IPv6 is not insecure because it lacks a NAT • Hacker News Board

Re: IPv6 is not insecure because it lacks a NAT

#181

Post by BatteryMountain » Wed, Jan 21, 2026, 7:09 AM UTC

fsh wrote: post #148

BatteryMountain wrote: post #141

I basically disable all ipv6 on my routers & firewalls completely. Waiting for the day we can disable ipv4 completely instead and use only ipv6 without NAT. But then each device will need its own firewall. NAT basically forces you to use some kind of firewall, which applies to all devices behind the NAT. But if we go all-in on IPv6, the firewall-by-default becomes much harder to implement in practice. Then we will ne…

You seem to have misunderstood how IPv6 works. In a home setup, all the traffic still goes through a single router which typically has a restrictive firewall enabled by default.

Only if enabled for a specific interface/network/zone/grouping... easy to misconfigure. You can easily misconfigure it to work fine for ipv4 but forgot about ipv6. Depending on what router software you use, this will either be easy or hard to spot. Sometimes the router software won't tell you explicitly that a certain interface is not included or that you have a gaping hole in your network somewhere.

If you use a consumer-grade device at home that you don't have full access to (meaning root via ssh and can update packages, cute web ui's alone don't count), you are screwed in other ways either way (hello open CVE's on unpatched routers....). I literally have a brand new Asus router sitting in a box at home, cause it has 3 open CVE's and asus basically dropped support for it, but they still sell them. Oh and I have root ssh access on it - it is running ubuntu 12 underneath it all (disgusting that asus haven't bumped it). Just all garbage. So I built my own x86 dual-nic/Wifi 6E router box that runs openwrt + adguard home + unbound + wireguard (all on proxmox) and all 4 systems update nightly. This setup absolutely crushes the performance versus top spec consumer-grade routers and I get to monitor it properly and update packages daily.

Re: IPv6 is not insecure because it lacks a NAT

#182

Post by whatevaa » Wed, Jan 21, 2026, 7:09 AM UTC

solaris2007 wrote: post #116

MobiusHorizons wrote: post #16

Fun fact I have actually had an sbc get hacked because I didn’t change the default password. I thought it would be reasonably safe for a few days because I knew the VLAN it was on had NAT and the associated firewall rules that deny inbound packets without outbound. But it turned out ipv6 was also enabled on that VLAN with no firewall. Left a bad taste in my mouth over a decade later even if it was a misconfigured fir…

That's pretty embarrassing lol

Nah, happened frequently at ipv6 early days. Some devices shipped with ipv6 enabled but no firewall out of the box.

Re: IPv6 is not insecure because it lacks a NAT

#183

Post by cwillu » Wed, Jan 21, 2026, 7:09 AM UTC

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

It's scary how somebody posting on hackernews thinks that this site is about hackers in the sense of security.

Re: IPv6 is not insecure because it lacks a NAT

#184

Post by jeroenhd » Wed, Jan 21, 2026, 7:12 AM UTC

nottorp wrote: post #178

No one's complaining that IPV6 is insecure. It may as well be very secure, but no one bothers to understand it if they're not paid to do that. Of course you can have default drop in your IPV6 firewall, but it's far easier to keep in your head that internal NATed IPs aren't accessible and "real" IPs are.

I've seen plenty of discussions here on HN where people have made that claim. Even more elsewhere on the discussion side of other news websites by sysadmins that disable IPv6 because one of their industrial routers didn't come with a default deny rule that one time which made them think that's normal.

The people who are supposed to know IPv6 never seemed to have learned it and many of them don't seem to be open to the idea of learning something new. Of course half the world runs on IPv6 now so they'll have to get with the times eventually, but the prevalence of statements like these is quite depressing.

Re: IPv6 is not insecure because it lacks a NAT

#185

Post by globular-toast » Wed, Jan 21, 2026, 7:15 AM UTC

Sohcahtoa82 wrote: post #5

This is going to depend on the router and on IP distribution. My ISP does not give me an IPv6 address, only a single IPv6 which all my network devices have to NAT through. NAT is not intended to be a security feature, for sure, but it creates security as a side effect . If I start up a web server on one of my devices, I know that it is unreachable from the Internet unless I go out of my way to set a port forward on m…

What ISP gives you a single IPv6 address? That's incredibly comical. An ISP would have at least 79 billion billion billion addresses and they are giving you one?!

