27

Will it still be useful to make use of private IP addresses with IPv6?

Improve this question
4
  • 1
    The IPv6 ULA addresses can be used for traffic that will never go out on the public Internet, but you can easily assign multiple IPv6 addresses on an interface (much more difficult for IPv4), so you can easily have one or more ULA and one or more Global addresses configured on one interface.
    – Ron Maupin ♦
    Apr 28, 2020 at 19:39
  • 8
    It will (hopefully) make them not mandatory!
    – user253751
    Apr 29, 2020 at 12:37
  • 1
    @user253751 Well said. Yes, your average Comcast account these days comes with enough IPv6 addresses for every nanide on the Revolut10n TV show... about a million times over. Nah, you'll still want unroutable private IPs for protection, for certain traffic you want to preclude leaking onto the open internet... or coming in. A side-effect of a NAT router is nobody can portscan your PC, since it doesn't have a public address.
    – Harper - Reinstate Monica
    Apr 29, 2020 at 18:04
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 17, 2020 at 16:57

3 Answers 3

Reset to default
31

No, private addressing will not become obsolete. But actually, there are two kinds of private addresses: the Unique Local Addresses (ULAs) and the link-local addresses (LLAs).

There will always be a need for big (i.e. routed) private networks that are not directly connected to the internet. Now, you could argue you don't require a private address space for this, just use whatever you want. There are still good arguments why there is still a dedicated IANA-assigned prefix FC00::/7 with a 40 bit randomizer for local unicast addresses as per RFC 4139:

  • Some devices on that network may be connected to the global internet also, either simultaneously or by moving networks. In any case, re-using prefixes will mess up routing tables. Worst case you even leak a 'privately used prefix' into the global routing table and black-hole that regularly routable address. Leaking a non-routable address is less bad.
  • Actual global addresses are owned by people and organisations. These people are free to do with those addresses what they want, including hard-coding them in certain applications. If you re-use those addresses internally you may see some weird traffic and/or application behavior.
  • At some point you may want to interconnect two private networks (e.g. combine two offices), at which point overlap would be a headache. The randomization makes sure this should be extremly unlikely.

Now, most homes and offices don't have such a complex network and only have one router that guarantees connection to the internet. Even here it is useful to have a kind of private addressing. For example you want to run a service that is only reachable from inside the home, or run a service that is not dependent on your internet connection. For this you can easily rely on the LLAs in prefix fe80::/64 as defined in RFC 4291. Most devices will automatically assign a link-local address to any IPv6-enabled interface. This address is only meaningful within a given broadcast domain and cannot be reached from outside that broadcast domain.

As a final: what IPv6 obsoletes is the need for private addresses that are NAT'ed into public ones. IPv6 allows for multiple addresses per interface, so the private addresses above can perfectly be combined with public addresses. Aside from that the IP resource saving from NAT is no longer necessary and the neglible perceived security that NAT gives can perfectly be built for IPv6 without actually doing NAT itself and is better of using a dedicated firewall anyway.

Improve this answer
10
  • 3
    "the security that NAT gives" is a non-existent myth. Firewalls provide security, and a NAT device without a firewall is vulnerable to being compromised, and since it has full access to the internal private network, then the private network is fully exposed to the attacker. NAT provides no real security.
    – Ron Maupin ♦
    Apr 28, 2020 at 21:03
  • 1
    You are forgetting the part where if there is no NAPT table entry, then the packet is destined to the NAPT device itself. As I explained, the NAPT device is vulnerable to attack without a firewall, and it has full access to the private network. It is firewalls that provide network security, not NAT or NAPT.
    – Ron Maupin ♦
    Apr 28, 2020 at 21:12
  • 9
    The real problem is that NAPT has stifled protocol innovation because it only allows TCP, UDP, and ICMP. SCTP probably would have taken over TCP and UDP years ago, except for NAPT, and other protocols cannot be developed due to NAPT. Restoring the original IP premise of end-to-end connectivity will open up innovation again, and we can retire things like TCP and UDP that have known weaknesses that have been solved by other protocols that we cannot use. The programmers on Stack Overflow cuss about the current protocols available, but we cannot use the ones that solve their problems.
    – Ron Maupin ♦
    Apr 28, 2020 at 21:40
  • 1
    @supercat, the entire premise of IP is that only the end-devices need to maintain state. The point was that any failure in the middle would automatically reroute around the failure, but that cannot happen if the device maintaining state fails because the connection would need to be reestablished, which was the point of packet-switching over the old telco circuit-switching. The government funded the research for packet-switching that resulted in IP to overcome the limitations of circuit switching in the event of disaster or war, and putting state back in defeats that.
    – Ron Maupin ♦
    Apr 29, 2020 at 22:42
  • 1
    @supercat, there is no Internet backbone. The Internet is simply the ISPs connecting to each other in whatever fashion they choose and contract. Think about a company with multiple egress points using VoIP with a bunch of calls. Using IPv4 and NAT, the failure of one NAPT box fails all the call calls going through that box because they would get different IPv4 addresses on a different NAPT box. With IPv6, the calls automatically reroute around the failed box through another box and continue because the addressing does not change.
    – Ron Maupin ♦
    Apr 29, 2020 at 23:13
11

IPv6 has Unique Local Addresses (ULA) (see RFC 4193) which function roughly like RFC1918 addresses.

