We’re rewarding the question askers & reputations are being recalculated! Read more.
2 added 107 characters in body
source | link

I completely agree with the general concepts in schroeder's answer. However, I would like to answer with respect to IPv6 specifically.

IPv6 address, when delegated by an ISP, are globally routable. This means that any other host on the IPv6 internet can reach any other IPv6 address, unless there is a firewall in the way (many consumer routers will drop or reject by default). This is somewhat analogous to having a public IPv4 address, and could open up your host(s) to being scanned, probed, attacked, and subject to lots of typical unwanted internet noise. That said, the IPv6 address space is incomprehensibly larger than that of IPv4, so it is not likely that your systems will be picked up in random scans. However, it could still be discovered and used, and any service listening on IPv6 could be probed or attacked.

In short, if an attacker knows or discovers your IPv6 address(es) and your machine is running services that listen on IPv6, vulnerabilities or misconfigurations in those services could be exploited in order to compromise your host.

To secure against this threat, you can either disable IPv6 entirely in the kernel, or set up firewall rules. Just like with iptables, use ip6tables for IPv6. Many of your existing rules may transfer over with minimal modification. Of course, if you choose to expose services through your firewall, those services could still be attacked.

I completely agree with the general concepts in schroeder's answer. However, I would like to answer with respect to IPv6 specifically.

IPv6 address, when delegated by an ISP, are globally routable. This means that any other host on the IPv6 internet can reach any other IPv6 address, unless there is a firewall in the way (many consumer routers will drop or reject by default). This is somewhat analogous to having a public IPv4 address, and could open up your host(s) to being scanned, probed, attacked, and subject to lots of typical unwanted internet noise. That said, the IPv6 address space is incomprehensibly larger than that of IPv4, so it is not likely that your systems will be picked up in random scans. However, it could still be discovered and used, and any service listening on IPv6 could be probed or attacked.

In short, if an attacker knows or discovers your IPv6 address(es) and your machine is running services that listen on IPv6, vulnerabilities or misconfigurations in those services could be exploited in order to compromise your host.

To secure against this threat, you can either disable IPv6 entirely in the kernel, or set up firewall rules. Just like with iptables, use ip6tables for IPv6. Many of your existing rules may transfer over with minimal modification.

I completely agree with the general concepts in schroeder's answer. However, I would like to answer with respect to IPv6 specifically.

IPv6 address, when delegated by an ISP, are globally routable. This means that any other host on the IPv6 internet can reach any other IPv6 address, unless there is a firewall in the way (many consumer routers will drop or reject by default). This is somewhat analogous to having a public IPv4 address, and could open up your host(s) to being scanned, probed, attacked, and subject to lots of typical unwanted internet noise. That said, the IPv6 address space is incomprehensibly larger than that of IPv4, so it is not likely that your systems will be picked up in random scans. However, it could still be discovered and used, and any service listening on IPv6 could be probed or attacked.

In short, if an attacker knows or discovers your IPv6 address(es) and your machine is running services that listen on IPv6, vulnerabilities or misconfigurations in those services could be exploited in order to compromise your host.

To secure against this threat, you can either disable IPv6 entirely in the kernel, or set up firewall rules. Just like with iptables, use ip6tables for IPv6. Many of your existing rules may transfer over with minimal modification. Of course, if you choose to expose services through your firewall, those services could still be attacked.

1
source | link

I completely agree with the general concepts in schroeder's answer. However, I would like to answer with respect to IPv6 specifically.

IPv6 address, when delegated by an ISP, are globally routable. This means that any other host on the IPv6 internet can reach any other IPv6 address, unless there is a firewall in the way (many consumer routers will drop or reject by default). This is somewhat analogous to having a public IPv4 address, and could open up your host(s) to being scanned, probed, attacked, and subject to lots of typical unwanted internet noise. That said, the IPv6 address space is incomprehensibly larger than that of IPv4, so it is not likely that your systems will be picked up in random scans. However, it could still be discovered and used, and any service listening on IPv6 could be probed or attacked.

In short, if an attacker knows or discovers your IPv6 address(es) and your machine is running services that listen on IPv6, vulnerabilities or misconfigurations in those services could be exploited in order to compromise your host.

To secure against this threat, you can either disable IPv6 entirely in the kernel, or set up firewall rules. Just like with iptables, use ip6tables for IPv6. Many of your existing rules may transfer over with minimal modification.