How does the shortage of IPv4 public IPs influence existing firewalls?

Question

I came to know recently IPv4 public IP address pools are going to be exhausted soon. If IPv6 addresses are fully in use, all device vendors like Cisco, Fortinet, Palo Alto have to redesign their firewalls and routers to make them compatible for configuring IPv6 addresses. Then what is the situation for firewalls already deployed and working in production? And can we NAT IPv6 public IP with IPv4 private IP ranges?

Answer 1

You're late to the game: IPv4 addresses are already exhausted, and have been for a number of years. All the major manufacturers have included IPv6 capability (in varying degrees) in their product for quite some time.

Answer 2

And can we NAT IPv6 public ip with ipv4 private ip ranges.

Since IPv6 addresses are abundant and allocated as /56 even for private access, there's absolutely no need for NAT (which is a kludge to deal with IPv4 public address scarcity). NAT64 for IPv6 was defined but there's little support - and that's a good thing.

Answer 3

I came to know recently ipv4 public ip address pools are going to exhausted soon.

Depending on your definition of "exhausted" they already are.

It's not like you can't get IPv4 though, just that the price is going up.

Realistically what will happen is that as prices rise companies will reevaluate where they are using their IPv4. Connections that would previously have come with a public v4 address as standard are likely to end up behind some form of IPv4 address sharing mechanism. Connections that have previously come with a block as standard may only come with a single address as standard with extra fees if you want a block.

If ipv6 address are in use fully. All devices vendor like cisco, fortinet, Paloalto has to redesign they firewalls and routers to make compatible for configuring IPv6 address.

Most vendors do now have support for IPv6, though exactly what features are supported can vary.

Then what is situation of firewall already deployed and working in production.

Highly variable :(

And can we NAT IPv6 public ip with ipv4 private ip ranges.

The problem is while you can easily encapsulate an IPv4 address inside an IPv6 address you can't do the reverse. For a v6 client connecting to a v4 server this means losing the true IP address of the client. For a v4 client connecting to a v6 server this would mean that your DNS gateway would have to be statefully tied to your NAT implementation (i'm not sure if anyone has actually implemented this or if everyone has dismissed it as too horrible).

Answer 4

Then what is the situation for firewalls already deployed and working in production?

Most professional devices seem already to support IPv6. And the manufacturers of home equipment will tell you to buy a new device. (Unfortunately, equipment not supporting IPv6 is still sold!)

And can we NAT IPv6 public IP with IPv4 private IP ranges?

There is one major difference to "traditional" IPv4 NAT:

Using traditional IPv4 NAT the IP packets in the local network contain the public address of the web server. Only the address of the client (the local computer) is changed by the NAT.

Using two different protocols with different address lengths this is of course not possible; a NAT must replace both addresses.

The problem is the first packet being sent to some web server (to establish a connection). Neither using a "traditional" IPv4 NAT nor using IPv6-to-IPv6 NAT this is a problem:

If you want to connect to some web site, the local computer will send an IP packet to the address of that web site. Because the destination address in the IP packet in the local network equals the public IP address of the server, the NAT knows the public address of the server: It is the destination address in the local IP packet.

Connecting to an IPv4 server from an IPv6 client (NAT64 or 464xlat) is a bit more tricky, but it is still feasible:

Because the IP addresses in the local network are 128 bits long but the public IP address of the server is only 32 bits long, the addresses cannot be equal. However, the 32 bits of the IP address of the web server can simply be added to some 96-bit prefix to get the 128-bit IPv6 address of the server being used inside the network. The NAT can simply find out the public IP address of the server: It's the last 32 bits of the 128-bit destination address in the local IP packet.

The other way round is more difficult:

The network packets in the local network would only contain 32-bit addresses, but the public IP address of the web server would be a 128-bit address. This means that there is no possibility to send the complete public IP address of the server in the local packet.

The NAT must have some table to look up the public IP address of the server when the first IP packet of a new connection must be routed from the local network to the internet.

NAT46/DNS46 does exist; the software I have seen (it's source is available in the internet) assigns an IPv4 address (maybe in the range 10.x.x.x) to some IPv6-only server when the IPv4 address of that server is queried using DNS.

This is rather complicated and it will only work if the DNS server used is also located on the NAT router.

Another thing are proxy servers as they are used by many companies:

Unlike a NAT, a proxy server is routing TCP payload (OSI layer 5 and above). Thererfore, even a proxy server between two networks using completely different protocols (e.g. TCP/IP is used in one network and AppleTalk Data Stream Protocol is used in the other one) would work exactly the same way as a proxy server between two IPv4 networks. The same is true if one network is using TCP/IPv4 and the other one is using TCP/IPv6.

There may be companies using proxy servers that will still use IPv4-only in the local network when the internet is IPv6-only.

Answer 5

NAT between IP4 and IP6 is pointless.

NAT always changes only destination address (as in destination-NAT) or source address (as in source-NAT or masquerading). You will end up with a connection between an IP4 and an IP6 address. Neither of them supports such connection.

Well, you can do both (SNAT + DNAT) in a single host and even encode IP4 addresses in an IP6 addresses. This is sometimes done in order to inject some IP4 traffic in an IP6-only network.

... and NAT is invented in order to deal with the IP4 address scarcity in the first place. It is almost pointless in a hypothetical IP6-only world.

BUT: that's not how most of the Internet deals with the IP4 scarcity. What the world does: everyone keeps using IP4, IP4 addresses are just valued higher and spared for important purposes like servers. NAT use is intensified and becomes more complex, carrier-grade NAT is employed, 100.64/10 network block is designated, SNI is invented, etc, etc...

...everything because IP6 is an incredible mess, lacking the simplicity and the usefulness of the IP4, its complexity arising from the attempt to solve a single real (address scarcity) and a great deal of imaginary problems. Its adoption is slow and few people see it as the future of the Internet.