[HN Gopher] IPv6 is not insecure because it lacks a NAT
       ___________________________________________________________________
        
       IPv6 is not insecure because it lacks a NAT
        
       Author : johnmaguire
       Score  : 7 points
       Date   : 2026-01-20 19:03 UTC (3 hours ago)
        
 (HTM) web link (www.johnmaguire.me)
 (TXT) w3m dump (www.johnmaguire.me)
        
       | ggm wrote:
       | Not wishing to undermine the central point, NAT for v6 is a
       | thing. The point of the article is that it's not "NAT by default"
       | the way home IPv4 is because so few places worldwide get more
       | than a single IP per customer: The NAT is not there in v4 for
       | security, it's to provide for multiple devices inside the home.
       | Or, in the case of Carrier-Grade NAT, to manage multiple
       | customers, behind a small pool of v4.
       | 
       | NAT doesn't exist to be secure. If it is, (and that is debatable
       | because NAT busting is a thing) then, it's a side-effect.
       | 
       | NAT for v6 is not common. If you use ULA, you'd possibly use NAT
       | for v6 in some circumstances.
       | 
       | https://datatracker.ietf.org/doc/html/rfc6296
        
       | Dagger2 wrote:
       | > The consequence of this is that when receiving inbound traffic,
       | the router needs needs to be configured with where to send the
       | traffic on the local network. As a result, it will drop any
       | traffic that doesn't appear in the "port forwarding" table for
       | the NAT.
       | 
       | As I keep trying to explain each time this comes up: no, it
       | doesn't and it won't.
       | 
       | When your router receives incoming traffic that isn't matched by
       | a NAT state table entry or static port forward, it doesn't drop
       | it. Instead, it processes that traffic in _exactly_ the same way
       | it would have done if there was no NAT going on: it reads the dst
       | IP header and (in the absence of a firewall) routes the packet to
       | whatever IP is written there. Routers don't drop packets by
       | default, so neither will routers that also do NAT.
       | 
       | Of course, this just strengthens your point that NAT isn't
       | security.
        
         | johnmaguire wrote:
         | That's a great point - the packet is not dropped by the
         | firewall as a result of NAT - but it still won't route anywhere
         | because the IP in the packet is that of the router itself. I've
         | updated the article as a result of your comment, thanks.
        
       ___________________________________________________________________
       (page generated 2026-01-20 23:01 UTC)