Sitting pretty in IPv4 land? Look, you're gonna have to talk to IPv6 at some stage

Re: Never!

@DougS

Wow and if you dig a hole in your driveway that should stop thieves getting to your house, or least by your description.

NAT provides no security whatsoever, the printer mentioned above only needs to initiate a single outgoing packet to the router that will then open a port public side and any (that is ANY!) internet traffic that hits that port public side will be sent to the printer. About time people stopped confusing the basic "established" firewalls rules used in home router devices for NAT providing security!

As for how can someone route to your 192.168.1.0/24 IP space at home behind your NAT device. Quite easily remember the box is just a router passing traffic from any connected subnet to another. This assumption just says I expect my ISP to not forward traffic using private addressing on the source or destination and most don't do this. There are varying methods to get traffic destined to your private range at home to pass over the net.

NAT simply states if traffic passing the router meets this rule then change the source/destination IP and/or port to something else, if it does not meet this rule then pass it unmodified. <- here see no security at all!

Your firewall is what says if this traffic is from the WAN and is not for an established connection in the connection tracking table then drop it usually via the implicit deny any any rule at the bottom.

Sure plenty of you will go on thinking NAT provides security until your IPv6 printer starts spitting out pages of unwanted messages - of course it won't as your ISP will have enabled the firewall by default.

This doesn't even account for the open wireless access point installed on most home printers these days (a quick scan of my neighborhood shows plenty)

Re: Never!

Wouldn't really matter either way. It's just that using RFC1918 addresses makes it that much more likely the packet stays inside.

And I've got a better one for you. Why don't you prove it actually happens in real life by describing the means to do it using a spare home router, meaning one can easily do it at home using actual physical devices and wires?

Re: Never!

It's not exactly horribly difficult though, is it? If you know how to run these four commands:

iptables -P FORWARD DROP

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -i lan0 -j ACCEPT

iptables -t nat -A POSTROUTING -o wan0 -j MASQUERADE

then you already know how to run these three commands:

ip6tables -P FORWARD DROP

ip6tables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

ip6tables -A FORWARD -i lan0 -j ACCEPT

It doesn't take a long sysadmin course to learn how to not run one command! What's everybody so afraid of?

For the other 99% of people who don't know to set up the necessary firewall rules for a NATed network in v4, it's even simpler: just plug in the ISP-provided dumb box and away you go, just like you've always done it.

Re: Never!

IPv6 supports everything IPv4 does. There's no need to make adopting it unnecessarily difficult by demanding people study long sysadmin courses just to set up their home network.

There, you just did it again. Please stop putting words into people's mouths. Nowhere did I say that home users will have to do this; the router folks can and should do it by default. It's utterly trivial for a consumer router to know which interface is the LAN and which is the WAN and construct the firewall with or without NAT to a safe default. Of course, they probably won't given the historical state of uPNP, WPS and so on being similar in quality and thought for the end user as a British Leyland car built in the 70s but that's not my problem unless and until I get a job at Draytek et al.

We, the El Reg commentards, are not consumers. If you want a discussion on consumer broadband, head on over to ThinkBroadband or Kitz where you will find untold thousands of like-minded users. The article addresses, therefore the comments are about, proper networking rather than consumer "hit generic chipset with a lump hammer until it sort of works, apply logo to /fs-overlay/var/www/images and ship" routers.

For the avoidance of doubt, nobody was or is saying that v6 doesn't support NAT, that NAT should be ditched on consumer networks or that it'll require at least a CCNA to set up v6 in the home.

Re: Never!

Arguing over NAT isn't productive for encouraging people over to IPv6. Better to explain that they can still use a feature than to try to convince them that they don't want that feature.

Characterising the downvotes on your post, which was about why not to use NAT, as people downvoting a post in favour of IPv6 will inevitably have escalated that issue.