Will a default-deny rule on incoming connections of an IPv6 firewall negate any advantages that were gained by not having NAT?

Question

Will a default-deny rule on incoming connections of an IPv6 firewall negate any advantages that were gained by not having NAT?

In other words, one of the most talked about advantages to IPv6 is that NAT is no longer necessary and endpoint addresses are no longer obfuscated to applications allowing direct connections between endpoints.

I can understand how this could benefit applications that are sensitive to throughput and/or latency such as voice and video communications. However, how would the internal network be protected from unsolicited traffic without breaking such apps.

Would hole punching (http://en.wikipedia.org/wiki/Hole_punching) provide a fix for this?

Answer 1

Yes and no.

Yes it is true that "NATs" and "outgoing connections only firewalls" without application level knowlage will both block applications that try to nievely open peer to peer connections between endpoints behind different firewalls.

However.

1. Often the largest benefit from direct connections comes when the endpoints are on the same site and hence behind the same firewall. With NATs this case often requires a bunch of special casing while with global addressing everywhere it just works.
2. "hole punching" techniques are simpler if only firewalls are involved because the client does not have to first request it's global address/port from a server on the Internet.
3. Many firewalls/NATs do go deeper than the transport layer. A firewall only needs to inspect application layer packets to determine whether to allow these "related" connections. A NAT that wants to allow "related" connections must modify the application data which opens up a much bigger can of worms.

So yes there are advantages to end to end addressing even in the presence of firewalls, no the utopia imagined by the IPv6 proponents where any node could talk openly to any other node is not going to happen, there are just too many insecure endpoint systems for it to be reasonable.

Answer 2

In a secure posture your firewall is going to be default deny anyway, whether you use IPv4 or IPv6. Thus inbound traffic will be blocked unless explicitly allowed.

The difference between IPv4/NAT and IPv6 is that, with the former, you would set up DNAT/SNAT rules (port forwards), while in IPv6 you simply create firewall rules to allow the desired traffic to pass.