3

It's more than usual to find NAT translating IPv4 private addresses (such as 192.168.0.0/16 or 10.0.0.0/8) to non private addresses.

Is it possible that NAT translates even IPv6 link-local addresses (such as FE80::/64) to non local IPv6 addresses instead of allocating a non local IPv6 address directly to the host?

If it's possibile, is it a common approach?

Improve this question

3 Answers 3

Reset to default
3

IPv6 doesn't have NAT. NAT is a hack or kludge in order to forestall the depletion of IPv4 addresses until IPv6 could become ubiquitous. NAT breaks the end-to-end connectivity which is fundamental to the IP design. IPv6 restores the end-to-end connectivity.

Improve this answer
4
  • 2
    Exactly, as we are used to say "NAT is evil".. and it has never been a security feature.
    – JFL
    Commented Feb 25, 2016 at 14:39
  • Ok so isn't it possible that an host gets an IPv6 address belonging to range FE80::/64 but it can reaches the outer network thanks to a NAT?
    – the structure
    Commented Feb 25, 2016 at 14:45
  • I explain: I've always encountered host with IPv6 non local addresses that can reach the outer network and host with IPv6 link-local address only that cannot reach outer network. Now I incurred in a host with IPv6 link-local address only that appears to reach the outer network. This is not possible, as far as i've understood your answer, isn't it?
    – the structure
    Commented Feb 25, 2016 at 14:48
  • Link-local addresses are confined to the LAN. Every IPv6 device has a link-local address in the same network, fe80::/10. There may be something else going on, like a 6to4 tunnel or something like that.
    – Ron Maupin ♦
    Commented Feb 25, 2016 at 14:51
3

Remember, the IPv6 equivalent to RFC1918 IPv4 address is NOT Link Local addresses (FE80::/10).

The closest IPv6 equivalent to what we know as "Private IPv4 addresses" is known as Unique Local Addresses (ULA):

This document defines an IPv6 unicast address format that is globally unique and is intended for local communications, usually inside of a site. These addresses are not expected to be routable on the global Internet.

ULA Address space exists to address 'internal only' resources, that will never need global route-ability, but might need internal route-ability.

For example, many offices have Printers which operate on a network. There is no reason for the Printer to be accessible (or to be accessing) the Internet, as such, Printers are a good candidate for ULA address space. There are always exceptions, of course

Or maybe an office has an internal only ticketing system (or CMS, or RMS, or People Portal, or ...) that should only be accessible from the internal, corporate network. If such a tool has no business being accessed from the public Internet, then these might be a perfect candidate for ULA address space.

That being said, Ron is correct, in IPv6 there is no NAT. It was built so NAT could be omitted entirely. And if you properly implement IPv6, you will not be using NAT.

HOWEVER, if there is going to be something NATed in IPv6 (despite best practices), it would be a ULA address to a Global address. It surely won't be link-local address space.

Link-Local addresses (FE80::/10) exists only for local network communication... aka, you communicating with your neighbor, and potentially your router. It is, by definition, not meant to be used to speak to anything on the other side of a router. As such, intrinsincly, you should never come across or try to NAT a Link-Local address to a Global address.

The IPv4 equivlent to the Link-Local address space is the 169.254.0.0/16 range.

This document describes how a host may automatically configure an interface with an IPv4 address within the 169.254/16 prefix that is valid for communication with other devices connected to the same physical (or logical) link.

Improve this answer
2
  • 1
    Thank you, I cannot upvote your answer due to my low feedback on this site but it was definitely useful to me.
    – the structure
    Commented Feb 26, 2016 at 1:22
  • "The IPv6 equivalent to what we know as 'Private IPv4 addresses' is known as Unique Local Addresses (ULA)" Not at all. As it explains in what your quoted, "This document defines an IPv6 unicast address format that is globally unique..." That is the opposite of IPv4 Private Addressing, which is designed so that it is specifically not globally unique. IPv6 does not have an equivalent of IPv4 Private Addressing. There are problems with IPv4 Private addressing, like merging private networks with duplicate addresses, which IPv6 ULA has eliminated (or hugely reduced chances of happening).
    – Ron Maupin ♦
    Commented Jun 8, 2018 at 2:50
2

Nat started as a kludge to work arround address shortages but over time people started to value other attributes.

  1. A NAT hides your internal network structure from the outside world.
  2. A Nat is less likely to "fail open" than a non-nat firewall (for example on linux if you mistakenly enable IP routing before/without setting up proper policy in IPtables you can easilly end up with what was meant to be a firewall being a wide open router).
  3. A NAT decouples the addresses used on your external connectivity from those used inside your network. This provides a level of ISP independence that is otherwise difficult to acheive.

Many people in the IPv6 community are/were ivory tower types who deseperately wanted to belive that the only reason for using NAT was address conservation and/or to convince people that there were better soloutions to their problems than NAT. They did propose alternative soloutions but many of those soloutions carried high costs of their own (for example for "hiding the network structure" they recommended giving out IP addresses at random across the organisation which would massively bloat internal routing tables).

Not everyone agrees with them though and as IPv6 has become more widespread NAT soloutions have become available.

It is not really possible to do NAT with link local addresses as they are forbidden from passing over routers (and a NAT can be viewed as a special router) but it is possible to do it with "Unique local" addresses since semantically they are equivilent to global addresses. It is also possible to translate from one global address to another which is useful sometimes (for example when switching to a backup ISP).

Improve this answer
5
  • 1
    NAT is a kludge which breaks the IP end-to-end paradigm, and it causes more problems than it has advantages. IPv6 has no NAT, except kludges for the NAT kludge, and those break many things IPv6 depends on. At least IPv4 has a NAT standard, while IPv6 has none.
    – Ron Maupin ♦
    Commented May 4, 2016 at 19:23
  • IPv6 privacy addrs make (1) much less of a concern, and NAT is little help there in general when things like Flash Player and now WebRTC will provide your machine's IP address to a remote server by default regardless. (2) is simply untrue -- without a default DROP/REJECT, a NAT router with IP forwarding enabled will happily pass packets from the public interface to internal addresses. NAT is not a firewall.
    – zrm
    Commented Aug 15, 2019 at 17:04
  • And there are solutions to (3) that work better than NAT. The best is to stop hard-coding addrs at all and use DNS (and distribute DNS with DHCP[v6]). Then if your IPv6 prefix changes you batch update the prefix in your DNS and everything still points where it ought. Larger entities can also register their own ISP-independent address block. Better than using hard-coded non-globally unique addrs and then contending with the ordeal each time your company merges or otherwise has to interoperate with one that happens to be using the same internal address blocks.
    – zrm
    Commented Aug 15, 2019 at 17:05
  • "without a default DROP/REJECT, a NAT router with IP forwarding enabled will happily pass packets from the public interface to internal addresses" as I understand it unless the attacker is on-link with the public side of the NAT box or the network supports source routing (AIUI most networks don't) the attacker won't have any way to get those packets to the nat box in the first place.
    – Peter Green
    Commented Aug 15, 2019 at 17:12
  • That's assuming none of the internal machines have any global addrs on them, which they could have through SLAAC or otherwise. And even if not, the same link for the public side of an edge router is often a public network full of unpatched cable modems and such that could easily be controlled by an attacker.
    – zrm
    Commented Aug 15, 2019 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.