I realize that IPv6 adoption is a long way off but I'm trying to understand the basics in order to stay ahead of the curve, and also just for fun.
Communicating using IPv6 is no problem. It works just fine. But I'm not sure how to secure my internal network.
Consider this screenshot from my router. I checked the "Block incoming IPv6 connections" option (it's unchecked by default):
As expected, the router now blocks all inbound IPv6 connections to my internal hosts. I verified this using a web-based port scanner. What I didn't expect was that peer-to-peer applications which run on an internal host are no longer able to instruct the router to temporarily open ports on-demand via NAT-PMP. Again, I verified this by using a port scanner; No connections were allowed to BitTorrent's port via IPv6 (despite the fact that it's listening on IPv6 as verified via 'lsof') but connections were allowed on the IPv4 address due to successful NAT-PMP mapping.
So the next thing I tried was to uncheck the "Block incoming IPv6 connections" box at the router level, and instead, apply firewall policy at the host level. This worked successfully. BitTorrent was able to receive inbound IPv6 connections. But there's a major security drawback. See the following screenshot of the host's firewall configuration screen:
Here we see that BitTorrent successfully opened its temporary port. We also see that File Sharing and other critical internal services are listening for connections too. And a quick IPv6 port scan revealed that these critical internal services were now fully exposed to the Internet. Obviously, this isn't what I want.
I quickly rechecked the "Block incoming IPv6 connections" box at the firewall level and concluded my experiment. But I'm still at a loss as to how to secure the internal network in an IPv6 world. Are we supposed to lock things down at the router level (but then, how do apps dynamically open ports? Do UPnP and NAT-PMP no longer apply?) or conversely, are we supposed to let the router pass traffic and apply security at the internal host level (but then, how do we protect internal services from the Internet?) ?