Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
Due to the addressing scheme of IPv6, each client now is able to get and directly use Globally-Routable Address (GUA) from the ISP. But that poses bigger security threat because attacker can directly discover and potentially attack them.
Is it okay to put them behind NAT and give them link-local address (FE80::/10) instead of directly giving them Public IPv6 address?
What you are suggesting is just one more "wrong-think" about IPv6. Stop thinking about things in terms of IPv4. If you have an actual, real, functional firewall, the security concern of having a public address is negligible. Unsolicited inbound traffic is blocked, and everything else is inspected.
IPv6 was designed to never have the insanity IPv4 does w.r.t. NAT. So, "NAT66" really isn't a thing. However, there were eventual compromises in the form of "prefix translation".
Your use of link-local addressing is a non-starter. Any time a LLA is used, a scope or interface MUST be specified -- how else would an application know which link to use, as they ALL use the same range. IPv6 has Unique Local Addresses (ULA) for this sort of thing: an address range one can reasonably assume will not collide with any other network to which you may someday link. But using NAT(-PT) to get them out to the internet will be problematic. (there are rules about when to select a ULA)
The purists don't like it but that doesn't make it un-viable. Said purists also like to claim that NAT is not a security feature, I disagree with this, having different addresses on your internal and external networks makes it much less likely you will end up with things wide open by accident. It also makes it harder for attackers to gather internal network addresses to target if they can somehow get a machine on the inside to do their bidding.
Of course there are security downsides to NAT as well, for example it may make it harder to locate the real source of traffic when an abuse report comes in.
In terms of actually implementing NAT66, you can't use link-local addresses, since traffic with a link-local source or destination is not allowed to pass over a router.
You can use unique-local or site-local addresses, however on many systems this will result in a de-prioritisation of ipv6 compared to ipv4 because the system will assume if it doesn't have a global address it probably does not have a connection to the IPv6 internet. You can also use NAT to translate from one global address to another.
