NAT Is Not Security

At best, Network Address Translation is security by obscurity. In other words, NAT is not security. Where did this idea come from? Even worse, it comes up regularly when discussing IPv6, which does not have NAT, a condition that that is seen as a huge negative of IPv6.

Of course, a properly configured stateful firewall will have exactly the same effect as NAT. I suppose the problem is the "properly configured" part. People expect things to just work without requiring any knowledge or skills.

IPv6 Setup Delayed

Yesterday was wonderfully productive. Today was the exact opposite. I felt tired all day and only picked half-heartedly at setting up IPv6 routing on the firewall. I did learn about radvd but couldn't motivated myself to actually install and configure it.

I'm totally in awe at how many IPv6 addresses my free tunnelbroker.net account gives me. 2⁶⁴ addresses is just ridiculous! And they are giving it away too. I mean, I know the number of available IPv6 addresses is huge (an understatement, if ever there was one) but it seems like giving /64 prefixes to hobbyists and experimenters like me is just overkill.

I wonder how much a permanent IPv6 /64 assignment costs and where can I get it?

New Firewall Running

I was up early this morning to finish my long outstanding project to setup a new firewall server. The server has been (mostly) ready for a while now but I've been putting off finishing the job, because I knew the final setup would require a lot messy configuration changes on all the computers on my network.

As I expected it took a few hours to get back to normal Internet access after all the minor details were cleared away. But it all works now and I'm happy with the results. I'm sure it is my imagination but web pages seem to be loading a little faster with the new firewall. The new server is slightly faster but I doubt that it would make a noticeable difference.

There is one remaining issue: IPv6. The first problem was the version of Shorewall in Debian Lenny/stable does not support IPv6, but I found a back port of the newer Shorewall on the package maintainers web site, so that obstacle has been cleared. I've never set up an IPv6 network before, so I'm sure there will be other head scratching moments.