IPv6 Address Planing: How to Survive without NAT

One of the "killer" features in IPv6 is the ability to provide each and every device in your network with a globally routeable IP address. However, this feature is also scary to network administrators who have been using NAT as a security feature.
This brief presentation outlines some ideas to use IPv6's unique local addresses to achieve real isolation of internal networks compared to the "fake isolation" provided by NAT.

Category:

Science & Technology

Tags:

• ipv6
• ipv4
• networking
• network security
• internet storm center
• SANS institute
• NAT

[tedpidau]

@fracutube Home routers just need to provide a default-deny firewall for incoming connections, the same way they do now with IPv4. The difference being that if you *want* to allow selected incoming access, you can do it without address translation, and you are no longer limited to a single device being publicly accessible on port 80 (if you want).

[SoftwareExplorer]

@fracutube Most likely, IPv6 routers will come with a stateful firewall preconfigured (which would be effectively as secure as NAT). So "grandma" won't even know the difference.

IPv6 has so many addresses that it is infeasible to try random addresses in hopes of finding a vulnerable computer behind it. Most homes would get the current number of IPv4 internet addresses SQUARED. So in some ways IPv6 can be more secure.

[caseynt]

Thanks.. very informative. A quick suggestion though, you might like to put the RFC and sixxs.net links in the video description so you can just click them.

[c1sc0m]

@jullrich Super excellent explanation!!!  Loved it. Many thanks for this presentation.

[blivklogere]

The LAN is dead, and so are the idears in this video... Servers should have a global IPv4 and IPv6 address, and clients sould have a NATTED IPv4 and a global IPv6 address... Firewalling sould not be based on source addresses. All services must be accessible from everywhere... Use authentication for security, not source address.

[SoftwareExplorer]

@gn02020202 Well, there's plenty of room to have static addresses. Also, autoconf picks the same address every time (generated from network card's MAC address), so it's usually as good as a static address. Also, you can use a DHCPv6 server in stateless mode along with autoconf to support things like giving out a DNS server. (I don't know about DNS updates, but you really don't need them with autoconf. The addresses are always the same for the same network card.)

[gn02020202]

@alp627 The windows default firewall will start blocking packets about 30 seconds after they come in. This means that some hacker has already gotten into your system before the firewall detects it. This is when you say, "Oops. Oh well. I guess I wanted to let him in by me running windows and not using a hardware firewall."

[gn02020202]

NATv6 is not gone, but is a common application. The main folks in charge of telling you about IPv6 do not want you to know about NAT and IPv6. I have been using NATv6 since Jan 1st successfully. And the NAT devices that the stores sell contain firewalls, but they do not list them on the package. Most people assume that it is just NAT and forget about the firewall.

[gn02020202]

@SoftwareExplorer There is something odd about DHCPv6. It supports DNS updates, where autoconf does not. IMHO, autoconf's intent is to make everyone memorize IPv6 addrs, while DHCPv6 makes us memorize dns names.

[gn02020202]

NATv6 is not gone, but a widely used application. I have been using it to change my FC00::/7 to a real IPv6 since January. Something to note, when people talk about NAT on V4, they usually mean a firewall with it, but the stores call it a "NAT" device, not a "NAT+Firewall" device. Most people use the default stock setup on the firewall and only change the NAT side. These firewalls usually block on incoming from the external.

[gn02020202]

@alp627 The windows firewall provides blocking about 30 seconds after the connection has started. That is long enough for someone to hack in and already own your box. A hardware firewall is much better.

[SoftwareExplorer]

Saying that a /64 is the smallest subnet you can have is false. If you use DHCPv6 instead of Autoconf (which requires /64 subnet), you can use any subnet size you want.