0

This question already has an answer here:

I'm not sure whether this is really the correct place to post this question, because it's not really about a "professional" setting. However, I have the standard setup with computers behind a netgear router that has the "auto config" ipv6 option enabled. As I understand it, this means that it assigns local ipv6 addresses on LAN and when ipv6 is available on WAN, it will assign ipv6 addresses to all of the computers on the LAN such that they are all accessible on WAN ("the internet"). The ISP does not currently support ipv6 but will enable it in the future.

Also currently, there are consumer devices that are connected to the network (a printer, a file server, computers with open network shares). This is "fine" because there are ~10 devices connected to the LAN, and they all trust each other (you can access the files on other computers and/or print as long as you are connected to the LAN).

What interests me is that in theory, when the ISP enables ipv6, all of the devices that are connected to the LAN will be accessible on WAN (with the default netgear consumer router settings). Does this mean that anyone connected to the internet can now print and/or access files on computers connected to the LAN? I'm not unfamiliar with networking protocols, so it does seem possible in theory.

If so, this would seem to contradict the "plug and play" model where computers can automatically discover the printers on LAN. And honestly, making the LAN "trustless" is kind of scary.

marked as duplicate by Ron Maupin Jul 12 '18 at 2:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

0

What interests me is that in theory, when the ISP enables ipv6, all of the devices that are connected to the LAN will be accessible on WAN (with the default netgear consumer router settings).

No more so than with IPv4.

Does this mean that anyone connected to the internet can now print and/or access files on computers connected to the LAN?

Only if you configure your firewall to allow that.


I think you are confusing NAT with security, but NAT really doesn't offer any security. Without a firewall, your router could be compromised, and even with NAT on IPv4, your compromised router would have full access to your network. What protects your LAN is a firewall.

A firewall will allow or deny traffic based on how you have configured it. By default, it will not allow any connections originated from outside. For example, you can configure it to allow someone from outside to access a web server, but that doesn't mean anyone can print on your printer, unless you configure the firewall for that, too.

  • As I understand it, it's not possible to remotely compromise the router unless that option is explicitly enabled (and I've not enabled it). routerlogin.net (the router's configuration) is only accessible from LAN. wrt NAT, yes it's technically not a firewall, but it's not possible to address LAN devices from the WAN using only ipv4. – xaav Jul 12 '18 at 2:35
  • 1
    This really is a practical question I guess of "do netgear routers have a builtin firewall when ipv6 is enabled." Millions of people have these routers in their home. – xaav Jul 12 '18 at 2:37
  • Unfortunately, questions about home networking and consumer-grade devices, such as your Netgear router, are explicitly off-topic here. – Ron Maupin Jul 12 '18 at 2:39
  • @xaav, "As I understand it, it's not possible to remotely compromise the router unless that option is explicitly enabled" That is because the firewall is block such traffic from the WAN, and you have not enabled that traffic. – Ron Maupin Jul 12 '18 at 2:44
  • I don't think that's correct. The netgear routers have a feature called "remote management." If it's disabled, only packets coming inside the LAN will be routed to the configuration utility. It's possible to use a proxy on the LAN to access the configuration utility, but then it's a chicken and egg problem, since you can't exploit the router to access the LAN. The only way I know how to access a LAN device with ipv4 is to set-up port forwarding. – xaav Jul 12 '18 at 2:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.