3

Say I have a server running some version of Linux and I give this server an IPv4 address of 10.1.1.1

Now using my network firewall I NAT this IP to some public IP address and I block all incoming traffic to that IP except ports 80 and 443.

Furthermore I have an iptables firewall on the server which also blocks all incoming connections except ports 80 and 443 and I run a web server on that machine. Additionally I allow connections from the local network to 22 and say 3306 (mysqld).

Now all of this is based on IPv4. However by default when I create a network interface the server will also give it an (to me frankly cryptic) IPv6 address.

My question is does the above now present a security risk? I.e. do I have a giant whole because IPv6 is running, has an address and is not at all filtered?

Since I don't see any reason to actually use IPv6 here my tendency would be to simply disable the protocol (and thus also relieve myself of the burden of having to do something about my ignorance thereof, at least for now...). But is this necessary? Discouraged?

Improve this question
2
  • 1
    What is your network firewall/router passing WRT IPv6? Do they allow or block that traffic?
    – baldPrussian
    Commented Jan 11, 2018 at 12:54
  • The firewall passes IPv6 into the DMZ. I have to verify the router, but for the sake of the question let's assume it too passes the traffic without filtering. Clearly that needs fixing. I'm focusing on the host right now as I'm also concerned about lateral movement on the network should another host get compromised.
    – IamNaN
    Commented Jan 11, 2018 at 14:19

2 Answers 2

Reset to default
1

I completely agree with the general concepts in schroeder's answer. However, I would like to answer with respect to IPv6 specifically.

IPv6 address, when delegated by an ISP, are globally routable. This means that any other host on the IPv6 internet can reach any other IPv6 address, unless there is a firewall in the way (many consumer routers will drop or reject by default). This is somewhat analogous to having a public IPv4 address, and could open up your host(s) to being scanned, probed, attacked, and subject to lots of typical unwanted internet noise. That said, the IPv6 address space is incomprehensibly larger than that of IPv4, so it is not likely that your systems will be picked up in random scans. However, it could still be discovered and used, and any service listening on IPv6 could be probed or attacked.

In short, if an attacker knows or discovers your IPv6 address(es) and your machine is running services that listen on IPv6, vulnerabilities or misconfigurations in those services could be exploited in order to compromise your host.

To secure against this threat, you can either disable IPv6 entirely in the kernel, or set up firewall rules. Just like with iptables, use ip6tables for IPv6. Many of your existing rules may transfer over with minimal modification. Of course, if you choose to expose services through your firewall, those services could still be attacked.

Improve this answer
4

IPv6 aside, you have asked: "I have an unused protocol enabled and active on my system without any technical controls around it. Does the situation pose a security risk?" The answer is very short: yes.

Is it a "giant hole"? No, but a hole. Is it a risk? Maybe. But the fact that you cannot quantify the risk means that you should turn it off until you can.

Will there be potential unexpected usability issues? Maybe. But that's not a security question.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .