3

I have the standard setup with computers behind a netgear router that has the "auto config" ipv6 option enabled. As I understand it, this means that it assigns local ipv6 addresses on LAN and when ipv6 is available on WAN, it will assign ipv6 addresses to all of the computers on the LAN such that they are all accessible on WAN ("the internet"). The ISP does not currently support ipv6 but will enable it in the future.

Also currently, there are consumer devices that are connected to the network (a printer, a file server, computers with open network shares). This is "fine" because there are ~10 devices connected to the LAN, and they all trust each other (you can access the files on other computers and/or print as long as you are connected to the LAN).

What interests me is that in theory, when the ISP enables ipv6, all of the devices that are connected to the LAN will be accessible on WAN (with the default netgear consumer router settings). Does this mean that anyone connected to the internet can now print and/or access files on computers connected to the LAN? I'm not unfamiliar with networking protocols, so it does seem possible in theory.

If so, this would seem to contradict the "plug and play" model where computers can automatically discover the printers on LAN. And honestly, making the LAN "trustless" is kind of scary.

This question is really about looking at this question within the context of the typical modem + wireless router setup. Everyone has assumed that they are safe because of NAT + ipv4, but I'm not so sure about that assumption anymore.

Note: this is the only "firewall" specified in the manual. It really does seem that consumer routers do not provide a firewall outside of NAT.

enter image description here

  • Sure, if the router doesn't implement a firewall. NAT is a "poor man's firewall", but a device only using NAT can't replace a real firewall if you truly care about security. – Ignacio Vazquez-Abrams Jul 12 '18 at 2:52
  • I don't really think any of the "wifi routers" that you purchase at the typical store or online have the firewall integrated. Am I correct here? – xaav Jul 12 '18 at 2:53
  • I can't find the firewall within the netgear configuration utility, though I'm not sure about other brands. – xaav Jul 12 '18 at 2:54
  • 1
    Also remember that the options may change whether the router is in router, gateway, or bridge mode. – Ignacio Vazquez-Abrams Jul 12 '18 at 2:56
  • 2
    I had the same question, enjoy: serverfault.com/questions/325200/… – leeand00 Jul 12 '18 at 3:44
3

when ipv6 is available on WAN, it will assign ipv6 addresses to all of the computers on the LAN such that they are all accessible on WAN ("the internet").

Globally addressable does not mean globally reachable.

Any router along the path (as well as the host itself) can implement a firewall and block certain packets, e.g. those trying to establish a new inbound connection. This is already done by most ISP-issued routers (NAT won't always protect you from your neighbours, but the firewall does).

This is not new to IPv6 in any way, shape, or form. For example, MIT used to have 18.0.0.0/8 and provided global IPv4 addresses to every single computer. The local ISP provides public addresses to every device on their city-wide Wi-Fi. It used to be the default before the address pools ran out.

It really does seem that consumer routers do not provide a firewall outside of NAT.

No, they usually do. (Sometimes the firewall is always-on and its configuration is hidden, and the only way to add inbound exceptions is by adding a port forwarding rule.) Search for something like "inbound rules".

Well, of course, there are routers which claim to support IPv6 but only have an IPv4 firewall and not IPv6. But I wouldn't expect popular brands (such as Asus or Mikrotik) with the latest firmware to have such issues anymore.

| improve this answer | |
  • Some of the ultra-cheap barely functional garbage routers lack IPv6 firewalls (and possibly other critical functionality). But if you buy a name brand device it's unlikely these days. – Michael Hampton Jul 12 '18 at 17:50
  • 1
    (except for D-Link, which sells name-brand garbage) – user1686 Jul 12 '18 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.