4 ms·

My ISP-provided router supports IPv6, but I've disabled it because I don't feel like setting up a firewall for all those poor devices on my network. Are there

by jannes 7y ago

My ISP-provided router supports IPv6, but I've disabled it because I don't feel like setting up a firewall for all those poor devices on my network. Are there any guides for how to properly secure a home network so that I can re-enable IPv6 with a clear conscience?

xur17 7y ago
My router automatically blocks all incoming traffic over ipv6 - you have to manually enable ports.
- unicornfinder 7y ago
  Can't say if this is still the case but when I had a MikroTik Routerboard by default it allowed everything through on IPv6.
  - ATsch 7y ago
    This is probably going to be the case for most professional devices that have CLI configuration and expect the user to be familiar with networking. They don't know what you're going to use it for and in real networks, the sensible home default of "allow outcoming deny incoming" doesn't usually make much sense. You're probably going to have dedicated firewall devices somewhere else in your network.
mrpippy 7y ago
I suppose you should never blindly trust the competence of an ISP-provided router, but I would expect it to automatically block all incoming IPv6 traffic unless you explicitly add forwarding rules. You can always enable v6, then see if you can reach internal machines from a machine on the internet (like a VPS or over a cell connection)
e2le 7y ago
You can likely re-enable IPv6 and simply block all incoming IPv6 traffic except for icmp and it'll be quite alright. If you're using OpenWrt for example the default firewall has this exact configuration.
bitofhope 7y ago
If you're not running a firewall, your router is just as vulnerable as any device behind it would be with IPv6 — that is potentially vulnerable on any port it might listen to. NAT is not a firewall, it's an ugly workaround to a scalability issue. For most home IPv6 networks, blocking all incoming traffic from the egress port will achieve the same level of security as a NAT'd IPv4. Different router/fw manufacturers would need their own guides on how to do that, but IMO any sane consumer product should be configured like that by default. Here's a guide for OpenBSD, for instance. Note how it includes "block all" which means it blocks everything not specifically allowed. https://www.openbsd.org/faq/pf/example1.html#pf https://www.openbsd.org/faq/pf/example1.html#pf
q3k 7y ago
> Are there any guides for how to properly secure a home network so that I can re-enable IPv6 with a clear conscience? ip6tables -P FORWARD REJECT ip6tables -F FORWARD ip6tables -A FORWARD -o wan -s 2a42:.../64 -j ACCEPT ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT Literally the same as for IPv4.
- Wheaties466 7y ago
  Why do I get the feeling that some home routers won't NAT or have the established/related rule by default for ipv6.
  - q3k 7y ago
    I don't know. I've never misconfigured/insecure v6 CPEs in Europe. But if you're bringing your own device, all bets are off of course. This makes sense, considering ISPs might not want to deal with a ton of pwned devices that are now part of botnets.
- porjo 7y ago
  You should also enable ICMP (or at least some of it) - see http://shouldiblockicmp.com/ http://shouldiblockicmp.com/ for explanation on why this is important for IPv6 ip6tables -A FORWARD -p icmpv6 -j ACCEPT
throw0101a 7y ago
Any/all consumer routers do stateful packet inspection for IPv6: by default no traffic will get in unless it is a reply to a previous outgoing request. If you have a Asus/Dlink/whatever there's nothing special to be done. * https://www.asus.com/support/FAQ/1013638/ https://www.asus.com/support/FAQ/1013638/ * https://www.asus.com/support/FAQ/113990/ https://www.asus.com/support/FAQ/113990/

by jannes 7y ago

xur17 7y ago

My router automatically blocks all incoming traffic over ipv6 - you have to manually enable ports.

unicornfinder 7y ago
Can't say if this is still the case but when I had a MikroTik Routerboard by default it allowed everything through on IPv6.
- ATsch 7y ago
  This is probably going to be the case for most professional devices that have CLI configuration and expect the user to be familiar with networking. They don't know what you're going to use it for and in real networks, the sensible home default of "allow outcoming deny incoming" doesn't usually make much sense. You're probably going to have dedicated firewall devices somewhere else in your network.

mrpippy 7y ago

I suppose you should never blindly trust the competence of an ISP-provided router, but I would expect it to automatically block all incoming IPv6 traffic unless you explicitly add forwarding rules. You can always enable v6, then see if you can reach internal machines from a machine on the internet (like a VPS or over a cell connection)

e2le 7y ago

You can likely re-enable IPv6 and simply block all incoming IPv6 traffic except for icmp and it'll be quite alright. If you're using OpenWrt for example the default firewall has this exact configuration.

bitofhope 7y ago

If you're not running a firewall, your router is just as vulnerable as any device behind it would be with IPv6 — that is potentially vulnerable on any port it might listen to. NAT is not a firewall, it's an ugly workaround to a scalability issue. For most home IPv6 networks, blocking all incoming traffic from the egress port will achieve the same level of security as a NAT'd IPv4. Different router/fw manufacturers would need their own guides on how to do that, but IMO any sane consumer product should be configured like that by default. Here's a guide for OpenBSD, for instance. Note how it includes "block all" which means it blocks everything not specifically allowed. https://www.openbsd.org/faq/pf/example1.html#pf https://www.openbsd.org/faq/pf/example1.html#pf

q3k 7y ago

> Are there any guides for how to properly secure a home network so that I can re-enable IPv6 with a clear conscience? ip6tables -P FORWARD REJECT ip6tables -F FORWARD ip6tables -A FORWARD -o wan -s 2a42:.../64 -j ACCEPT ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT Literally the same as for IPv4.

Wheaties466 7y ago
Why do I get the feeling that some home routers won't NAT or have the established/related rule by default for ipv6.
- q3k 7y ago
  I don't know. I've never misconfigured/insecure v6 CPEs in Europe. But if you're bringing your own device, all bets are off of course. This makes sense, considering ISPs might not want to deal with a ton of pwned devices that are now part of botnets.
porjo 7y ago
You should also enable ICMP (or at least some of it) - see http://shouldiblockicmp.com/ http://shouldiblockicmp.com/ for explanation on why this is important for IPv6 ip6tables -A FORWARD -p icmpv6 -j ACCEPT

throw0101a 7y ago

Any/all consumer routers do stateful packet inspection for IPv6: by default no traffic will get in unless it is a reply to a previous outgoing request. If you have a Asus/Dlink/whatever there's nothing special to be done. * https://www.asus.com/support/FAQ/1013638/ https://www.asus.com/support/FAQ/1013638/ * https://www.asus.com/support/FAQ/113990/ https://www.asus.com/support/FAQ/113990/