28

Living behind a consumer-grade router for the memorable past, I guess I took the side-effect of NAT for granted, in that I had the burden of forwarding ports when I needed to, instead of have to manage them with a software firewall.

If there's no address translation problem to solve with IPv6, and if it still uses ports, is it now my responsibility to manage this? What's automatically deflecting probing traffic in the IPv6 world?

Do I have to actively try to be defensive in things like blocking RPD or SSH requests, or should I be confident in the updated modern OS saving me from thinking about these things?

If an ISP is delivering IPv6, does it need to be understood by the average netizen before it's enabled?

4
  • 4
    See: serverfault.com/questions/184524/…
    – Zoredache
    Aug 29, 2014 at 0:27
  • @Zoredache Thanks, I'll take a few to consume all of this. Aug 29, 2014 at 0:34
  • Something worth looking up once you've decided on setting up ipv6 is the mechanism your ISP uses - Mine uses ipv6rd on cable and SLAAC on fibre.I'd also note that ipv6 isn't an all or nothing thing - I disable ipv6 on a per system level - If you don't need it, its trivial to turn it off..
    – Journeyman Geek
    Aug 29, 2014 at 2:19
  • @JourneymanGeek Will do. I've already disabled it at the router because I definitely sensed that there was nothing like the usual protection that apparently exists, being offered as the service and the hardware was being marketed to me. I'm not so brave as to disable it in Windows yet though, as the local addresses seem to be preferred by some services and software, and I don't know what it means to rebuild it yet. Aug 29, 2014 at 2:23

5 Answers 5

32

Having used IPv6 for the better part of a decade now, and watching the changes go by, I have a little bit of perspective on this.

The most important point here is this: NAT is not the firewall. These are two completely distinct things. In Linux it happens to be implemented as part of the firewall code, but this is merely an implementation detail, and isn't necessarily the case on other operating systems.

Once you completely understand that the thing in the router protecting your home network is the firewall, and not the NAT, then the rest falls into place.

To answer the rest of your question, let us take a look at a real live IPv6 router firmware, OpenWrt version 14.07 Barrier Breaker. In this router, IPv6 is enabled by default and works out of the box using DHCPv6 with prefix delegation, the most common way that ISPs will assign address space to customers.

OpenWrt's firewall configuration, like any reasonable firewall, blocks all inbound traffic by default. It contains a way to set up port forwarding rules for NATted IPv4 connections, as most every other router has for years. It also has a traffic rules section for allowing specific traffic to be forwarded; this is what you use instead to allow inbound IPv6 traffic.

Most home routers I've seen with IPv6 support also firewall inbound IPv6 traffic by default, though they might not provide an easy way to forward inbound traffic, or it may be confusing. But since I never actually use factory firmware on any home router, (OpenWrt is that much better) it's never affected me.

Indeed, many people are using IPv6 right now and have absolutely no idea that this is the case. When their ISPs enabled it, their home routers picked up the DHCPv6 responses and provisioned the addresses and everything Just Worked. Had I not needed more than a /64, I could have just plugged it in with zero configuration. I had to make one change to get a larger prefix delegation, though this is easy enough.

Finally there's one more thing: If you have a system on the IPv4 Internet today, it gets all sorts of inbound connection attempts on a variety of ports, attempting to exploit known vulnerabilities or brute-force passwords. The IPv4 address range is small enough that it can be scanned in its entirety in less than a day. But on IPv6, in almost a decade I've never seen such a connection attempt on any port. The much larger size of the host-part of the address makes scanning the range virtually impossible. But you need the firewall still; the fact that you can't be found from an IP address scan does not mean you can't be targeted by someone who already knows your address because they got it somewhere else.


In short, generally, no you won't have to be too overly concerned about incoming IPv6 traffic because it will be firewalled by default, and because IPv6 address ranges can't be easily scanned. And for many people IPv6 will come on automatically and they will never notice.

