1

I'm currently starting to read up on IPv6, and as soon as I heared that every device can/will have a public accessible adreess i got a little freaked out.

There are a lot of horror stories about unsecure webcams, "smart" devices with major security vulnarabilities or weak credentials. So far they were somehow protected by the NAT, so noone could reach them if they wouldnt be in the local network (excluding some UPnP trickery or the like).

With IPv6, EVERYTHING is publicly reachable. Since the change to iv6 will be invisible to the average user and they deffinitly wont bother configuring a firewall, would this mean that there will be huge increase in possibly exploitable devices?

Improve this question
2
  • 2
    There are many factors that would increase or decrease the possibility of exploits. Most answers to this question would mostly opinions.
    – Ron Trunk
    Nov 30, 2017 at 1:50
  • Maybe its my fault for not reading the post rules, but I would be ok with opinions as long as they are sufficiently explained.
    – Florian Schöffl
    Nov 30, 2017 at 1:59

1 Answer 1

Reset to default
4

Firewalls are what protect your network, not NAT. The original premise of IP is that every device has a unique address, and the same source and destination addresses are used end-to-end. NAT has nothing to do with security; it is a kludge to extend the life of IPv4 until IPv6 can become ubiquitous, and NAT breaks the IP end-to-end paradigm, causing problems with many protocols. IPv6 restores IP end-to-end connectivity.

Firewalls work the same way in IPv6 that they do with IPv4. Many businesses use public IPv4 addresses on devices, and they are secure because they use firewalls. It is no different with IPv6. Just because a device uses a global address, doesn't mean it is globally reachable. Firewalls default to blocking all outside-sourced traffic, and you configure the firewall to allow in what you want to allow in. For example, you could not get to my IPv6 PC from the public Internet, even though it has a public address, because my firewall would block your attempt.

There is also IPv6 ULA (Unique Local Addressing) for traffic that will never be allowed on the public Internet.

Improve this answer
2
  • Ok, I was under the impression that everything would be reachable by default from the internet, which in hindsight seems obviously wrong since IPv6 doesnt equal removal of the firewall. Dont realy know why I thought this.
    – Florian Schöffl
    Nov 30, 2017 at 2:12
  • 2
    Many people make that mistake. Also, the vulnerable devices, like web cameras, that were taken over and used for attacks were on privately addressed networks using NAT, behind firewalls, in users' homes. That is a completely different problem and discussion.
    – Ron Maupin ♦
    Nov 30, 2017 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.