Slightly off topic, but perhaps you can point me in the right direction. I recently upgraded my home router/NAT firewall to one that runs pfSense and it now supports IPv6. I was slightly horrified to find that DHCP had assigned all my devices IPv6 addresses and that they were all publicly routable. Comments online seemed to indicate that in order to protect devices on my local network from being probed by external entities I'd have to create custom firewall rules. I know just enough to know I didn't want to do that as the likelihood of doing it wrong and compromising security far outweighed any benefit I'd see from IPv6. The only other option was to disable all IPv6 traffic at the firewall.

What am I missing here? Is it intended that regular home users have their printer, which the manufacturer hasn't seen fit to update since Bush Jr. was president, exposed to the entire Internet? Is it that the IPv6 space is so large that port scanning for vulnerable machines is like finding a needle in a haystack?

[–] Perhyte@lemmy.world 11 points 1 year ago

Generally this isn't an issue for home users. Pretty much every home router defaults to denying incoming connections but allowing outgoing ones, for both IPv4 and IPv6.

In both cases you can of course configure the router to allow incoming connections on certain ports and (for IPv6) IP addresses (unless you're behind CGNAT), but it's almost never the default.

For IPv4 this happens to be a necessity of NAT: without additional configuration, the router simply doesn't know which device is being addressed because they all use the router's IPv4, so it can't forward it. For IPv6 this is a good and extremely common default firewall configuration, especially for routers intended for connecting private networks to the Internet.

The only real difference is that for outgoing IPv4 connections they typically all come from the same IPv4 (as seen from outside the local network) while for outgoing IPv6 you can potentially distinguish^1^ between different devices.

^1^: Not reliably, mind you: a device can have multiple IPv6 addresses, and many default to changing the one they use for outgoing connections every so often. Theoretically they could even re-use one that was previously used by another device, but that's vanishingly unlikely unless specifically configured to do so.

[–] Redex68@lemmy.world 3 points 1 year ago* (last edited 1 year ago) (1 children)

~~In general, you should probably turn on your router's NAT even for IPv6. What you mentioned is a security concern, and while yes, the IPv6 address space is enormous and finding a valid address is hard, if somebody already knows your IPv6 address it's a lot easier. For a home user there isn't really a reason for your ports to be accessible from the outside, and if you need such a thing, you can easily port forward specific ports~~.

edit: To add to that, turning on your router's NAT isn't a problem, you can always port forward, the problem with IPv4 is that you're behind two NATs, your router's and your ISP's. Because of this, you can't actually open up any port to be publicly visible on the Internet, which is extremely frustrating.

edit edit: Reply to my comment pointed out that what I suggest is retarded.

[–] 2xsaiko@discuss.tchncs.de 12 points 1 year ago (2 children)

In general, you should probably turn on your router’s NAT even for IPv6.

No, you should not! NAT is not needed with IPv6 and you should never use it unless you really know what you are doing.

NAT is not a security feature, firewalls are, the default firewall rules from consumer routers are generally enough (allow outgoing, deny incoming except if it's an existing connection). And if you're concerned about others tracking hosts inside your network, the default settings of Privacy Extensions makes your device assign itself different IPs for outgoing connections every so often.

[–] Lemmington@sopuli.xyz 3 points 1 year ago (1 children)

Coming from the land of IPV4 networks I struggle so much to wrap my head around this, do you have any suggestions for good resources to learn about it?

[–] 2xsaiko@discuss.tchncs.de 1 points 1 year ago

Learn about which part specifically? I'd argue that IPv6 is essentially IPv4 with reduced complexity (due to stuff like NAT no longer being necessary since address space is large enough). The basics of how smaller connected IPv4 networks work pretty much extends to how IPv6 works across the internet with a few differences such as link-local addresses which are only valid in the same network.

If you mean Privacy Extensions, that's part of SLAAC, which is a way of how devices in a network can get an IP address (the other being DHCPv6, which afaik works pretty much like DHCP in IPv4). Here, the router only announces the local network prefix and hosts assign IP addresses themselves, instead of the router assigning an address to each host. This works due to networks usually being a /64 block which is a large enough address space for IP collisions to be very unlikely (and in case they happen, the colliding hosts can resolve that automatically).

That's as far as my understanding goes anyway, I'm far from an expert, just someone who has set up a Linux home router from scratch so I've had to deal with this stuff :P

[–] Redex68@lemmy.world 1 points 1 year ago

Thanks for pointing out. By NAT there I meant symmetric NAT which by my understanding would fix that problem as well.

But you're right, NAT wouldn't make sense, you could just add some rules to the firewall.