If I run a webserver on my network I know it's unreachable from the internet unless I specifically allow inbound traffic to it at my firewall. I get to use the actual security features with sensible terminology instead of silly things like "port forward".

Re: IPv6 is not insecure because it lacks a NAT

#186

Post by athrowaway3z » Wed, Jan 21, 2026, 7:16 AM UTC

solaris2007 wrote: post #170

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

The competency crisis is very real.

I suspect the author was trying to put into words why their technically correct world view is better, but he spends his opening arguing semantics (ineffectually, as apparent) instead of meeting the 'wrong' people where they are and explaining why his semantics are an improvement.

Competency crisis is not limited to just the audience.

Re: IPv6 is not insecure because it lacks a NAT

#187

Post by digitalPhonix » Wed, Jan 21, 2026, 7:18 AM UTC

dehrmann wrote: post #142

amarant wrote: post #100

It's scary how much of this thread of supposed hackers comes from people who clearly don't understand the difference between a NAT and a firewall. NAT is not for security, it does not provide security. It is often bundled with a firewall. The firewall provides security. Firewall=\=NAT

This goes against Hyrum's law. NAT provides the behavior 99.9% of users want, usually by default, out of the box. True firewalls can do the same thing, but not necessarily by default, the firewall might not even by on by default, and there's more room for misconfiguration. IPv6 is a security regression for most people, regardless of its architectural merits or semantics of what's a firewall.

It’s still conflating things. You can have a stateless NAT: device x.x.x.y will get outbound source ports rewritten to (orignal port) This is a (dumb) NAT but has no state so it cannot possibly implement a default deny or any firewall adjacent features.

Re: IPv6 is not insecure because it lacks a NAT

#188

Post by almosthere » Wed, Jan 21, 2026, 7:18 AM UTC

So with IPv4 with NAT you definitely have this security. According to this article with IPv6 you MIGHT have that security -we don't know. That's not secure.

Re: IPv6 is not insecure because it lacks a NAT

#189

Post by denkmoon » Wed, Jan 21, 2026, 7:18 AM UTC

xl-brain wrote: post #49

denkmoon wrote: post #47

Earlier quoted context omitted.

This is entirely untrue. Every shitty router shipped by ISPs this side of the doctom bubble has a stateful firewall enabled by default. NAT is distinctly not the only thing protecting most home users. Not to mention every OS I know of shipping with its own firewall enabled with default deny on inbound.

You are stuck on the theory of what is protecting this population. In practice, less than 1% of these users can or will turn NAT off. Can you imagine how great things would work out with a public IP on all your nana's computers, NAT turned off, protected by the prowess of her Arris gateway's stateful firewall?

Telstra, one of Australia's massive telcos who are the "go to" telco for nannas who don't know anything about this internet thingy, have IPv6 enabled by default on their CPE routers. Without NAT. With a stateful firewall. Works perfectly fine for their millions of customers.

Re: IPv6 is not insecure because it lacks a NAT

#190

Post by jeroenhd » Wed, Jan 21, 2026, 7:19 AM UTC

john01dav wrote: post #98

alanfranz wrote: post #83

Earlier quoted context omitted.

…and they did really guess an ipv6 address? Full scans of the ipv6 address space looks infeasible. Or did the sbc reach out to the internet thus having its address exposed? Otherwise just the huge amount of addresses should make ipv6 “more secure” imho.

I don't know how much impact this has in practice, but you do not need to scan the entirety of the ipv6 address space because you can just look at the IPs that are registered to known ISPs/ASs.

You're gonna need to scan 2^64 addresses once you've located the IPv6 network assigned to my connection before you find my phone. 2^56 if you don't get lucky guessing the network prefix it happens to be on at that moment.

Assuming a scan with a minimum 4 byte ICMP packet, that's about 73786 petabytes of network traffic for that /64. You'll need to shove it down the pipe within a day because IPv6 privacy extensions means the IPv6 address used changes after 24 hours. With only 1gbps fiber, I don't think the deanonimysation is the problem at that kind of traffic level.