5
  • I would add with either 1st party firmware I used, I had to turn on IPv6 explicitly, and at least one of them didn't have an ipv6 firewall. Least with my ISP and routers, Its unlikely that you'd 'just' pick up ipv6 and start using it.
    – Journeyman Geek
    Aug 29, 2014 at 11:51
  • Hm, I seem to recall something from ASUS (maybe?) had IPv6 off by default and no obvious firewall. Was that it? Aug 29, 2014 at 11:52
  • No firewall. I think you probably remember that from the issues I was having with 802.11g clients.
    – Journeyman Geek
    Aug 29, 2014 at 11:54
  • OpenWRT really is plug-n-play (almost?). Hit the road out the box: i.stack.imgur.com/cZ0hC.png Sep 3, 2014 at 0:43
  • BTW, it's besides the point, but I really like your "finally". I was aware of ZMap and how quickly the IPv4 address space can be scanned with little resources, and I can understand the size of 2^32 and think of things I could use it to describe. But even if the publicly addressable addresses are only a small fraction of the IPv6 space, I can understand that I can't understand the size of 2^128. Sep 5, 2014 at 6:01
13

NAT really did very little for security. To implement NAT you basically have to have a stateful packet filter.

Having a stateful packet filter is still a strong requirement to be secure with IPv6; you simply no longer need the address translation since we have lots of address space.

A stateful packet filter is what permits outgoing traffic without permitting incoming traffic. So on your firewall/router you will set up rules which define what your internal network is and then you might permit your internal network to make outbound connections, but not permit any other networks to connect to your internal hosts, except in reply to your requests. If you are running services internally you might set up rules to permit the traffic for that specific service.

I expect IPv6 consumer routers either already do this, or will start implementing this in the future. If you are using some custom router, you might have to manage this yourself.

3
  • Rad, thanks for the cannocal link, and sharing that. I think I understand. My router does not support IPv6. It does run the Linux kernel however, and my impression from setting it up was that the users getting this working were either experts in many things not well known, or just experimenting half-blindly, like mysyelf. I'll let this hang out for bit. But I will say that whatever little NAT did, I never saw, ever, the endless probes in my logs that I see on my public machines at work. Aug 29, 2014 at 0:45
  • So in summary: Nothing has changed; Consumer IPv6 will have resonably safe settings. People plugging straight into the modems will have the same responsibilities they did with IPv4...? Aug 29, 2014 at 6:29
  • 1
    A firewall does not have to be stateful. Most of the threats people are concerned with when deploying firewalls can be addressed by rejecting incoming SYN packets and allowing everything else. Of course you can do better by using a stateful firewall, but you can also do worse. There has been cases where DoS attacks took down firewalls due to the firewall running out of memory for tracking connections. Usually the firewall doesn't know if the connection still exists on the server it is protecting, so it doesn't know which connections can safely be forgotten, and which must be remembered.
    – kasperd
    Aug 30, 2014 at 16:15
8

NAT isn't really security, except by a certain kind of obscurity.The internet, and most tools are designed to be used from end to end anyway. I would treat any individual system behind a nat the same way I would treat a system on the open internet.

Its worth considering the different mechanisms of getting ipv6 access, from the least native (Teredo), Tunnels (and there's different protocols that work well in different situations), ipv6rd (essentially an ISP run tunnel, that's a good way to get ipv6 quickly on an existing ipv4 network), to native (We use SLAAC and NDP I believe).

If you're on a less than utterly ancient windows box (XP or better - but I don't have anything worse than a SP3 box, and that's under duress), you probably have the option of non native, teredo support. You might already be on ipv6 and not realising it. Teredo kind of sucks and except in a few situations its worth explicitly turning it off.

Tunnels need a client of some sort, and that's even more work than a native install.

Outside of this ts nearly impossible to set up native ipv6 by accident. Even where your modern router supports it, you need to explictly set it up, and there's 3-4 different mechanisms in common use. My ISP uses ipv6rd and SLAAC on different physical connections, and the instructions are in the equivilent of a filing cabinet in a toilet. The alternative is a tunnel, and that's essentially at least an hour of work.

I would treat any system that's open to the IPV6 networks the same as I would any other system that's on the open internet. If it dosen't need ipv6, turn it off. Its trivial, and I've done this with my XP systems. If it does, make sure its secured. There's very little that absolutely relies on ipv6 in the current transition period that cannot fall back to ipv4. One notable exception is homegroups on windows 7 or later

The good news is most modern OSes with ipv6 support have their own firewalls for IPV6, and you shouldn't have too much trouble locking them down.

