All Windows users should immediately update their computers. An exploit rated 9.8/10 (CVE-2024-38063) compromises all devices running Windows with an IPv6 address.

As a tech nerd who self hosts stuff, I'm more like "what is IPV6 and why is it causing me issues, I can't figure this out, I guess I'll disable it, wow my problems are fixed now."

I guess I can see why people don't like it, as it's caused me issues, but just because I don't understand it doesn't mean it's dumb. I'd need to understand how it works before I could say anything about it, positive or negative. I guess all I could say is that it's been way less intuitive to me, I can't memorize the numbers, and the reason it exists makes sense. Beyond that, I unno.

I should probably spend the time to learn about it, but I already have a full time job where I work on computers all day, I'd rather focus on my other hobbies while I'm at home.

It's not terribly difficult to learn when you avoid trying to relate it to IPv4 concepts. Particularly: forget about LAN addresses and NAT, and instead think about a large block of public addresses being subdivided between local devices.

Just sayin'

IPv6 genuinely made some really good decisions in its design, but I do question the default "no NAT, no private network prefixes" mentality since that's not going to work so well for average Janes and Joes

Routers simply need to block incoming unestablished packets (all modern routers allow for this) to replicate NAT security without NAT translation. Then you just punch holes through on IP addresses and ports you want to run services on and be done with it.

Now, some home routers aren't doing this by default, but they absolutely should be. That's just router software designers being bad, not IPv6's fault, and would get ironed out pretty quick if there was mass adoption and IPv4 became the secondary system.

To be clear, this is not a reason not to be adopting IPv6.
No NAT doesn't mean no firewall. It just means that you both don't have to deal with NAT fuckery or the various hacks meant to punch a hole through it.

Behind NAT, hosting multiple instances of some service that uses fixed port numbers requires a load-balancer or proxy that supports virtual hosts. Behind CGNAT, good luck hosting anything.

For "just works" peer to peer services like playing an online co-op game with a friend, users can't be expected to understand what port forwarding is, let alone how it works. So, we have UPnP for that... except, it doesn't work behind double NAT, and it's a gaping security hole because you can expose arbitrary ports of other devices if the router isn't set up to ignore those requests. Or, if that's not enough of a bad idea, we have clever abuse of IP packets to trick two routers into thinking they each initiated an outbound connection with the other.
- can you tell me if any device in an IPv6 LAN can just assign itself more IP v6 adresses and thereby bypass any fw rule?
  
  IPv6 has two main types of non-broadcast addresses to think about: link-local (fe80::) and public.
  
  A device can self-assign a link-local address, but it only provides direct access to other devices connected to the same physical network. This would be used for peer discovery, such as asking every device if they are capable of acting as a router.
  
  Once it finds the router, there are two ways it can get an IP address that can reach the wider internet: SLAAC and DHCPv6. SLAAC involves the device picking its own unique address from the block of addresses the router advertises itself as owning, which is likely what you're concerned about. One option for ensuring a device can't just pick a different address and pretend to be a new device is by giving it a subset of the router's full public address space to work with, so no matter what address it picks, it always picks something within a range exclusively assigned to it.
  
  Edit: I butchered the explanation by tying to simplify it. Rewrote it to try again.
  
  thanks.
  
  In most cases, the router advertises the prefix, and the devices choose their own IPv6. Unless you run DHCPv6 (which really no-one does in reality, I don't even think android will use it if present).
  
  It doesn't allow firewall bypass though, as the other commenter noted.
  
  Unless you run DHCPv6 (which really no-one does in reality)
  
  Question for you since I have very little real world IPv6 experience: generally you can provide a lot of useful network information to clients via DHCP, such as the DNS server, autoconfig info for IP phones, etc. how does a network operator ensure that clients get this information if it's not using DHCPv6?
  
  ok. thank you. stuff like this just made me wonder: https://en.avm.de/service/knowledge-base/dok/FRITZ-Box-7590/573_Configuring-IPv6-in-the-FRITZ-Box/
  
  for linux etc they suggest du enable dhcpv6 and i cant figure out where they adress this in their firewalls. still learning.
  
  Best thing to do to test the firewall is run some kind of server and try to connect to your ipv6 on that port.
  
  Like I've said in other posts, routers really should block incoming connections by default. But it's not always the case that they do.
  
  DHCPv6 is very much in use with large ISPs. SLAAC only lets you get a single /64 (one network) from the ISP, but if you use DHCPv6, which is also provided ISP side, you can often request a /60 to get you 16 networks to use. Also, DHCPv6 doesn't base the IPv6 address off the MAC address like SLAAC does, so it is better for device privacy.
  
  Why Android does not support DHCPv6 is beyond me. It's honestly quite ridiculous as it makes configuring LAN-side DNS and other things a lot easier.
  
  Yeah, I butchered my answer by trying to simplify the process. I rewrote it in a hopefully more accurate but still simple to understand way.
  
  Yep, it's all good. In my opinion, IPv6 routers should just be dropping incoming connections by default. If you want to run services you give your machine a static IPv6 and open ports on that IP/port specifically. It's actually easier than NAT because you don't need to translate ports and each IP can use the same ports (multiple web servers on 80/443).
  
