This is an interesting take, however from what I seen its other way around. Most security conscious operators would only allow IPv4 instead of IPv6. Your ACL rules and tools are still better at handling/managing IPv4 compared to IPv6
This is an interesting take, however from what I seen its other way around. Most security conscious operators would only allow IPv4 instead of IPv6. Your ACL rules and tools are still better at handling/managing IPv4 compared to IPv6
> Most security conscious operators would only allow IPv4 instead of IPv6.
I strongly disagree. That's obsolete knowledge, thrown around by people who want to be considered security conscious but haven't actually updated their knowledge in many years. A statement with similar implications might be "security conscious operators require their users to rotate their passwords monthly", which is what a lot of people use to think a decade ago, and now what it really communicates is that you're talking to a dinosaur.
But IPv6 is complex and inherently globally accessible. Yes, NAT IS not supposed to be a firewall but it works like one nonetheless in many cases.
IPv6 will never replace IPv4 because it is a different protocol rather than merely a new version. The name is a lie.
> IPv6 is... inherently globally accessible.
No, it's not. If you really want a NAT there is no reason you can't use a NAT with ipv6. In fact, it can work even better because instead of using a random port for the translation, you can use a random ip address for each connection.
A random ip address that is globally reachable?
Why would it be reachable? It might be name-able but that doesn't imply reachable.
You're conflating the two parts of NAT: address translation and inbound filtering. A router can block any inbound traffic coming from WAN, even if the IPv6s on the LAN side are public.
In fact, hole punching for IPv4 shows this distinction. By default inbound traffic is blocked, but as soon as private host has opened up a connection, it is (indirectly) reachable and nameable (via the routers public IP + port).
BTW, static IPv4 NAT with public addresses on both sides exists as well.
Addressable means routable. Otherwise the distinction between a Public and Private address becomes one of firewall rules rather than a meaningful property of the IP Address.
And as you say, hole punching is still “PUBLIC IP” + port. Not an IP and any port you fancy unless the firewall was configured correctly.
Maybe I am wrong, maybe you’re confused, maybe IPv6 is just rubbish. Maybe all 3.
What do you mean globally accessible? All the devices on my network have global IPv6 addresses for the last 5 years - since my ISP enabled IPv6 but none of them are accessible unless I configure it.
Very weird take, and not supported by facts or evidence, but OK.
Do you ever wonder if most people don’t “see the facts” and after almost 3 decades and so much the adoption at 50% might mean to consider if the technology is just rubbish?
Most IPv4 "security" is a side-effect of NAT. NAT was not intended as a security feature, but it does provide a level of security in the common consumer implementation (PAT, single external IP, unroutable internal network.)
Otherwise, what are the practical differences?
There's more that's been written about configuring/protecting IPv4 networks and if you learn about network security from a mentor or from coworkers at a job, rather than reading books/the internet/LLMs, you're more likely to learn about IPv4 security.
But if you've ever had to deal with endpoint security, if you're just doing static rule based blocking/throttling, /32 or /24 blocking is often your best option. Thanks to CGNAT this often means having a pretty large impact since an ISP's residential customer might end up getting randomly assigned a "bad" address and the cooldown for these rules is often months long or more.
In IPv6 land, you can just block a /128 or even a /64 and rarely hit anyone else in the crossfire.
Blocking /128 is unlikely to block anyone for very long around here. Both the major ISPs give out /56 blocks with prefix delegation. In almost 4 years, mine hasn't changed.