Due to the addressing scheme of IPv6, each client now is able to get and directly use Globally-Routable Address (GUA) from the ISP. But that poses bigger security threat because attacker can directly discover and potentially attack them.

Is it okay to put them behind NAT and give them link-local address (FE80::/10) instead of directly giving them Public IPv6 address?

  • You forget that NAT is not about security. Security comes from firewalls, not NAT. It is often convenient to put the NAT on the firewall, but that has nothing to do with security. NAT is a kludge to keep IPv4 working until IPv6 is ubiquitous. NAT breaks protocols other than TCP, UDP, and ICMP, preventing innovation and new technologies. IPv6 restores the IP paradigm and allows existing and new protocols that are broken by NAT on IPv4. Also, the NAT66 RFC is an experimental RFC, not on the standards track, and it requires a one-to-one NAT, and forbids the NAPT many-to-one NAT. – Ron Maupin Nov 9 '20 at 13:16

What you are suggesting is just one more "wrong-think" about IPv6. Stop thinking about things in terms of IPv4. If you have an actual, real, functional firewall, the security concern of having a public address is negligible. Unsolicited inbound traffic is blocked, and everything else is inspected.

IPv6 was designed to never have the insanity IPv4 does w.r.t. NAT. So, "NAT66" really isn't a thing. However, there were eventual compromises in the form of "prefix translation".

Your use of link-local addressing is a non-starter. Any time a LLA is used, a scope or interface MUST be specified -- how else would an application know which link to use, as they ALL use the same range. IPv6 has Unique Local Addresses (ULA) for this sort of thing: an address range one can reasonably assume will not collide with any other network to which you may someday link. But using NAT(-PT) to get them out to the internet will be problematic. (there are rules about when to select a ULA)

  • 3
    While I don't disagree with the answer, "Stop thinking about things in terms of IPv4" seems to imply that NAT was a security feature in IPv4, which is not the case. In both IPv4 and v6 you need proper firewalling. – JFL Nov 9 '20 at 9:24
  • Perhaps, but it's a statement about IPv6 NOT BEING IPv4, so we should stop applying the same practices to IPv6. (LANs smaller than /64, NAT, private addressing, etc...) – Ricky Nov 9 '20 at 22:32

The purists don't like it but that doesn't make it un-viable. Said purists also like to claim that NAT is not a security feature, I disagree with this, having different addresses on your internal and external networks makes it much less likely you will end up with things wide open by accident. It also makes it harder for attackers to gather internal network addresses to target if they can somehow get a machine on the inside to do their bidding.

Of course there are security downsides to NAT as well, for example it may make it harder to locate the real source of traffic when an abuse report comes in.

In terms of actually implementing NAT66, you can't use link-local addresses, since traffic with a link-local source or destination is not allowed to pass over a router.

You can use unique-local or site-local addresses, however on many systems this will result in a de-prioritisation of ipv6 compared to ipv4 because the system will assume if it doesn't have a global address it probably does not have a connection to the IPv6 internet. You can also use NAT to translate from one global address to another.

  • 1
    NAT really isn't security, but most people assume that it is. (And it's their only security.) Once past this facade of security, most networks are easily discovered/enumerated, and then it's a free-for-all. (I've watched this happen in several large corporate networks.) – Ricky Nov 9 '20 at 22:37
  • 1
    ULA also has the drawback of not being selected for communication to a GUA. (at least it's not supposed to. many network stacks still get that wrong.) ULA plus local proxies can work, however. (and is how I've handled some lab "islands" without public v6 access) – Ricky Nov 9 '20 at 22:39
  • I'm sure last I read the RFCs they were expressed in terms of preferences, so if the client has a GUA assigned it should be used but if no GUA is assigned a ULA or SLA can be used. – Peter Green Nov 9 '20 at 22:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.