alt Hacker NewsYou were asking about reachable, not routable. Of course, an address behind a firewall might be adressable and theoretically routable, but it certainly isn't reachable.
The default config of a SoHo router has both: (a) NAT44 separating public vs. private IPv4, (b) and also a firewall that blocks any unknown ingress traffic on IPv4 and IPv6.
From a security standpoint, it doesn't matter if the IP get translated inbetween. Only the ingress firewall counts: If the firewall is in-place both IPv4 and IPv6 traffic will be blocked. If you open up the firewall (via hole punching or port forwarding on IPv4, or via IP allows for IPv6), I can send packets to your public IPv4 + port and they will arrive at you private server, or I send them to your servers GUA IPv6 and it arrives. There is no security difference.
Replies
I “inherently” reachable. You can play semantics but the point stands.
> From a security standpoint, it doesn't matter if the IP get translated inbetween. Only the ingress firewall counts
This is complete nonsense. Security is about layers and risk mitigation. You know what is better than firewall rules that can be misconfigured or overridden due to conflict or interface name changes and so on? An IP that can be addressed from global space. Wild!
The fact that the private IPv4 block is not globally reachable counts for something. If I accidentally give you my private IP (192.168.17.102, by the way!) you can't do anything, absent other details, no matter how much misconfiguration occurs. If I give you my IPv6 GUA, there's a lot more variability.