<div dir="ltr">You can keep NAT in IPv6 if you really want - just configure your firewall to port external address port pairs to point to link local addresses... (yes, I am insane, what makes you ask?)</div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 5, 2014 at 6:07 PM, Beeson, Ayden <span dir="ltr"><<a href="mailto:ABeeson@csu.edu.au" target="_blank">ABeeson@csu.edu.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I'm on a phone and we have had this talk on the list before, so I'll keep it brief:<br>
<br>
Portability: auto discovery and dhcp already provide this on ipv4 and v6, regardless of NAT. NAT adds nothing and actually makes it worse in some cases as port forwarding etc may be necessary<br>
<br>
Security: those unsecured devices when moved to ipv6 will be behind an IPv6 router which should have an adequate firewall pre configured that provides the same level of protection that NAT "provides" now.<br>
<br>
The onus is on manufacturers to ship devices with the adequate protection, it's not hard to provide a stateful firewall with established traffic allowed back in, most people would be covered then and anything else configured by users that know what they are doing (if even only vaguely)<br>
<br>
Cheers,<br>
Ayden<br>
(This email was sent from a mobile device, please forgive any typos etc)<br>
<br>
<br>
---- Ross Wheeler wrote ----<br>
<br>
<br>
[cid:csu-logo384.bmp]<<a href="http://www.csu.edu.au/" target="_blank">http://www.csu.edu.au/</a>><br>
<br>
| ALBURY-WODONGA | BATHURST | CANBERRA | DUBBO | GOULBURN | MELBOURNE | ONTARIO | ORANGE | PORT MACQUARIE | SYDNEY | WAGGA WAGGA |<br>
<br>
________________________________<br>
LEGAL NOTICE<br>
This email (and any attachment) is confidential and is intended for the use of the addressee(s) only. If you are not the intended recipient of this email, you must not copy, distribute, take any action in reliance on it or disclose it to anyone. Any confidentiality is not waived or lost by reason of mistaken delivery. Email should be checked for viruses and defects before opening. Charles Sturt University (CSU) does not accept liability for viruses or any consequence which arise as a result of this email transmission. Email communications with CSU may be subject to automated email filtering, which could result in the delay or deletion of a legitimate email before it is read at CSU. The views expressed in this email are not necessarily those of CSU.<br>
<br>
Charles Sturt University in Australia<<a href="http://www.csu.edu.au" target="_blank">http://www.csu.edu.au</a>> The Grange Chancellery, Panorama Avenue, Bathurst NSW Australia 2795 (ABN: 83 878 708 551; CRICOS Provider Number: 00005F (National)). TEQSA Provider Number: PV12018<br>
Charles Sturt University in Ontario<<a href="http://www.charlessturt.ca/" target="_blank">http://www.charlessturt.ca/</a>> 860 Harrington Court, Burlington Ontario Canada L7N 3N4 Registration: <a href="http://www.peqab.ca" target="_blank">www.peqab.ca</a><<a href="http://www.peqab.ca" target="_blank">http://www.peqab.ca</a>><br>
<br>
[cid:anniversay7f4f.bmp]<br>
<br>
Consider the environment before printing this email.<br>
<span class=""><br>
<br>
On Wed, 5 Nov 2014, Mike Everest wrote:<br>
<br>
</span>> I may be opening a can of worms here, but for a bit of fun…<br>
<div class="HOEnZb"><div class="h5">> I like NAT. It solves a lot more problems that it causes (for me)<br>
<br>
+1<br>
<br>
I am truly scared of a world with eleventy-billion unpatched, unprotected,<br>
vulnerable/exploitable devices suddenly "directly reachable" by all those<br>
malware-infected, script-kiddies etc.<br>
<br>
Apart from any other conveniences NAT offers (more later), it gives the<br>
majority of the world "a degree" of protection from all these old windows<br>
boxes (particularly, but there are lots of other exploitable devices out<br>
there that haven't (yet) been widely impacted)<br>
<br>
Sure, you can firewall/filter/protect IPv6. But how many of those<br>
eleventy-billion unpatched systems are GOING TO BE PROTECTED?<br>
If they can't "update" their system, don't "GET" the bit about having to<br>
keep AV software up-to-date etc, how the HELL can we expect them to secure<br>
IPv6? (Hint: we can't)<br>
<br>
Portability: being able to just "move" from one provider to another and<br>
not have to reconfigure all your home devices, because they just get NATed<br>
by your router just makes it SO easy for people. I'm PARTICULARLY looking<br>
at the "not-quite-trivial" home/SOHO networks here. A single machine or<br>
two, probably not so much, but there are an increasing number of people<br>
with everything from home automation systems, cameras, PVRs etc that for a<br>
variety of reasons seem to end up with static IPs, NAT makes their life<br>
very easy - in a way that IPv6 probably won't.<br>
<br>
It's all fine and good for those of us in the industry who do this all day<br>
every day, but there are a LOT of people who wil never "get" the IPv6 clue<br>
they need to do this stuff properly, but we're going to be the ones who<br>
have to pick up the pieces afterwards, and clean up the mess.<br>
</div></div><br>_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Dr Paul van den Bergen<br><br></div>
</div>