4

From what I understand about IPv6 networks, since NAT was a hack to deal with a lack of IP addresses in IPv4, NAT is a possibility, but not a requirement in an IPv6 LAN.

So taking this into account, how does the physical / logical diagram of a basic LAN change when using IPv6 without NAT?

Is there still a gateway router / firewall? Does every machine on my network require a public IP address? Can I still use a single firewall to protect all the machines behind it? What do the physical / logical diagrams look like?

Improve this question
0

1 Answer 1

Reset to default
4

There is no real difference in IPv4 or IPv6 network diagrams. The network devices are the same things (routers, switches, firewalls, etc.), and the diagrams look the same, other than the addressing.

Routers route between networks, and IPv6 still uses networks. Firewalls are still used to protect networks. Switches are still used to connect hosts.

Since IPv6 has plenty of address space, there is no need to NAT. NAT breaks the original IP premise of end-to-end connectivity, where every device has a unique IP address. IPv6 doesn't have a NAT standard, and NAT breaks things in IPv6. NAT was developed as a short-term solution to the IPv4 address shortage, and it is expected to go away once IPv6 is ubiquitous.

Improve this answer
6
  • I'm confused though; if the hosts are all connected through the router / gateway and somebody outside wants to connect to one of the hosts; in NAT the single external IP of the router / gateway is contacted and a firewall rule that does port forwarding allows the host inside the gateway to be connected to with it's LAN IP; and translates it to the internal host and then when it replies the gateway translates the IP back to it's own external IP again. So if all the hosts in the lan have a public IPv6 IP; I don't understand how this is any longer relevant;
    – leeand00
    Commented May 9, 2016 at 14:32
  • But I also don't understand how the firewall rule can still protect the lan hosts if they all have a public IPv6 ip.
    – leeand00
    Commented May 9, 2016 at 14:33
  • 3
    @leeand00, NAT and firewalls are two separate things. Often, it is convenient to NAT on the firewall, but you can NAT other places, and not all firewalls are doing NAT. You can have a firewall which protects your network from the public Internet, and never do NAT on the firewall. Many companies own blocks of IPv4 addresses, and they don't NAT on the IPv4 firewall. NAT has nothing to do with protection, it is merely a way to extend IP addresses.
    – Ron Maupin ♦
    Commented May 9, 2016 at 14:36
  • 2
    @leeand00 A Firewall can filter any traffic coming through it, not just traffic destined to one of its NAT IP addresses. Same in IPv6, any IPv6 traffic passing through a firewall can be filtered by said firewall -- regardless of whether the IP/IPv6 address is public or private.
    – Eddie
    Commented May 9, 2016 at 15:54
  • 1
    Put another way, the protection that NAT provides against unwanted incoming traffic is not a design goal, but only a consequence of the restrictions that NAT imposes on incoming traffic. With NAT, you have to specify where to send a new incoming connections, and therefore you have to list them, and those you do not list are denied, and you can have only (say) one webserver per public IP. With a firewall, you usually want to specify all incoming traffic, but you don't have to.
    – Law29
    Commented May 9, 2016 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.