5

In the next months/years my ISP might give me IPv6 for my home connection. But what are the security implications? Will local network servers/embedded devices be accessible from the whole internet?

In IPv4 you were protected by the NAT. Many services and embedded devices like network printers have a local adress but listen to any incoming connection (0.0.0.0 at IPv4). If they should be reachable from the internet, port forwarding or upnp were your options (including some infamous security cameras beeing accessible via upnp without password by default from the internet).

When my ISP switches me to IPv6 are those accessible from the internet/do I need to create firewall rules on my home router (similar to port forwarding)/will there be something like UPnP for programms like bittorrent? Are there other security considerations? Will it end like this https://serverfault.com/questions/766890/network-printer-exploited-read-hacked-to-print-antisemitic-documents-how-to ?

If this is model/ISP specific, feel free to assume a common configuration (preferable in central Europe).

Improve this question
1
  • It's a bit hard to be sure - there isn't really a common configuration, yet, since it still seems to be in the hands of consumer router manufacturers and choices by consumer ISPs, at least in the west. I'm not sure how places like South Korea have adopted it commonly, but it would be interesting to hear from someone from that part of the world.
    – Matthew
    Commented Apr 1, 2016 at 12:52

2 Answers 2

Reset to default
4

With IPv6 you cannot rely on NAT, and thus, yes, you have to configure reasonable packet filtering rules on the router or firewall. For stateful filters this is easy to accomplish: Allow all outgoing traffic and allow all incoming traffic that is related to the outgoing traffic, drop anything else. For stateless filters there's a bit more to do, in particular, you have to bear in mind that IPv6 requires several ICMPv6 packet types for its operation (mostly error messages; for instance, "packet too big" messages since with IPv6 routers don't fragment as they do with IP legacy).

Without NAT you don't need port forwarding, you simply add the according filter rule for incoming traffic.

Improve this answer
1
  • 2
    Is there also a standard like UPnP that allows applications to automatically open/forward/... a port to it in IPv6 when using such a firewall? All information I found was about IP but didn't specify if it is for IPv6 too.
    – H. Idden
    Commented Apr 1, 2016 at 16:11
1

StackExchange doesn't allow me to comment without enough rep, so I'll just post to the answer to H. Idden's comment question on the other answer as a reply, to whomever may find it useful:

My understanding is that the UPnP WANIPv6FirewallControl service is intended for the purposes of allowing firewall control behind IPv6 routers. That said, the standard was written 12 years ago and I can barely find anything about it so I'm extrapolating that it's still barely supported.

UPnP is not a protocol only for port mapping, many more devices use it and expose "services" on it. The WANIPConnection service is commonly used for the well-known IPv4 UPnP port forwarding (and more), WANIPv6FirewallControl is another.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .