Protect Against WannaCry

[Kerlingen]

If you have a very old ISP contract or are using a mobile modem (SIM card) to access the internet you might be running in an IPv4-only environment behind a NAT. But in pretty much every other situation you have IPv6 without NAT and all your network PCs are accessible directly from the internet.

[TechLord]

Originally Posted by Kerlingen

If you have a very old ISP contract or are using a mobile modem (SIM card) to access the internet you might be running in an IPv4-only environment behind a NAT. But in pretty much every other situation you have IPv6 without NAT and all your network PCs are accessible directly from the internet.

For many of the home users and even office PCs, NAT is switched on by default in the router through which they access the internet, so this should not be a problem.

At least, for many of the routers in the US, I see that the NAT is already enabled...

[Kerlingen]

NAT is no security feature. You can't just turn it on or off as you like, you either require it or can't use it at all depending on your setup.

NAT for IPv6 doesn't exist, so no, not a single IPv6 router in the US (or elsewhere) has NAT enabled (or an option to turn it on).

If you find some NAT settings in your router configuration these are IPv4 settings.

If your ISP supports IPv6, then all your local network computers are accessible directly by IPv6, no matter what settings you choose for IPv4 connections.

[TechLord]

Originally Posted by Kerlingen

NAT is no security feature. You can't just turn it on or off as you like, you either require it or can't use it at all depending on your setup.
...

Its not a security feature I agree, but you can turn it on or off at various levels (the OS level, commercial Cisco Routers level, Hardware Firewall level etc).

I'm sure you know this bro Kerlingen, but for the sake of some of the others who are following this discussion, would like to highlight an important fact :

Many use VPNs etc and stay smug thinking that they are now more or less anonymous on the internet. All the while keeping their IPv6 Address enabled

When my team is called for an investigation to identify some [cyber] miscreant(s) and we find that the perpetrator used a VPN but kept the IPv6 address enabled, my team guys go out for a beer

Because our job is more or less done and we would have uniquely identified the guy (of course assuming that he didn't spoof it).

SO the take-home lesson from this post :
You cannot assume that you are anonymous online if your IPv6 address is kept enabled !

Cheers