I realize that IPv6 adoption is a long way off but I'm trying to understand the basics in order to stay ahead of the curve, and also just for fun.

Communicating using IPv6 is no problem. It works just fine. But I'm not sure how to secure my internal network.

Consider this screenshot from my router. I checked the "Block incoming IPv6 connections" option (it's unchecked by default):


As expected, the router now blocks all inbound IPv6 connections to my internal hosts. I verified this using a web-based port scanner. What I didn't expect was that peer-to-peer applications which run on an internal host are no longer able to instruct the router to temporarily open ports on-demand via NAT-PMP. Again, I verified this by using a port scanner; No connections were allowed to BitTorrent's port via IPv6 (despite the fact that it's listening on IPv6 as verified via 'lsof') but connections were allowed on the IPv4 address due to successful NAT-PMP mapping.

So the next thing I tried was to uncheck the "Block incoming IPv6 connections" box at the router level, and instead, apply firewall policy at the host level. This worked successfully. BitTorrent was able to receive inbound IPv6 connections. But there's a major security drawback. See the following screenshot of the host's firewall configuration screen:


Here we see that BitTorrent successfully opened its temporary port. We also see that File Sharing and other critical internal services are listening for connections too. And a quick IPv6 port scan revealed that these critical internal services were now fully exposed to the Internet. Obviously, this isn't what I want.

I quickly rechecked the "Block incoming IPv6 connections" box at the firewall level and concluded my experiment. But I'm still at a loss as to how to secure the internal network in an IPv6 world. Are we supposed to lock things down at the router level (but then, how do apps dynamically open ports? Do UPnP and NAT-PMP no longer apply?) or conversely, are we supposed to let the router pass traffic and apply security at the internal host level (but then, how do we protect internal services from the Internet?) ?

  • Your Mac needs a better firewall. – Michael Hampton Jan 28 '15 at 1:57
  • I agree. I was appalled when I saw it was opening ports to the outside world. My preference is to not mess around with host-based firewalls at all and instead, control everything at the network's router/firewall instead. – Festus Martingale Jan 28 '15 at 14:18
  • You still need host-based firewalls, as you can't safely assume that insiders are trustworthy - or that if they are, that they haven't become compromised. – Michael Hampton Jan 28 '15 at 14:32

The same way you protect your IPv4 hosts. Just make sure that any hardware/software fully supports the security features of IPv6 in addition to IPv4.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.