IPv6 is not insecure because it lacks a NAT

Post by anonymars » Wed, Jan 21, 2026, 1:38 PM UTC

quotemstr wrote: post #306

1dom wrote: post #292

John, your post opens saying it's addressing the point: “the NAT-by-default of IPv4 effectively means that I get the benefit of a default-deny security strategy.” Your title is "IPv6 is not insecure because it lacks NAT" I'm sure anyone who understands how NAT offers the equivalent of a default block rule also understands that the absence of NAT alone doesn't make IPv6 insecure. This makes the title feel a little cli…

> There's more security to be had in an intrinsic architectural feature No, there is not. Even ignoring the question of whether the concept of an ordinal ranking in amount of security even makes sense, this claim doesn't make sense. If the invariant is that incoming connections are blocked by default, an IPv4 NAT and an IPv6 default deny rule are equivalent in security: both uphold the invariant. If the claim is that…

Post by p0w3n3d » Wed, Jan 21, 2026, 1:42 PM UTC

figmert wrote: post #213

p0w3n3d wrote: post #212

I'd argue not about security, but transparency - when having your mac address partially included in the IPv6, you would basically allow browsers and other systems identify you without additional steps. Early IPv6 commonly used EUI-64 addressing, which did embed your MAC address into the IPv6 interface ID

Sure, but your MAC address is easily spoofed. In fact, all major operating systems do it nowadays for public WiFi systems and you have to explicitly opt-out of randomising your MAC Address when connecting.

Post by nottorp » Wed, Jan 21, 2026, 1:47 PM UTC

Macha wrote: post #318

nottorp wrote: post #278

Earlier quoted context omitted.

> IPv6 works internally out of the box Works if you rely on the ISP provided box? And why pick on ARP and not on SLAAC, NDS, DAD, RS, RA... ?

Been running IPv6 for years on both my home network and internet servers, and I've never had to think about NDS, DAD, RS. SLAAC is something I've only had to think about once at network setup time, less than I think about DHCP on my IPv4 network. RAs I have actually had to think about because Unifi has had some regressions in IPv6 support over the years, but that's fixed these days so it's likely going into the "don'…

Post by winstonwinston » Wed, Jan 21, 2026, 1:58 PM UTC

ghshephard wrote: post #57

zamadatix wrote: post #35

Earlier quoted context omitted.

I'm not sure I buy the "you get a leak of the address of a high value target you believe can be routed to over the internet in some fashion, but it's the internal address which leaked and you have no idea who could own said high value target either" story. I agree if it's an actual concern then you can use NAT66 to hide the prefix, I just don't see how this achieves security when the only publicly accessible attack p…

NAT66 doesn't add much in the way of security here, because the external address is fully routable and maps 1:1 to the internal address. You are once again fully dependent on a correctly configured firewall. The IPv6 address that I shared was, in fact, a static (and real) IPv6 address, belonging to a real device - with the possible exception of the last 3 bytes, was likely one I worked on frequently. Put another way…

Post by vlan0 » Wed, Jan 21, 2026, 2:01 PM UTC

deng wrote: post #294

Before you engage in discussions, may I suggest to look into RFC 4787, especially section 5 about filtering behaviors of NAT: https://datatracker.ietf.org/doc/html/rfc4787#section-5 Several things can be correct at the same time: * NAT is not a firewall * NAT can still filter traffic (and practically always does) * NAT can hence still provide security features * The real world often does not care about original defin…