network - Is IPv6 with NAT less secure than IPv4? - Information ...

3 Answers
3
IPv4, due to the size of the address pool, has long had a technique called Network Address Translation. In a simplistic view, let's assume you are allocated the (invalid) IP address for your router 256.10.20.30 (I use invalid addresses so people don't go around pinging them etc). Locally, your router is 192.168.0.1 and your host is 192.168.0.2 like this:
As such, your router appears to the internet as a public facing IP-address; however, unless you deliberately route connections on ports from the router to a computer on the private IP address range, the computers on the private LAN side are not directly addressable from the internet. The route is performing two functions - both NAT and routing.
In IPv6 there are a lot of addresses. The idea fundamentally is that there are no private IP address ranges (which isn't exactly true; an RFC for that does exist) and as such the IPv6 situation looks like this:
There isn't really enough space in these boxes to write out the full addresses, but in the IPv6 model, the router performs its routing function (it gets packets to the computers on the LAN) but crucially here it routes both from and to the internet, rather than routing / NATing outwards.
The effect of this is that the default case for IPv4, namely that home computers aren't directly accessible by nature of the fact they have no IP address unless the router knows about the connection goes away. The computer becomes addressable from the internet, much like a server.
Clearly, such connections can still be firewalled, with firewalls denying all incoming (non-client-initiated) connections, however, you've lost needing to explicitly configure your router to route internet packets to you. If the firewall doesn't filter the incoming packet, the client better be able to cope with it. There is, therefore, a slightly increased security risk to home users using IPv6.
I expect (hope?) most home routers will come configured with this firewall setting. As such, while the risk is slightly increased, it is still probably dwarfed by the threat from browser-based exploits (the "outbound stuff").
NAT is a solution to the IPv4 address-shortage problem: you hide many systems behind one IP address. With IPv6, an end-user will have many addresses, so the need for NAT disappears. This is great from a networking standpoint, since NAT is an ugly hack (from the network perspective) that makes many applications harder.
From a security standpoint however, NAT provides some security by hiding your systems behind a firewall (that NAT router). This NAT router must be configured explicitly to forward incoming connections to internal hosts (not considering UPnP). When NAT disappears and all your systems have a unique, globally reachable IPv6 address, malware can open up a listening socket for connectback.
With IPv4 for a private user, the ISP will only assign one public IP anyway, that's why NAT is needed in the 1st place. Does it remain to be seen whether ISP will provide more than one public IP(v6) address?
After looking around I'm not entirely sure what /56 means, except that it would mean multiple public IPv6 addresses for me. On the other hand, here where I live, consumer DSL lines just get a DSL modem that get's assigned one IPv4 address, and I'm not sure why providers should (without charging me extra) change that policy once they assign me an IPv6 address, especially since many home users should be better off behind NAT. (But I guess this is getting off topic -- maybe you could add a link or two for some background.)
/56 means 2^(128-56) addresses for your home. If you follow the standard and make subnets of 64 bits, you can have 2^8=256 subnets in your house. ISPs won't charge extra because this is how IPv4 is supposed to be assigned, and they aren't charged for their /32s either. ripe.net/ripe/docs/ripe-523
The first problem, that comes to my mind, is that you may have an IPv6 connection that you are not even aware of.
Microsoft Windows has build in support for Teredo. Teredo tunnels IPv6 through IPv4 UDP packets. This provides full duplex IPv6 connectivity.
Furthermore Teredo is designed to work through IPv4 NAT: The client regularly sends queries to the nearest Teredo relay. If this relay has packets for the client, it will answer and the NAT will let the answer through. These packets may contain a connection attempt from the outside.