Programmer Humor

32453 readers

654 users here now

Post funny things about programming here! (Or just rant about your favourite programming language.)

Rules:

Posts must be relevant to programming, programmers, or computer science.
No NSFW content.
Jokes must be in good taste. No hate speech, bigotry, etc.

founded 5 years ago

MODERATORS

[email protected]

682

Basically the extent of my IPv6 knowledge (lemmy.world)

submitted 4 months ago by [email protected] to c/[email protected]

85 comments fedilink hide all child comments

Template source: https://web.archive.org/web/20210304000634/https://www.government.nl/topics/coronavirus-covid-19/visiting-the-netherlands-from-abroad/checklist

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 9 points 4 months ago* (last edited 4 months ago) (1 children)

There's no reason your clients can't have public, world routeable IPs as well as security.

There are a lot of valid reasons, other than security, for why you wouldn't want that though. You don't necessarily want to allow any client's activity to be traceable on an individual level, nor do you want to allow people to do things like count the number of clients at a particular location. Information like that is just unnecessary to expose, even if hiding it doesn't make anything more secure per se.

[–] [email protected] 12 points 4 months ago

Well good news. Because ipv6 has a thing called privacy extensions which has been switched on by default on every device I've used.

That generates random ipv6 addresses (which are regularly rotated) that are used for outgoing connections. Your router should block incoming connections to those ips but the os will too. The proper permanent ip address isn't used for outgoing connections and the address space allocated to each user makes a brute force scan more prohibitive than scanning the whole Ipv4 Internet.

So I'm going to say that using routable ipv6 addresses with privacy extensions is more secure than a single Ipv4 Nat address with dnat.