• 0 Posts
  • 153 Comments
Joined 9 months ago
cake
Cake day: December 22nd, 2023

help-circle










  • that’s literally what a stateful firewall does.

    It only allows corresponding return traffic to outgoing traffic that a device has internally sent outwards.

    if you disabled that, it wouldn’t do that. But even a NAT without a stateful firewall might end up doing this depending on how it’s configured and your open ports due to how the forwarding is handled. This is how we get around NATing for P2P traffic, though the trick is to just send two NATed users to the others ip and port at the same time to establish a connection that can “isAlive” from there. If you had no firewall you would only need to know the IP and port to do this.

    plus not to mention you can run internal firewalls on each device specifically which would do basically the same thing anyway. But then again i don’t use windows so that’s way easier.





  • yeah, under IPv6 based home networking, you just assign a block of addresses to a home, 512 or something, for example, and then you just use a stateful firewall to do the same exact thing that a NAT + a stateful firewall would be doing on a traditional IPv4 network.

    Nothing stops you from using a NAT if you felt like you wanted your networking to be more complicated for no reason. But you probably shouldn’t.

    There are potential benefits for the anonymization of traffic (though this is probably easy enough to defeat by simply sniffing for all traffic across the IP block) a denial of service wouldn’t be super important anymore, as you could just engage in round robin across the other IPs, unless of course you DOS’d every IP all at once, but that would be super fucking obvious and trivial to deal with. Though it might kill an individual computer in the network due to traffic influx.

    You could still engage in DHCP IP handouts, which would actually be beneficial in terms of traffic anonymization in this case. Especially on a high frequency basis. Similar to the effects of NATing on an IPv4 network.

    Plus you could still grab a static IP address per device, and then just pass through firewall rules to allow external connections or whatever you please. No forwarding required.