Raspberry Pi utility/program to find its external IP address

Try:

wget -qO -

That's a mouthful. And no IPv6.

Those work great, and support IPv4 and IPv6. icanhazip also will speak either http or https.

This also speaks http or https but does not support IPv6.

Elijah

------ not supporting https in this day and age is a disgrace

Thanks, both of you. I did not know of those services.

A much more handy way would be to get the public IP address from your router, using probably snmp.

Or possibly telnet.

depending on the router

https doesn't matter here, I'd say, so it is probably just useless overhead for this purpose. Also it's hard for some devices to implement & maintain. IPv6 is nice but a bit redundant because there's no NAT so the device knows its own global IPv6 address.

I've never understood why IPv6 was implemented without NAT in the router. The thing that were are short of is external (WAN) addresses. So make that WAn address IPv6 with many more possible values. But why did they not design the router to translate that into a IPv4 LAN address in 192.168.m.n exactly the same as if the WAN had been an IPv4 address. Most routers, as supplied, only give 256 possible LAN addresses but I imagine many can be changed to a subnet mask of 255.255.0.0 rather than 255.255.255.0 so as to give 256*256 =

Having no NAT on the router places a hell of a lot of responsibility on the firewall on every single device that is connected to you LAN to implement equivalent of the NAT's "don't respond to unsolicited traffic" (ie unless it's in reply to a request that a LAN device has made).

A firewall should obviously be in the router, not in every device. There, a firewall isn't much different to, or more difficult than a NAT solution. There are *plenty* of IPv6 addresses for every device on earth, no need to pool them with NAT. NAT is evil, and if you don't believe that, just wait until your ISP kindly provides you with double NAT aka carrier grade NAT ;((((

Because in spite of the best efforts of cost-paring telcos the internet is designed to be, and works best as, a peer to peer network.

Or you run your firewall on or immediately behind the router (the "soft, chewy centre" principle).

If you have any IoT devices you'll want to stop them connecting _out_ except as you allow... my ideal IoT model is a USB device connected to an RPi which can handle all the hard security-related stuff like networking.

The normal situation is a firewall on the router.

That?s true even with NAT; an address translator alone does not filter inbound packets. i.e. NAT is not the security measure you think it is.

NAT is not evil. It is something that works pretty well and enforces a de facto firewall policy without one needing to be set up, and that is what noddy home users need. If and when we go IPV6 we will need default firewalls on domestic routers and a load of stuff will not work until everyone has found a way to make it so.

Personally I think IPV6 wont ever quite make it, and that someone will come up with something that coexists with IPV4 better.

Or there will be in effect two separate internets, one on IP V6

I don't think today's backbone routers can handle full IPV6 addressing...

Well it completely nerfs all inbound packets not to a connected socket for sure, so it does filter inbound packets.

Home routers, especially those provided by ISP will be default no-inbound originating IPv6 traffic. The firewall will be set to enable returning traffic back to a locally originated connection. It will likely all look just as it does now. No ISP wants their customers hosting lots of compromised machines. Going to the router and enabling an inbound IPv6 connection, will be analogous to enabling port forwarding in current IPv4 routers, only with more options - like as many web servers on your LAN on port 80 as you want :-)

It really doesn?t! You should do the experiment. I did. Again:

yes BUT your way involves spoofing internal source addresses on an external interface.

In short a compromised ISP

Interesting reading. I've learned something. I thought that the address-translation was the point at which unsolicited incoming packets were blocked, but evidently the block occurs immediately up- or down-stream of it. I admit I was wrong ;-)

I must admit it makes me feel a bit vulnerable (unjustifiably) using the same IP address within the LAN that can be seen externally, even if the firewall will block any unsolicited traffic to that IP from outside the LAN.

As a matter of interest, what had 172.17.207.12 done to you, to deserve the hostname deodand? That means an inanimate object (eg a machine) which was forfeited (eg to the Crown as a proxy for "God") if it was judged to be responsible for the deaths of people. It tended to be used as a lazy solution when the authorities couldn't be bothered to investigate who (person or company) was responsible - eg a shoddy working practices, lack of maintenance, human error. That law was abolished in the mid 1800s.

All my hostnames are from Jack Vance novels, and he re-used[1] the word to mean ?a species of flesh-eating, forest-dwelling monster?.

Network security should be based on the assumption that everything you don't control is potentially hostile.

I now understand why you wear a tinfoil hat.

Paranoia is appropriate when dealing with security.