Does IPv6 remove the need for a VPN?

Question

I know that a VPN may be used in lots of different ways for lots of different things, so I'm not suggesting that IPv6 removes the need for a VPN completely. I'm interested in one particular use-case:

I have a cellular (GSM) router, and traditionally, a standard SIM from my local network operator will give me a dynamic IPv4 address. In order to be able to reach my router from the internet, today I use a VPN. This does 2 things:

• It gives my router a static IPv4 address. This will not change, if the dynamic IPv4 address assigned by the operator changes, or if I change operators.
• It allows me to traverse the operator's NAT firewall. If my router is acting as a server, I can initiate a connection to it.

I'm still learning about IPv6, but it seems to me that if a network operator supports IPv6 (say Verizon Wireless in the US), then I no longer need a VPN:

• 3GPP cellular operators use SLAAC, and I get a Global Unicast Address. This, by definition, is globally-routable. There is no NAT.
• I know what /64 prefix the operator assigns, and I know what Interface ID will be used (either EUI-64 or RFC 7217), so I have a static IPv6 address.

Is this correct? Or am I missing something?

Of course, I'm aware that a VPN provides extra security, because it adds authentication and encryption. But lets assume for the purposes of this discussion that I will use an IPv6 firewall, or IPsec, or TLS at the application layer, for security.

I know I could continue to use a VPN with IPv6, and this would allow me to use Unique Local IPv6 Addresses just like my old private IPv4 addresses. But why would I need to?

Answer 1

I think your idea that consumer and mobile ISPs will give out static IPv6 is optimistic to say the least. Some may do so but many probably will not.

VPNs provide two main features.

1. They provide protection for the traffic against evesdropping, spoofing, replay attacks and so-on.
2. They decouple your addressing and routing from the operators of your underlying networks.

Feature 2 is useful for many reasons.

• You can work around "outgoing connections only" firewalls/NATs. While Nat is strongly discouraged for v6 "outgoing connections only firewalls are likely to remain common.
• You can keep a consistent IP address on machines even when your provider readdresses their networks.
• You can keep a consistent IP address on machines even when they move location or provider.
• Due to the above two points you can more easily use IP based access control, either within your own networks or for access to third party services.
• If you have high quality links between your campuses around the world and good connections from each campus into the local broadband/mobile providers you can route traffic from your mobile and work at home users down those links rather than down whatever shitty transit their "broadband" provider bought.

Some of these may be less of an issue in a v6 world but I expect that VPNs will still be useful in general and will likely remain a good solution for administering remote devices.

Answer 2

The primary point of IPv6 is that it restores the original idea of every device having a unique IP address, which restores the end-to-end concept of IP. NAT is a kludge to extend the life of IPv4 until IPv6 can become ubiquitous.

The point of a VPN (Virtual Private Network) is to give your traffic privacy while in transit, although it can fix some of the problems inherent with IPv4 NAT, but fixing those problems is not the real purpose of a VPN. You can use a VPN with IPv6 for the real reason of a VPN: privacy.

IPv6 does have, built into it, a way to encrypt traffic on the wire. Unfortunately, it is poorly supported in the way it was intended, although OSPFv3 uses it. The intention was to not need a VPN wrapper around the IPv6 packets, but to move that inside the IPv6 packets. With the current environment of both IPv4 and IPv6, it is much simpler to have one way to encrypt your traffic.

Answer 3

Supposing the IPv6 ISP assigns a "Global Unicast Address. This, by definition, is globally-routable. There is no NAT." ... Even if it gives you a completely static allocation, perhaps based on the IMEI or similar of the calling device, there is no reason to assume it will actually route it under the conditions that suit you.

One of the functions of the VPN is to give you control over your numbering and routing, which can be very useful to give, amongst other things, independence from the ISP. The pre-eminent way to insulate against addressing changes is of course DNS, but VPNs are another which suit some network requirements.

Answer 4

In case of privacy alone, just maybe... but it still has other uses like bypassing geo-restrictions and unblocking websites and all... so i guess a vpn serves a purpose greater than just offering privacy.

Apart from the technical discussion, I think this page pretty much sums up what a vpn can do.

https://www.ivacy.com/what-is-vpn/