Why stop there? Probes traverse the whole TCP/IP stack, best to stop them early at layer 1: https://www.bit.nl/news/115/88/Cut-here-to-activate-firewall...

> The idea of IPv6 is that every few hours or so my iPhone gets a new set of IPv6 addresses (usually 4 at a time I don't exactly know my currently config but they keep changing always). So the obscurity is from the fact that you have ipv6 ips shuffling all the time. Since the /64 address space is so vast for a home network you will ideally not notice someone targeting your IP because it may not be worth the effort for those targeting it.

This is fundamentally not a part of IPv6. It was an extension added later for privacy, but doesn't really accomplish too much in that regard except for the simplest of detection. My home address space is a /48. And when do some really simple subnet math on my IPs, you can easily identify my addresses.

And again, the point is, just because you live out in the country, doesn't mean you shouldn't lock your doors.

Even though right now it's impossible to feasibly to even really scan a /64, that may not be true in a week.

How do defenses against attackers work with rotating IPs etc? Could you still identify and block problematic traffic? Sorry if this is a naive question.

It's more of an accidental side effect than an intentional feature. The actual reason the customer gets 2^64 addresses is to make sure they have enough addresses and don't need NAT. And SLAAC (also an accidental feature) ossified it at 2^64 - a good ossification, for once. And then, if you have so many addresses, may as well rotate through them so it's hard for anyone to observe how many separate devices from your network are accessing their server.

again though, the fallacy that's repeated over and over again with IPv6 is that just because you have a public IP, suddenly everything is exploitable.

If you have an IPv4-only network, you still have firewall and routing. This is what protects your router, allows ports to be forwarded, etc.

Literally nothing changes. You still need routing, just not the NAT/PAT part of it. You still need a firewall.

To be fair, changing the SSH port does MASSIVELY cut down on the amount of log spam from low-effort scans.

Obscurity isn't security, but hiding still makes you harder to find. In other words the lock is just as good or bad as it always was but a lot less people are going to jiggle the handle.

Changing default service ports is a good thing and is one of the reasons everyone should be in favor of software supporting SRV/SVCB records so services can be hosted on arbitrary ports while still being accessible with a plain DNS name everyone's used to using.

That shouldn't be lumped in with pure idiocy like disabling SSID broadcast or believing that IPv6 inherently exposes your network to the world.

Ironically disabling SSID beaconing on wireless APs actually results in clients configured to use those networks broadcasting looking for them wherever they go, for those who want to hide a network it's the literal opposite of their desired result.

> Thank you. The whole read indeed feels like not understanding IPv6.

He's posting his learning and realizations as he goes.

He often has posts of style "I thought X, but then I noticed certain things (in the logs), and after more digging it's actually Y." Or "Last time I checked things were A, but at some point things changed and now they're B, and going into the release notes it appears to be about at about C."

/24 is 256 IPv4 IPs though, while /17 is 32K.