9

I know that a VPN may be used in lots of different ways for lots of different things, so I'm not suggesting that IPv6 removes the need for a VPN completely. I'm interested in one particular use-case:

I have a cellular (GSM) router, and traditionally, a standard SIM from my local network operator will give me a dynamic IPv4 address. In order to be able to reach my router from the internet, today I use a VPN. This does 2 things:

  • It gives my router a static IPv4 address. This will not change, if the dynamic IPv4 address assigned by the operator changes, or if I change operators.
  • It allows me to traverse the operator's NAT firewall. If my router is acting as a server, I can initiate a connection to it.

I'm still learning about IPv6, but it seems to me that if a network operator supports IPv6 (say Verizon Wireless in the US), then I no longer need a VPN:

  • 3GPP cellular operators use SLAAC, and I get a Global Unicast Address. This, by definition, is globally-routable. There is no NAT.
  • I know what /64 prefix the operator assigns, and I know what Interface ID will be used (either EUI-64 or RFC 7217), so I have a static IPv6 address.

Is this correct? Or am I missing something?

Of course, I'm aware that a VPN provides extra security, because it adds authentication and encryption. But lets assume for the purposes of this discussion that I will use an IPv6 firewall, or IPsec, or TLS at the application layer, for security.

I know I could continue to use a VPN with IPv6, and this would allow me to use Unique Local IPv6 Addresses just like my old private IPv4 addresses. But why would I need to?

4 Answers 4

4

I think your idea that consumer and mobile ISPs will give out static IPv6 is optimistic to say the least. Some may do so but many probably will not.

VPNs provide two main features.

  1. They provide protection for the traffic against evesdropping, spoofing, replay attacks and so-on.
  2. They decouple your addressing and routing from the operators of your underlying networks.

Feature 2 is useful for many reasons.

  • You can work around "outgoing connections only" firewalls/NATs. While Nat is strongly discouraged for v6 "outgoing connections only firewalls are likely to remain common.
  • You can keep a consistent IP address on machines even when your provider readdresses their networks.
  • You can keep a consistent IP address on machines even when they move location or provider.
  • Due to the above two points you can more easily use IP based access control, either within your own networks or for access to third party services.
  • If you have high quality links between your campuses around the world and good connections from each campus into the local broadband/mobile providers you can route traffic from your mobile and work at home users down those links rather than down whatever shitty transit their "broadband" provider bought.

Some of these may be less of an issue in a v6 world but I expect that VPNs will still be useful in general and will likely remain a good solution for administering remote devices.

6
  • 3
    "your idea that consumer and mobile ISPs will give out static IPv6 is optimistic to say the least". Why? The use of IPv6 Stateless Address Autoconfiguration (SLAAC) is standard in all GSM networks, according to 3GPP TS 29.061.
    – banjaxed
    Feb 6, 2017 at 10:30
  • 2
    Your point about "outgoing connections only firewalls" is interesting. Is there any anecdotal evidence of this on an IPv6 cellular network?
    – banjaxed
    Feb 6, 2017 at 10:39
  • Regarding firewalls. I don't know about cellular networks but I do know that many "home routers" contain such firewalls. Regarding SLACC, SLACC doesn't imply static, SLACC prefixes can be time limited just like DHCP leases can. Feb 6, 2017 at 11:18
  • 1
    Re the "static" IPv6 address question: I think you're right. In my preliminary testing, Verizon Wireless was always giving me a 2600:1008:b045:2275 prefix. I naively thought that this would be static. But it turns out that they have a pool of hundreds of different prefixes: tcpiputils.com/browse/as/22394
    – banjaxed
    Feb 6, 2017 at 12:53
  • 1
    How does that imply that the prefix won't be static? Sep 12, 2017 at 6:53
5

The primary point of IPv6 is that it restores the original idea of every device having a unique IP address, which restores the end-to-end concept of IP. NAT is a kludge to extend the life of IPv4 until IPv6 can become ubiquitous.

The point of a VPN (Virtual Private Network) is to give your traffic privacy while in transit, although it can fix some of the problems inherent with IPv4 NAT, but fixing those problems is not the real purpose of a VPN. You can use a VPN with IPv6 for the real reason of a VPN: privacy.

IPv6 does have, built into it, a way to encrypt traffic on the wire. Unfortunately, it is poorly supported in the way it was intended, although OSPFv3 uses it. The intention was to not need a VPN wrapper around the IPv6 packets, but to move that inside the IPv6 packets. With the current environment of both IPv4 and IPv6, it is much simpler to have one way to encrypt your traffic.

5
  • Thanks Ron. Just to be clear, when you say "IPv6 does have ... a way to encrypt traffic", do you mean IPsec? And when you say "it is much simpler to have one way to encrypt your traffic", do you mean a VPN?
    – banjaxed
    Feb 2, 2017 at 13:08
  • IPv6 was designed with IPsec, which can be implemented using the AH authentication header and the ESP extension header inside the IPv6 packets. IPv4 doesn't have this, so the packets are encapsulated inside other packets (tunnel), and they can be encrypted for a VPN. That can happen that way for IPv6, too.
    – Ron Maupin
    Feb 2, 2017 at 14:50
  • So ... yes and yes?
    – banjaxed
    Feb 6, 2017 at 10:25
  • Just to point out that not all VPNs are designed to be private in the sense of "others can't read", but private in the sense of "under your control". Some VPNs have no encryption, and use VPN just to simplify the networking. Certainly most VPNs use encryption, just remembering that some don't.
    – jonathanjo
    Nov 9, 2017 at 13:28
  • Well, I think that depends on the context. I think you are pointing out what most people consider a tunnel. Most people consider a VPN (where the "P" stands for "Private") as an encrypted tunnel.
    – Ron Maupin
    Nov 9, 2017 at 13:32
1

Supposing the IPv6 ISP assigns a "Global Unicast Address. This, by definition, is globally-routable. There is no NAT." ... Even if it gives you a completely static allocation, perhaps based on the IMEI or similar of the calling device, there is no reason to assume it will actually route it under the conditions that suit you.

One of the functions of the VPN is to give you control over your numbering and routing, which can be very useful to give, amongst other things, independence from the ISP. The pre-eminent way to insulate against addressing changes is of course DNS, but VPNs are another which suit some network requirements.

0

In case of privacy alone, just maybe... but it still has other uses like bypassing geo-restrictions and unblocking websites and all... so i guess a vpn serves a purpose greater than just offering privacy.

Apart from the technical discussion, I think this page pretty much sums up what a vpn can do.

https://www.ivacy.com/what-is-vpn/

3
  • If you think about it, "bypassing geo-restrictions and unblocking websites" is all about privacy. That you can have those is a side-effects of the privacy offered by VPNs.
    – Ron Maupin
    Feb 2, 2017 at 17:35
  • I know what a VPN can do, I use them all the time. As I said, I wanted to limit the discussion to one particular use case: reaching my device when it is on a cellular IPv6 network. Do I need a VPN in that case?
    – banjaxed
    Feb 6, 2017 at 10:40
  • @banjaxed "_ wanted to limit the discussion to one particular use case: reaching my device when it is on a cellular IPv6 network._" That question is actually off-topic here because it involves a network over which you have no direct control, and also the host configuration, both of which are off-topic on Network Engineering.
    – Ron Maupin
    Sep 24, 2017 at 18:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.