IPv6 also has an odd advantage. With ipv4, you often had many exploits that randomly scanned you for open ports. IPv4 NAT mitigates that a little by hiding the clients behind a main ip address. IPv6 mitigates that by having a huge address space it is implausible to completely scan.

At the end of the day NAT is not a security tool - its one meant to solve a very specific issue (the difficulty in assigning public IP addresses), that makes it a TINY bit harder to access a network from outside. In an era of router firmware hacks, and massive botnets, I'd suggest treating any system, ipv4 or 6 as if it was on the open, end to end internet. Lock it down, open up what you need, and not worry as much since you have actual security, rather than a cardboard policeman.

2
  • "NAT isn't really security, except by a certain kind of obscurity", how is it obscurity, when talking about typical broadband routers which use NAPT? A reference link about, for example, accessing home NAS (only non-routable IP) from outside without explicit setup? Or, what more is needed except NAPT to protect the home NAS behind typical NAPT router?
    – hyde
    Aug 30, 2014 at 10:37
  • 2
    see security.stackexchange.com/questions/8772/… superuser.com/questions/237790/does-nat-provide-security and ipv6friday.org/blog/2011/12/ipv6-nat. Its precisely cause nat is not security, that its always paired up with a firewall, which sadly dosen't get enough respect. Port forwarding? Its a firewall. Dropping packets? Firewall. Nat is basically a postman who will happily deliver a mailbomb. The firewall is the guy who hears it ticking, and calls the bomb squad.
    – Journeyman Geek
    Aug 30, 2014 at 10:51
2

If there's no address translation problem to solve with IPv6, and if it still uses ports, is it now my responsibility to manage this?

Without NAT, everything behind your router has a unique public IP address.

Typical consumer routers perform many functions other than routing:

  • firewall/packet filtering/"Stateful Packet Inspection"
  • NAT
  • DHCP
  • etc.

If NAT is not needed, it doesn't have to be used, though the firewall can still be there and be used. If the device doing the routing doesn't do firewalling (likely not the case unless it's an enterprise router), you'd have to add a separate device to do that.

So if you want to "open ports" on an IPv6 router, and if that router behaves like most common consumer routers, you tell the firewall part of your router to allow incoming traffic on the port/protocol you want. The main visible difference to you would be that you no longer have to specify which private IP on your network it's supposed to go to.

What's automatically deflecting probing traffic in the IPv6 world?

Nothing, unless the device has a firewall function and it's set to a sensible default, which is probably the case on any consumer IPv6 router.

To summarize, you need something acting as a firewall to filter traffic you don't want to move past your router with IPv6.

3
  • Thanks, I think my confusion was that my router does not actually support it, or the company doesn't. So I could only get an IPv^ address by bypassing it, or delving into the *nix world with WW-DRT (which also does not support it, but look what it's running on). So it seemed like getting it working was something risky...you see? Really didn't know consumer-grade routers had it in mind. Aug 29, 2014 at 0:57
  • Newer consumer grade routers support it - I've been on ipv6 for ages with first an asus, then a dlink router, both with stock firmware. Amusingly, the asus definately dosen't have an ipv6 firewall, and I haven't checked it on the dlink yet. Wouldn't hurt to have per system firewalls though
    – Journeyman Geek
    Aug 29, 2014 at 2:15
  • I like these answers--I know what I want in my next one--but what @JourneymanGeek found amusing makes me wonder if my last question was answered. Aug 29, 2014 at 6:34
0

Same as with ipv4. Don't let your computer get infected by malware and become part of a botnet used to send spam, perform ddos attacks and anything else that is bad for the internet. Don't run any insecure services exposed to the internet. And so on.

You can block ssh but if you just block root login and only allow keys for login it'll make it basically impossible for anyone to hack in (assuming you have all the latest versions or old ones with backported bug fixes). You can also use like something like fail2ban which doesn't block it completely but only after a certain number failed login attempts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .