I've read that IPv6 over IPv4 tunnels are a security risk because IPv6 traffic cannot be intercepted by Intrusion Detection Systems and Firewalls. This apparently deterred some networks to deploy IPv6. However, if a network has native IPv6 support it shouldn't be subject to this security risk because the traffic over this network won't be tunnel. Do I understand something wrong?
1
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.– Ron Maupin ♦Dec 14, 2019 at 20:58
Add a comment
|
2 Answers
I've read that IPv6 over IPv4 tunnels are a security risk because IPv6 traffic cannot be intercepted by Intrusion Detection Systems and Firewalls.
That's completely untrue. Maybe some specific, very old IDS systems and firewalls are unable to detect this, but modern equipment sure can.
However, if a network has native IPv6 support it shouldn't be subject to this security risk because the traffic over this network won't be tunnel. Do I understand something wrong?
As said, this is not an issue. It would be interesting to see what exactly you read and where you read it.
There are a few tunneling protocols, but I'm guessing you're talking about these: (1) 6to4 tunnels, which are trivially stopped by firewalls, as they are clearly marked as IPv4 protocol 41. (2) teredo tunnels, which are also trivially stopped by firewalls, as they require outbound udp/3544.
As Teun said, this is not an issue. Firewalls can simply block the tunnels, as I showed above. Also, your concern about IDS is likely based on very outdated info and is just not an issue in 2019, since IDS can handle IPv6 these days.
You should use IPv6 if it's available. In fact, your cellphone in the US likely already has IPv6. And if you have a cable ISP, you also likely already have IPv6. Over 50% of US traffic to Facebook is IPv6 now, and over 33% of US traffic to Google is IPv6.
