9

Home users are generally expected to set the Windows Firewall to the Private profile when they are connected to their home network. The most common setup is being connected to the ISP provided router.

If the ISP provides IPv6 connectivity the connected computer will have a globally routable IPv6 address. This means that all it's ports and applications are directly exposed to the internet. With IPv4 there's usually NAT in between which acts as a firewall.

The security of this depends on what applications are running and what ports are open. In typical configurations there might be a few things accessible. At the very least there will be the Windows file sharing the RPC communication ports. These functionalities have been affected by security issues in the past.

Some routers (including mine) has an "IPv6 firewall" which simply drops all inbound IPv6 traffic. But if I actually want to open at least one inbound port for some application (such as Remote Desktop) then I have no choice but to expose everything to everyone.

Does this not mean that an IPv6-enabled computer must pick the Public profile because anyone (not just trusted devices) can connect?

2
  • 3
    NAT is not a firewall. A firewall is a firewall. Virtually all currently sold home routers which support IPv6 also firewall IPv6. That an address is routable does not mean it is reachable. Of course, many home routers have a completely garbage IPv6 firewall, such as yours. Consider replacing the firmware, if you can. Third party firmware has much better support. Oct 19, 2018 at 15:02
  • Your assertion that "If I...open at least one inbound port...I have no choice but to expose everything to everyone" is incorrect. This lead you to improperly assume the Private profile is useless, when in fact it is not. Nov 15, 2018 at 19:16

1 Answer 1

14

No. Neither the Windows firewall nor a competent router's firewall is "all or nothing".

Home users are generally expected to set the Windows Firewall to the Private profile when they are connected to their home network

The "Private" mode doesn't actually allow all connections from everywhere: most of the default rules are limited to "This subnet" only, which for IPv6 means that even in this mode, only other hosts within the same /64 (e.g. just your home hetwork) will be accepted. Foreign connections remain blocked.

(Note also that the built-in Windows Firewall knows about higher layers than just TCP ports: it can also restrict access to individual RPC services even if they're running on a shared port. This also means that SMB file-sharing access doesn't necessarily automatically grant RPC-over-SMB access.)

There are exceptions to "same subnet" being default (e.g. Remote Desktop is wide open as MS trusts NLA), but those are easy to change via wf.msc.

Which brings to the second reason: even if the profile had bad defaults, just having two customizable profiles is in itself a feature useful by many advanced users (who would still be able to configure at least custom rules for different security levels).

With IPv4 there's usually NAT in between which acts as a firewall.

NAT doesn't act as a firewall; it is used in addition to a firewall. Yes, you could say that it provides an extra layer against distant attackers – due to private LAN addresses being unroutable on the Internet – but that has nothing to do with actual packet filtering that a firewall does.

If you have just NAT but no other form of packet filtering, then your immediate WAN neighbours still have ways of reaching inside your LAN with just an ip route add.

Some routers (including mine) has an "IPv6 firewall" which simply drops all inbound IPv6 traffic. But if I actually want to open at least one inbound port for some application (such as Remote Desktop) then I have no choice but to expose everything to everyone.

That's a significant omission in your router's firmware then. If its firewall supports custom "allow-specific, deny-all" rules for incoming IPv4, there is no reason it cannot support the same for IPv6.

In both IPv4 and IPv6, it is trivial for a router to implement a firewall that passes through inbound connections to a specific host only, and/or to a specific port only. Most home routers don't even implement their own; they ship standard Linux iptables, so they have no excuse.

If you're completely sure your router doesn't offer custom IPv6 rules (they might be named "virtual server" or "port forwarding" despite not involving DNAT), check if there is a firmware update available.

2
  • Thank you for that detailed answer. The default firewall rules often being for local subnet only is a very good point. I verified this on my machine by testing all TCP ports from another local computer and the using an only IPv6 TCP port checker on those findings. All were closed except those that I explicitly opened.
    – boot4life
    Oct 19, 2018 at 14:20
  • 1
    This is a good point about IPv6 firewall allow rules: The configuration option to allow specific IPv6 traffic through is generally not named "port forwarding" because that's not what it is. I've seen several other names used, so it may be hard to find. Knowing the specific router model may help. Oct 19, 2018 at 15:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .