the way you specified. You could go around scanning people's systems, viewing their fileshares and so on. NAT "fixed" a lot of that.


First off, good luck trying to implement any kind of decentralized network service when almost nobody has a globally routable address.

Second, if ISPs are willing to keep records of IP-address-to-customer mappings, it's not much of a stretch to add TCP/UDP ports to those records as well.


The IETF has (sadly) specced logging of cgn associations for surveillance purposes.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: