5

Will a default-deny rule on incoming connections of an IPv6 firewall negate any advantages that were gained by not having NAT?

In other words, one of the most talked about advantages to IPv6 is that NAT is no longer necessary and endpoint addresses are no longer obfuscated to applications allowing direct connections between endpoints.

I can understand how this could benefit applications that are sensitive to throughput and/or latency such as voice and video communications. However, how would the internal network be protected from unsolicited traffic without breaking such apps.

Would hole punching (http://en.wikipedia.org/wiki/Hole_punching) provide a fix for this?

Improve this question
1
  • 4
    Your access lists should stay the same with or without NAT. Your dynamic port mappings (IGD/UPNP) should stay the same with or without NAT. Your question makes it sound NAT traversal is easier than having a global IP, which it isn't. You will need a hole in the firewall for your application to work either way. – David Houde Apr 20 '15 at 18:49
1

Yes and no.

Yes it is true that "NATs" and "outgoing connections only firewalls" without application level knowlage will both block applications that try to nievely open peer to peer connections between endpoints behind different firewalls.

However.

  1. Often the largest benefit from direct connections comes when the endpoints are on the same site and hence behind the same firewall. With NATs this case often requires a bunch of special casing while with global addressing everywhere it just works.
  2. "hole punching" techniques are simpler if only firewalls are involved because the client does not have to first request it's global address/port from a server on the Internet.
  3. Many firewalls/NATs do go deeper than the transport layer. A firewall only needs to inspect application layer packets to determine whether to allow these "related" connections. A NAT that wants to allow "related" connections must modify the application data which opens up a much bigger can of worms.

So yes there are advantages to end to end addressing even in the presence of firewalls, no the utopia imagined by the IPv6 proponents where any node could talk openly to any other node is not going to happen, there are just too many insecure endpoint systems for it to be reasonable.

Improve this answer
2

In a secure posture your firewall is going to be default deny anyway, whether you use IPv4 or IPv6. Thus inbound traffic will be blocked unless explicitly allowed.

The difference between IPv4/NAT and IPv6 is that, with the former, you would set up DNAT/SNAT rules (port forwards), while in IPv6 you simply create firewall rules to allow the desired traffic to pass.

Improve this answer
3
  • So what about applications that use unpredictable ports? FTP / Skype / P2P ? – Corey Apr 27 '15 at 13:16
  • 1
    Most firewalls these days have stateful functionality. So usually among your first inbound rules would be one to allow established/related traffic. If you then create an outbound connection, the return traffic will match the established (TCP) or related (UDP) states and be allowed. As for outbound rules, many firewalls will allow any outbound traffic. – YLearn♦ Jun 24 '15 at 20:58
  • Right, for "related" traffic the firewall will see, for instance, a SIP INVITE, and know that a call is about to be set up and it should open the corresponding port(s) between the two end hosts. Similarly for FTP PORT and PASV commands, etc. – Michael Hampton Jun 28 '15 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.