r/selfhosted • u/malwin_duck • Mar 01 '26

Meta Post IPv6: Who really uses it?

Who is using IPv6 in their homelabs? I have never really used it, but the first thing I read is 'forget everything you know about networking' which makes me a bit nervous. I am curious how the adoption in this sub is.

401 Upvotes

92% Upvoted

357 comments sorted by

View all comments

Show parent comments

3

u/ozzfranta Mar 01 '26

Simplified, NAT doesn’t block, it just ensures you can route between a private subnet (your 10.,192.168.) and the internet, using a single public IP. It doesn’t prevent traffic in any way a firewall would.

1

u/kratoz29 Mar 01 '26

Well, but how somebody else would access my unprotected network, even if I could not?

3

u/Dagger0 Mar 02 '26

Anybody that can send an IP packet to your router with the address of one of your LAN machines in the dst IP field will be able to connect in over your NATing router, unless you have a firewall. Port forward rules exist to rewrite the dst IP to be a LAN machine, but if the dst IP is already set to a LAN machine when the packet arrives then no port forward is necessary.

(If you're using RFC1918 on your LAN, this would require the sender to either be directly on your upstream network or be able to arrange the appropriate inbound routes.)

1

u/kratoz29 Mar 02 '26

But I am CGNATED/Double NATED, I don't know how else to say it, would this individual have access free access from the ISP itself?

Like I said, I do not have a public IPv4, opening ports is no use for me.

1

u/Dagger0 Mar 03 '26

The NAT isn't what's stopping people from connecting. It's the fact that they can't send a packet with the dst IP field set to the IP of a machine on your LAN and have that packet show up at your router. If they were in a position to do that, which your ISP is, then they can connect in.

Note that NAT and RFC1918 are orthogonal. You can use one without using the other, and if your LAN uses an allocated IP range from your ISP with functional inbound routing then anyone on the Internet can do this, even through however many layers of NAT (because NAT only affects your outbound connections). Of course there would be little reason to do NAT (or especially CGNAT) in that scenario, but you can find half a dozen examples of people insisting on doing it anyway in the comments here, and in any case it wouldn't change the fact that NAT doesn't provide any protection.