  I do agree that the average joe is going to expect NAT level security by default and that would provide that.
  
  I absolutely agree with you on all points here.
  
  From a security perspective, allowing all incoming connections by default is unnecessarily exposing devices to a hostile environment. The average Joe isn't going to understand the risk unless somebody explained it as "it's like posting your home address on 4chan and hoping nobody manages to pick your front door lock," and they're likely never going to take advantage of the benefits that come from having their device be globally reachable.
  
  Another benefit to not having to deal with NAT is that you can actually host services using the same protocol (e.g. HTTP) on multiple machines without having to resort to alternate port numbers or using a proxy with virtual host support.
  
  How would that bypass the firewall?
  
  Honestly, I think most fear of IPv6 is just borne out of ignorance and assigning their understanding of IPv4 onto IPv6 and making assumptions.
  
  assigning their understanding of IPv4 onto IPv6 and making assumptions.
  
  This is also what makes it more difficult to learn, unfortunately.
  
  That's true. But there are not many differences. It's just, the differences there are, are crucial to understanding it.
Why would you think it wouldn’t work for the average Jane and Joe?
- Honestly the more I think about it the more I realize I'm wrong. I was thinking someone could enable a server on their client device without realizing it but the firewall on the router would still need to be modified in that situation, and anything not requiring firewall modifications would be just as much of a security hole on IPv4
  
  Yeah it’s a common trip up. We’re all so used to the way that things are done in IPv4 that our natural response is to try and apply IPv4 logic to IPv6, but you’re absolutely right.
  
  Many people think NAT is a security feature but but that’s only a coincidence and it doesn’t do anything a firewall doesn’t already do. And if we take it one step further we can actually see that it’s more secure than NAT. The only inherent risk of port warding in NAT is that the IP you’re forwarding to is ultimately arbitrary. Think, have a port open to SMB for a publicly accessible file sharing container, then later ditching it and via DCHP your laptop picks up that old IP and now voila you've technically exposed your laptop. It’s not quite that simple but that’s the essence of it.
  
  But with IPv6, IPs are no longer arbitrary. When you allow access in certain ports to a certain machine and that machine goes away, that rule will always only allow access to nowhere.
- Not the person you were replying too, but I was there when we had modems and raw-dogged the internet.
  
  The average person clicks "Yes" on everything without reading it, has no idea what a firewall is, and they never update anything unless it does it without asking.
  
  Having things accessible from outside your network is great if you're a network nerd and that's what you want, but most people are going to be in a world of unprotected shit. Especially in a world of pointlessly online devices. I don't trust any of those fuckers to have their shit in order.
  
  I would assume/hope the default setting for a consumer router would still be to drop incoming connections. That should suffice for the average person as long as ISPs don't make it easy to disable that without actually understanding what the consequences are.
  
  I would also assume that to be the default, but unfortunately the first Google search for "why doesn't my smart fridge work from my phone when I leave the house" will be a set of instructions for turning that feature off.
  
  NATs and port forwarding is annoying, but it's also very manual, and only lets you fuck up one device at a time.
  
  Then the instructions are bad. They should be how to open the firewall port for that device, which is almost the same as setting a NAT port forward, with the same limitation of only exposing one device.

Ye fuck ipv6 lol. I still have no need to move to it lol.

IP4 is running out, that's the problem. Or better, IP4 is hoarded by companies and they don't give them up. The insane amount of network devices every human being uses on a daily basis doesn't make the situation better. It exploded the last 10 years and only gets worse. The fuckery ISPs are doing to solve it without IP6 is insane, fuck cgnats and co. The whole networking world would be so much better to get it over with and adopt IP6 everywhere and let the hoarders drown in their mountain of IP4.
- Old tale, I know, but just cause v4 is running out on the internet it doesn't stop anyone from using it in their homes. I manage some ASNs on the internet. I have no need yet to worry about implementing v6 on the inside.
  
  The thing is that if IPv6 were actually adopted, it would be straight up better. For everyone. It's easier to use if it's all the networking instead of just a niche case.
  
  Yup, I know. What a pain to migrate it all.
  
  It's really not though. ISPs are a problem, but every hosting provider I've used has offered IPv6. It's really trivial to setup IPv6 name DNS, and host a website on both IPv4 and IPv6. I just do it by default now.
  
  Once it becomes the default to deploy to both, if IPv4 died then the IPv6 side would just keep working.
  
  For DNS, you can make a single glue record contain an IPv4 and IPv6 address.
  DNS just needs A and AAAA records for the Name servers. NS records still point to the hostname as normal.
  
  For Web servers, the web server just needs to bind to the IPv6 address(es). Then in DNS just have an A and AAAA record for each website hostname. The server name directives will cover both.
  
  There really isn't much to it right now. The technology is mature now. It used to be a pain, but now it isn't.
  
  It really is for me when I've got thousands of servers and hundreds of firewall rules, hundreds of subnets and routing to worry about.