Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Not a networking expert by any means, but having built out a home network, my understanding is as follows:

Benefits-wise, your devices are addressable on the Internet, so it becomes simpler to create peer-to-peer connections, firewall traffic, and create segregated subnets.

Security-wise, your devices are addressable on the Internet, so all the workarounds to punch through NAT with terrible security implications aren't needed (I'm thinking UPnP mostly, but STUN/TURN/ICE are easy to get wrong). Essentially, under IPv4+NAT, your devices are already "addressable" via a combination of your router's IP and some form of session token, but securing such traffic depends on the successful implementation of a NAT-traversal protocol by a third party.



> Security-wise, your devices are addressable on the Internet

Nope. By default home routers (e.g., Asus) will block incoming connections just like with IPv4. It may allow pings (ICMP) in, but that's usually it.

You have to manually go in and tell the router to allow new connections in (either generally, or per service/port), just like the "DMZ" functionality with IPv4 many routers have.


And to open up those incoming connections on IPv6, we'll invent some other variant of UPnP so users don't have to manually go punch holes into their firewall to allow peer to peer connections.

IPv6 doesn't solve the problem of everything in the internal network being unable to accept incoming connections. With a NAT you need to set up port forwarding. With IPv6 you need to punch a hole into your firewall. Either way, home users will not be doing it by hand... we'll invent some protocol to do it and that protocol will have security issues.


> we'll invent some other variant of UPnP

We don't have to. UPnP works just fine with ipv6 already. (upnp v1.1, appendix A)


"UPnP Device Architecture V1.0 Annex A – IP Version 6 Support":

* http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf


> It may allow pings (ICMP) in, but that's usually it.

I sure hope it does. Blocking ICMP can cause TCP connections to hang due to inability to do MTU size detection.

With IPv4 this is usually not as visible, but with IPv6 if you block ICMP your connections will block as soon as you try to transfer a large block of data.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: