Is IPv6 with NAT less secure than IPv4?

Question

This is a follow up to a snippet from another answer.

There, user Ninefingers writes:

(...) only allow outbound connections, ever. Do this in spite of NAT as IPv6 will make those NAT defences disappear.

Can someone please explain what this means? Or, rather, how this affects the average user that has his Windows 7 PC(s) running behind his local router that's doing NAT and connecting to the DSL modem.

Answer 1

Yes I can.

IPv4, due to the size of the address pool, has long had a technique called Network Address Translation. In a simplistic view, let's assume you are allocated the (invalid) IP address for your router 256.10.20.30 (I use invalid addresses so people don't go around pinging them etc). Locally, your router is 192.168.0.1 and your host is 192.168.0.2 like this:

/----------\       /-------------------------------\       /----------------\
| Internet |-------| Your router                   |-------| A computer     |
\----------/       | Internet sees as 256.10.20.30 |       | has only:      |
                   | You see as 192.168.0.1        |       | 192.168.0.2    |
                   \-------------------------------/       \----------------/

As such, your router appears to the internet as a public facing IP-address; however, unless you deliberately route connections on ports from the router to a computer on the private IP address range, the computers on the private LAN side are not directly addressable from the internet. The route is performing two functions - both NAT and routing.

In IPv6 there are a lot of addresses. The idea fundamentally is that there are no private IP address ranges (which isn't exactly true; an RFC for that does exist) and as such the IPv6 situation looks like this:

/----------\       /-------------------------------\       /----------------\
| Internet |-------| Your router                   |-------| A computer     |
\----------/       | Internet sees as 2000::...    |       | has:           |
                   | You see as 2000::...          |       | 2001::...      |
                   \-------------------------------/       \----------------/

There isn't really enough space in these boxes to write out the full addresses, but in the IPv6 model, the router performs its routing function (it gets packets to the computers on the LAN) but crucially here it routes both from and to the internet, rather than routing / NATing outwards.

The effect of this is that the default case for IPv4, namely that home computers aren't directly accessible by nature of the fact they have no IP address unless the router knows about the connection goes away. The computer becomes addressable from the internet, much like a server.

Clearly, such connections can still be firewalled, with firewalls denying all incoming (non-client-initiated) connections, however, you've lost needing to explicitly configure your router to route internet packets to you. If the firewall doesn't filter the incoming packet, the client better be able to cope with it. There is, therefore, a slightly increased security risk to home users using IPv6.

I expect (hope?) most home routers will come configured with this firewall setting. As such, while the risk is slightly increased, it is still probably dwarfed by the threat from browser-based exploits (the "outbound stuff").

Answer 2

NAT is a solution to the IPv4 address-shortage problem: you hide many systems behind one IP address. With IPv6, an end-user will have many addresses, so the need for NAT disappears. This is great from a networking standpoint, since NAT is an ugly hack (from the network perspective) that makes many applications harder.

From a security standpoint however, NAT provides some security by hiding your systems behind a firewall (that NAT router). This NAT router must be configured explicitly to forward incoming connections to internal hosts (not considering UPnP). When NAT disappears and all your systems have a unique, globally reachable IPv6 address, malware can open up a listening socket for connectback.

Answer 3

The first problem, that comes to my mind, is that you may have an IPv6 connection that you are not even aware of.

Microsoft Windows has build in support for Teredo. Teredo tunnels IPv6 through IPv4 UDP packets. This provides full duplex IPv6 connectivity.

Furthermore Teredo is designed to work through IPv4 NAT: The client regularly sends queries to the nearest Teredo relay. If this relay has packets for the client, it will answer and the NAT will let the answer through. These packets may contain a connection attempt from the outside.

Some software may activate Teredo support, uTorrent (see Release Announcement 1.8 Build 7237) even did it automatically by default.