0

Can somebody help me get a better understanding of IPv6? For me, v4 is considerably easier to wrap your head around. Some questions I still have after a few hours of reading:

  1. Maybe the simplest one: Is a v6 address static? Or can I make it static like a v4 one so that I can reach my printer at home for example?

  2. In v4 if I were to create a server it would be reachable through my assigned IPv4 address, where then my router would forward it to me. In v6 I can seemingly access my PC just by knowing it's global unicast address. Would that mean, that anyone can access my server if they were to randomly pick its v6 address?

  3. If I wanted to access my local network, I would have a VPN running, through which I could tunnel into it. Now in v6 there is a ULA but can I use the prefix to create a VPN? How would that work?

2 Answers 2

3

Maybe the simplest one: Is a v6 address static? Or can I make it static like a v4 one so that I can reach my printer at home for example?

IPv6 addresses like ipv4 ones can be either dynamic or static.

The big difference is that IPv6 NAT is strongly discouraged. One function of NAT is to save addresses, but another is it decouples the addressing on your local network from that of your provider.

What this means is if you use a "broadband" service you are very likely to be allocated a dynamic IPv6 prefix just as you are today very likely to be allocated a dynamic IPv4 address. However with IPv4 the dynamic address stays on the providers side of your "router", while with IPv6 the dynamic addresses are assigned to the end systems on your LAN.

The IPv6 proponents "solution" to this is to run multiple addresses in paralell, you have dynamic global addreses for communication with the internet while having static link local and/or unique local addresses for local communications.

In v4 if I were to create a server it would be reachable through my assigned IPv4 address, where then my router would forward it to me. In v6 I can seemingly access my PC just by knowing it's global unicast address. Would that mean, that anyone can access my server if they were to randomly pick its v6 address?

It depends. Most ipv6-capable home routers now have a firewall that restricts traffic to outgoing connections only by default.

The problem is that it's difficult to meaningfully configure a firewall in an environment where addresses are dynamic. So it's easy to end up in a situation where your only reasonable options are "incoming connections allowed to every device" and "no incoming connections allowed at all".

Pure random guessing of addresses is likely impractical in IPv6 Some sort of "structured random" guessing taking account of known information about what IP blocks have been allocated to ISPs, what MAC addresses have been allocated to network equipment vendors, known information about the behavior of ISPs etc may get a higher hit rate, but it will still likely have a lot more "misses" than IPv4 scanning. In practice I suspect it's more likely that ipv6 attackers will focus on harvesting rather than scanning addresses.

If I wanted to access my local network, I would have a VPN running, through which I could tunnel into it. Now in v6 there is a ULA but can I use the prefix to create a VPN? How would that work?

Sure you ca use unique local addresses on a VPN, just as you can use private IPv4 addresses.

0

Is a v6 address static?

Not by itself. IPv6 addresses are delegated by your ISP or network administrator and may change over time, depending on their policy. In contrast to IPv4, the change doesn't need to be a hard cut but you can phase in new addresses and then phase out the old ones. (That is possible with IPv4 as well but rather uncommon.)

In v4 if I were to create a server it would be reachable through my assigned IPv4 address, where then my router would forward it to me.

You seem to be referring to destination NAT aka port forwarding - NAT is deprecated for IPv6 and absolutely superfluous. If your network has got a static IPv6 prefix you could assign a static address to your server (via DHCPv6) and access it transparently. Just configure your firewall appropriately. With dynamic prefixes you could use still use DHCPv6 in combination with some DDNS scheme.

Would that mean, that anyone can access my server if they were to randomly pick its v6 address?

That depends on your firewall config.

If I wanted to access my local network, I would have a VPN running

With a VPN, you'd tunnel ULA addresses and use global addressing between the VPN endpoints to create the tunnel.

Alternatively, you could use global addresses within the tunnel, but there's no need or benefit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.