1

A router doesn't support ipv6. There is a machine connected to the router, that is assigned an ipv4 address by the router. The machine uses firewall software.

Setting up the machine's firewall, all incoming traffic to the machine needs to be blocked except for one service. Is it enough for the machine's firewall to accept / reject ipv4 packets only, or should it also be set up to accept/reject ipv6 packets?

2

The other answers are misleading, so here is my take:

Yes, you should block IPv6 on the machines firewall or disable IPv6 on the machine altogether.

Here is why:

While the router may not support IPv6 (at this moment) and thus no IPv6 traffic is routed from external devices, the router does act as a Level 2 switch as well, so internally - because IPv6 works fine without a DHCP server - IPv6 traffic might work fine.

Now, since IPv6 is the only way to access some services today, one of your users might establish a IPv6 tunnel through IPv4 (which is possible and not very hard to do) to use this services.

If now the tunnel and/or the machine is badly configured, if may act as an IPv6 router through the IPv4 connection, turning the tides on the whole „IPv6 packets cannot reach that machine“.

It is also worth noting that even leaving the ports open to internal users might pose a security risk. This usually applies to people now knowing about IPv6 being enabled and defining firewall rules for IPv4 and think they are done, until whatever malware (android? Those are basically unpatched carriers of malware to begin with) gains access to your network.

  • "block IPv6 on the machines firewall" how? – curiousguy Nov 25 '17 at 22:41
  • That depends on your operating system and firewall product. For Linux and iptables that would be ip6tables -P INPUT DROP. – Tobi Nary Nov 25 '17 at 22:45
1

If the router doesn't support IPv6, it won't route IPv6 packets, so you don't have to worry about IPv6 attacks from the internet (as others have said).

It's probably still worthwhile setting up firewall rules for IPv6, though, to protect against malicious traffic originating from your local network (smart TV, your friend's infected laptop, etc.).

If you don't actually use IPv6, you really just need 1 rule.

-1

If the router doesn't support IPv6, you don't need to do anything since it cannot route those packets at all.

You can easily check. If your router supports IPv6 at all, it will have a number of settings that relate to it. Typically there will also be a flag that turns it off completely.

You can also check on a PC by connecting to the router and rebooting. If your network connection has an IPv6 address starting FE00 (link local) or FC00 or FDnn (Unique Local Addresses - ULA) then you have a non-routable address that cannot be routed over the Internet.

  • This is true as long as attacks are only expected from the internet and not from IPv6 enabled systems inside the local network. It is not clear for me from the question what the exact expectation is here. – Steffen Ullrich Nov 24 '17 at 22:24
  • That is certainly a reasonable point. Perhaps the question will be clarified. – Julian Knight Nov 24 '17 at 23:30
  • @SteffenUllrich sorry for my ignorance, but are you saying that one ipv6-enabled system could interact with another ipv6-enabled system, even if attached through a non-ipv6 router? i'm afraid this is a difficult concept for me to grasp, probably because i'm more used to ipv4. maybe another answer detailing your thoughts would be good. – Aaron Thomas Nov 25 '17 at 1:35
  • @AaronThomas: the task of a router is to route packets to some external network (i.e internet)based on some routing information (like a single default gateway in the simplest case). For traffic inside the local network no routing is done. In this case you either have a separate switch or the router works as a switch too (common with SoHo devices). And a dumb switch (i.e. most cheap ones) works only at layer 2 (i.e. MAC addresses) and does not care about layer 3 (IP address, i.e. IPv4 or IPv6) and thus works with IPv6 even if the router itself does not support IPv6 for routing. – Steffen Ullrich Nov 25 '17 at 5:16
  • Oh, before reading your comments, @SteffenUllrich I kind of answered in that direction. Julian: that would imply that I am fine with private IPv4 addresses as well? A router might designate local addresses but still route traffic - ever heard of NAT? – Tobi Nary Nov 25 '17 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.