[flagged]
One bad apple can spoil your IPv6 privacy (2022)
41–50 of 64 posts
Re: One bad apple can spoil your IPv6 privacy (2022)
#42What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)
I think the real question is "what the hell IoT is doing on a globally-routable network?" Put it on an isolated VLAN with no Internet connectivity. Or a minimal connectivity only to what's absolutely necessary (e.g. I haven't seen IoT devices that need inbound connections, so drop any inbound packets unless conntrack says otherwise). There there will be probably no need for weird NAT66 contraptions or anything like that - just old good plain drop-by-default firewall.
But then, the article is about consumer tech, and most consumers aren't gonna set up any VLANs, firewalls or complex NAT systems, they don't know anything about those. They got one single flat WiFi network and that's about it. So, I guess, all the technical suggestions here are not really relevant.
Re: One bad apple can spoil your IPv6 privacy (2022)
#43Ipv6 is a lot like a bios update - best avoided unless absolutely necessary. Potential mess with no upsides for end users.
I really wanted to disagree with you but sadly that's how it was treated in secure environments a few years ago: "ipv6.disable=1". Everything that's not in needed would be disabled. Nobody wanted to be the first to "need it" and learn all that stuff, if it works with ipv4, stick with it.
Sure, one can figure out the split DNS, tunneling/no tunneling, DHCPv6, multiple addresses per interface, additional filtering rules, or just you know "ipv6.disable=1" and worry about in a few more years perhaps.
Re: One bad apple can spoil your IPv6 privacy (2022)
#44Earlier quoted context omitted.
> I don't want any random machines behind my router to be able to open ports to the internet at large. The solution to this is a firewall, not NAT. As has always been. NAT is not a security feature and never has been. The fact that it blocks uninitiated inbound connectivity is an implementation detail, not its purpose.
Firewalls don’t fail safe, NAT does. With a disabled/broken/misconfigured firewall, there is a good chance that everything works sans security. With a disabled/broken/misconfigured NAT, you may as well have unplugged the ethernet cable
Or allowed one of the many NAT-busting methods to connect through.
Re: One bad apple can spoil your IPv6 privacy (2022)
#45Earlier quoted context omitted.
> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…
> I don't want any random machines behind my router to be able to open ports to the internet at large. While it's hypothetically possible to have NAT without a firewall, I've never personally touched or seen such a thing. I can confidently state that if you have NAT, you also have a firewall. Use it.
1:1 NAT or floating IPs. I've only ever seen those to simplify server setups where a subset of servers need a public IP
Re: One bad apple can spoil your IPv6 privacy (2022)
#46So uh, this seems to imply that ISP rotating ipv6 prefix is "obvious", but uh. Really? I don't think I've ever seen this implemented willingly (many have dynamic allocation, but it's changing so slowly that it looks more like a bug than a feature). Does some people have other experience? I was wondering what kind of IoT could be widespread enough to pose a significant problem or if it was rather statistical, but they…
My ISP assign changes the IPv4 /32 and IPv6 prefix every PPPoE authentication. This is so annoying and breaks routing every couple days or so that I ended up running NPT (NAT for IPv6) and using a ULA block for my LAN. I've seen reports saying you can request a specific prefix as hints to Prefix Delegation and it keeps it mostly static but it is not guaranteed.
I'm a little confused why you would need NPT to resolve this? Why not just create a separate local prefix for your local networking needs? Unless you mean something else by "breaks routing"?
Re: One bad apple can spoil your IPv6 privacy (2022)
#47Earlier quoted context omitted.
And by that analogy, the previous BIOS version was released in 1981, and modern networking is hamstrung by its design which assumed "4 billion addresses ought to be enough for anybody" and that it needed to be manageable by an 8-bit OS with 64KB of RAM. IPv4 is a brilliant protocol for having been published 43 years ago. There aren't a whole lot of technologies that old still widely used. I mean, I'm glad my NVMe dri…
> And by that analogy, the previous BIOS version was released in 1981, and modern networking is hamstrung by its design which assumed "4 billion addresses ought to be enough for anybody" and that it needed to be manageable by an 8-bit OS with 64KB of RAM. I'm not sure if it makes the analogy better or worse, but this is what happened; BIOS was born in ~1981 (I think), had severe shortcomings that were partially mitig…
Fighting for adoption? The majority of Internet traffic is now IPv6 and we're almost starting to see eyeball networks without any IPv4 at all, so I hope your boss is aware you're blocking potential customers from visiting your website.
Re: One bad apple can spoil your IPv6 privacy (2022)
#48Everytime IPv6 comes up there's back and forth on NAT vs firewall etc etc.
That's easy. IPv6 has more flexibility. You do what you want and leave everyone else to do what they want. Networking stuff will break sure, but hasn't it always...
I haven't gone to IPv6 at home because working with an IPv6 string is so much harder.
I can't always copy'n'paste addresses. I often shout/phone an address to someone else to type in. And talking to 3rd parties (ISP , anyone controlling outside WAN) etc IPv4 is a known quantity.
It's that chicken vs egg problem. I don't want to touch IPv6 at home until other admins have figured out how to make this easy.
Re: One bad apple can spoil your IPv6 privacy (2022)
#49What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)
>Quick solution would be DHCPv6 so they don't have a choice in what address they use.
Android doesn't support DHCPv6.
Re: One bad apple can spoil your IPv6 privacy (2022)
#50What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)
I think the real question is "what the hell IoT is doing on a globally-routable network?" Put it on an isolated VLAN with no Internet connectivity. Or a minimal connectivity only to what's absolutely necessary (e.g. I haven't seen IoT devices that need inbound connections, so drop any inbound packets unless conntrack says otherwise). There there will be probably no need for weird NAT66 contraptions or anything like t…
> Put it on an isolated VLAN with no Internet connectivity.
It's hardly an Internet of Things if your Things aren't connected to the Internet :p