21

For my home network, my public IP address shows through some websites as an IPv4 and others as an IPv6 address. I have read this thread and understand that it is possible for my ISP to have assigned me one of each type.

  1. What is the purpose of me being assigned one of each type?
  2. Can disabling IPv6 from within Windows on a local host guarantee only my IPv4 address is used from that machine? I ask as I have read about security concerns in relation to certain VPN protocols used in combination with IPv6.
Improve this question
2
  • There is hardware that exists that does not support IPv6. Your ISP is not aware of what hardware you have. They own the addresses so it costs them nothing to assign you both.
    – Ramhound
    Feb 9, 2016 at 0:39
  • 6
    You can expect a less reliable connection if you disable IPv6. A lot of the providers who are enabling IPv6 are doing so because they have run out of IPv4 addresses, and your IPv4 connection might go through a CGN. Besides modern browsers can fail over between IPv4 and IPv6 in less than a second, so having both enabled can provide additional resilience to some network failures.
    – kasperd
    Feb 9, 2016 at 9:18

3 Answers 3

Reset to default
39

Firstly, what is the purpose of me being assigned one of each type?

Ideally, we should be moving towards greater IPv6 rollout, due to IPv4 exhaustion. However, a lot of servers still don't support IPv6 - there are many workarounds, none particularly great, but they generally involve tunneling through an intermediate server that can translate between the two. Your ISP provides you an IPv4 address for compatibility reasons.

What many ISPs now do is implement CGN, where many people share a single 'public' IPv4 address. There are many, many reasons this is a bad thing1, but it is necessary simply because there aren't enough IPv4 addresses to go around. This is why we need IPv6, and probably why your ISP provides it.

Secondly, can disabling IPv6 from within Windows on a local host gaurentee only my IPv4 address is used from that machine.

Yes. However, this is generally not a good idea. Alternatively, you can disable IPv6 at your router, which is a bit better, but again this isn't a great idea. We can't stay with IPv4 forever.

I ask as I have read about security concerns in relation to certain VPN protocols used in combination with IPv6.

That's typically due to broken VPN clients and configurations. It's getting better now, though. If you don't use any VPNs, it won't affect you. If you do use one, you should first research if it supports IPv6 correctly - modern ones should by now. One of the biggest issues was VPN clients ignoring IPv6 entirely, so IPv6 connections bypass the VPN, but hopefully that's gotten better now that there's some more attention there (see also: http://www.techrepublic.com/article/ipv6-security-vulnerability-pokes-holes-in-vpn-providers-claims/).

1 For example, one of the consequences of CGN is home users can no longer reliably host a server. Traditional NAT was bad enough (and again a consequence of IPv4 shortage) but with CGN port-forwarding is no longer possible either. There are techniques around it, such as NAT hole-punching, but they again require external servers and won't always work depending on the service required. Having a unique IPv6 address works around this limitation.

Improve this answer
2
  • Does this mean other people can listen to your traffic if they have the same IPv4 adress ?
    – HopefullyHelpful
    Feb 9, 2016 at 14:28
  • 4
    @HopefullyHelpful Generally no. TCP and UDP both use IP + port pairs to identify a socket, and NAT should only associate a single internal IP + port with any external IP + port at a time. Your traffic won't be visible to other people. However, there are cases where people use IP-based access control, e.g. allowed hosts and bans, and CGN (and NAT in general) weaken such schemes - now banning an IP affects lots of innocent people, and allowing an IP allows more than you might expect.
    – Bob
    Feb 9, 2016 at 15:07
4

IPv6 and IPv4 are different and incompatible systems, you are running a 'dual stack' and your OS will try one then the other - typically 6 and then 4. If a site has a AAAA record, and you have a dual stack setup, you will typically connect to ipv6 first then ipv4.

In theory this also means you can connect to ipv6 only or ipv4 only servers transparently.

And yes, disabling ipv6 for the interface will ensure you don't get an ipv6 address. You can confirm this with ipconfig.Protocols are set per interface, not per machine. However with modern versions of windows, some file sharing related things - like homegroups, may rely on ipv6. Depending on how your VPN is configured, you may need to disable it on each interface that is active, rather than just the VPN

Improve this answer
1
  • 3
    The issues around broken VPN clients/configs cannot be worked around by disabling IPv6 on just the VPN interface. The problem is they didn't route IPv6 through the VPN correctly, so you end up accidentally bypassing the VPN.
    – Bob
    Feb 9, 2016 at 0:44
2

Internet Protocol Version 4 is the 4rth revision of Internet protocol, its generally a 32-bit address consisting of 4 numbers separated by periods for example 12.342.7.89

Internet Protocol Version 6 is the 6th revision and intended to replace IPv4, it is a 128 bit address written in hexadecimal and separated by colons for example 8ffe:1900:4545:7:336:f3ff:fe19:34c

Since there a limited number of potential IPv4 address (around 4 billion) we are rapidly running out of unused Ipv4 addresses to assign to new devices this is called IPv4 exhaustion. However since this is the older and dominant form most computers still have one, your ISP however is anticipating the move into IPv6 and has therefore assigned you an address

IPv6 also provides a number of other benefits included but not limited to

  • No more NAT (Network Address Translation)
  • Auto-configuration
  • No more private address collisions
  • Better multicast routing
  • Simpler header format
  • Simplified, more efficient routing
  • True quality of service (QoS), also called "flow labeling"
  • Built-in authentication and privacy support
  • Flexible options and extensions
  • Easier administration (no more DHCP)

Most modern servers will typically try to connect to your IPv6 address first and then your IPv4, many modern OS's functions may rely entirely on IPv6 therefore it is not recommended for you to disable your IPv6 although this will force your computer to connect through IPv4.

The security vulnerabilities with IPv6 are almost entirely related to VPN's as they sometimes bypass IPv6 entirely, however this is no longer becoming an issue and most new VPN providers are switching to provide IPV6 compatibility.

Improve this answer
2
  • 2
    I thought we had run out, and were now doing silly things like carrier NAT to stretch them even further?
    – user253751
    Feb 9, 2016 at 4:17
  • @user20574 The Asia/Pacific region ran out in 2011. Europe ran out in 2012. South America ran out in 2014. North America ran out in 2015. Africa still have addresses, but at their current growth rate they can run out in 2016.
    – kasperd
    Feb 9, 2016 at 9:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .