While I mostly agree with the idea, I dislike the appeal to original intent that often comes along with insisting "well direct device to device addressing is the way the internet was originally designed."
And its like true, but also the internet wasn't built with the intent that my fridge, lightbulb, etc were all gonna be online either. Of course the solution is a sane firewall not NAT, but similarly all of that is beyond the original scope as well, such is life.
In any case, ipv6 is an easy qualifier of several for me to apply stronger anti-bot checking, without really impacting my intended audience. Of course geolocation, ASNs, alleged user agents, etc all weigh in too.
> I dislike the appeal to original intent that often comes along with insisting "well direct device to device addressing is the way the internet was originally designed."
That's fair, I should have addressed that better.
> And its like true, but also the internet wasn't built with the intent that my fridge, lightbulb, etc were all gonna be online either.
Oh no, the devices in my WAN aren't directly exposed to the internet! What ever will I do‽
There's lots of reasons to push for IPv6, but the ability to not have a NAT is not a good one. I absolutely want everything on my network to be behind at least one layer of NAT. When setting up a router, I have two choices of internet protocol versions:
Choice A: If I set it up right, everything is behind a NAT. If I set it up wrong, there is no connection to the internet.
Choice B: If I set it up right, everything is behind a NAT. If I set it up wrong, Everything gets directly exposed to the internet.
Someday I'll get around to learning how to properly set up an IPv6 LAN, but until then, I'll just use the default IPv4 setting.
> NAT only drops unsolicited inbound packets because it doesn’t know where to take them.
NAT does not drop unsolicited inbound packets. That's your firewall. If NAT doesn't know what to do with a packet, it just ignores it. Your router will then route it based on whatever dest IP is in the packet.
If v6 was the thing that made you realize you needed a firewall, then v4 was less understandable to you than v6 is.
5 comments
[ 99.0 ms ] story [ 604 ms ] threadAnd its like true, but also the internet wasn't built with the intent that my fridge, lightbulb, etc were all gonna be online either. Of course the solution is a sane firewall not NAT, but similarly all of that is beyond the original scope as well, such is life.
In any case, ipv6 is an easy qualifier of several for me to apply stronger anti-bot checking, without really impacting my intended audience. Of course geolocation, ASNs, alleged user agents, etc all weigh in too.
That's fair, I should have addressed that better.
> And its like true, but also the internet wasn't built with the intent that my fridge, lightbulb, etc were all gonna be online either.
It kinda was. Remember "IP on Everything"?
There's lots of reasons to push for IPv6, but the ability to not have a NAT is not a good one. I absolutely want everything on my network to be behind at least one layer of NAT. When setting up a router, I have two choices of internet protocol versions:
Someday I'll get around to learning how to properly set up an IPv6 LAN, but until then, I'll just use the default IPv4 setting.NAT does not drop unsolicited inbound packets. That's your firewall. If NAT doesn't know what to do with a packet, it just ignores it. Your router will then route it based on whatever dest IP is in the packet.
If v6 was the thing that made you realize you needed a firewall, then v4 was less understandable to you than v6 is.