These addresses are called Unique Local IPv6 Unicast Addresses and are abbreviated in this document as Local IPv6 addresses. They are not expected to be routable on the global Internet. They are routable inside of a more limited area such as a site. They may also be routed between a limited set of sites.

Improve this answer
4
  • 1
    The key about ULA vs. RFC 1918 or even the deprecated IPv6 Site-Local addresses is that it is not expected that the same addressing will be used in multiple places because of the required, randomly-chosen 40-bit Global ID.
    – Ron Maupin ♦
    Apr 28, 2020 at 19:41
  • 1
    Nitpick it is expected that (assuming people follow the RFC which of course not everyone will) that the probability of two sites that want to communicate with each other using the same address block is low. However it is very likely that even if everyone does pick their blocks randomly that there will be multiple sites in the world using the same block.
    – Peter Green
    Apr 28, 2020 at 22:19
  • "randomly chosen" People are very bad at random, and so are computers. Overlaps are going to happen, but IPv6 is, in theory, easier to renumber. The hope is these overlaps will be rare -- far more so than RFC1918 networks.
    – Ricky
    Apr 29, 2020 at 4:49
  • 1
    @RickyBeam there also is only a problem if those prefixes somewow come into contact, e.g. due to accidental route leaks or due to office merges. Both those should be rare enough, adding that to the randomization in the RFC I doubt it will ever be a real issue. The real issue is that many people will ignore the randomization and just pick zero.
    – KillianDS
    Apr 29, 2020 at 6:49
4

Yes, IPv6 NAT is possible. Juniper Junos, for example, supports generally similar features for IPv6 as it has for IPv4.

You may wish to read about IPv6 Unique Local Addresses.

Many will argue that 6-to-6 NAT is unnecessary, that you shouldn't rely on it as a security tool, etc. I don't believe they're wrong, but I'm glad NAT is still a tool we can use when it's the most practical option.

Improve this answer
11
  • 1
    The standards documents for IPv6 explicitly specify a lot of really stupid things. Forbidding NAPT is one of them. Remember, IPv6 also specifies you musn't configure subnets longer than /64, yet breaking this "rule" is almost universally standard among transit networks. Requiring end-systems to participate in multiple networks, instead of permitting NAT to abstract hosts from network inter-connections, is fine for purists but just isn't the most practical option in many cases.
    – Jeff Wheeler
    Apr 28, 2020 at 20:10
  • 4
    "IPv6 also specifies you musn't configure subnets longer than /64" That is a common misconception. There are some feature that do not work with networks that are not /64, but ask @RickyBeam, and he will tell you that it works just fine. The only RFCs about the length will give you pros and cons about using different lengths, but there is not one that says you can only use /64. On the contrary, there is one that recommends /127 for point-to-point networks. In any case, there is no real need for NAT, much less NAPT, which breaks the IP end-to-end paradigm that IPv6 restores.
    – Ron Maupin ♦
    Apr 28, 2020 at 20:57
  • 3
    "permitting NAT to abstract hosts from network inter-connections, is fine for purists but just isn't the most practical option in many cases." Why is that not practical? That is the very foundation of IP. IP is based on end-to-end connectivity, and NAPT breaks that, rendering many protocols unusable. NAPT only works with TCP, UDP, and ICMP. SCTP is a better, more modern protocol that breaks, and new protocols cannot be defined because of NAPT, which also breaks some application-layer protocols.
    – Ron Maupin ♦
    Apr 28, 2020 at 21:08
  • 2
    OK, I'll jump in this rant too: This terribly broken paradigm has somehow allowed more people on the planet to communicate and share information than anything else in history, not to mention creating all our careers. Yes, end to end may have some advantages for more efficient protocols, but it eliminates all the practical things that make the Internet work, like security proxies and load balancers. End to end sounds good until you need to inspect traffic in order to protect your company’s or government’s assets.
    – Ron Trunk
    Apr 29, 2020 at 3:50
  • 1
    Actually the "/64 rule" does exist, but it's in the context of LANs. In the myriad of RFCs constantly redefining IPv6, they make it out like a /96 LAN will bring about the apocalypse. Try it yourself, it only "breaks" SLAAC because "prefix length === 64" is hard coded in the standard. (if you edit your linux source, that rule is trivial to remove.) If you take it too far, you can run into issues with anycast and other special, reserved addresses, which is why /127 takes special handling. Also, the smaller the network, the harder it is to find a unique address.
    – Ricky
    Apr 29, 2020 at 5:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.