Hacker News Reader

Comment by jannes | Hacker News Reader

My ISP-provided router supports IPv6, but I've disabled it because I don't feel like setting up a firewall for all those poor devices on my network.

Are there any guides for how to properly secure a home network so that I can re-enable IPv6 with a clear conscience?

View on HN

If you're not running a firewall, your router is just as vulnerable as any device behind it would be with IPv6 — that is potentially vulnerable on any port it might listen to. NAT is not a firewall, it's an ugly workaround to a scalability issue.

For most home IPv6 networks, blocking all incoming traffic from the egress port will achieve the same level of security as a NAT'd IPv4. Different router/fw manufacturers would need their own guides on how to do that, but IMO any sane consumer product should be configured like that by default.

Here's a guide for OpenBSD, for instance. Note how it includes "block all" which means it blocks everything not specifically allowed. https://www.openbsd.org/faq/pf/example1.html#pf

> Are there any guides for how to properly secure a home network so that I can re-enable IPv6 with a clear conscience?

    ip6tables -P FORWARD REJECT
    ip6tables -F FORWARD
    ip6tables -A FORWARD -o wan -s 2a42:.../64 -j ACCEPT
    ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Literally the same as for IPv4.

Why do I get the feeling that some home routers won't NAT or have the established/related rule by default for ipv6.

I don't know. I've never misconfigured/insecure v6 CPEs in Europe. But if you're bringing your own device, all bets are off of course.

This makes sense, considering ISPs might not want to deal with a ton of pwned devices that are now part of botnets.

You should also enable ICMP (or at least some of it) - see http://shouldiblockicmp.com/ for explanation on why this is important for IPv6

  ip6tables -A FORWARD -p icmpv6 -j ACCEPT

I suppose you should never blindly trust the competence of an ISP-provided router, but I would expect it to automatically block all incoming IPv6 traffic unless you explicitly add forwarding rules.

You can always enable v6, then see if you can reach internal machines from a machine on the internet (like a VPS or over a cell connection)

My router automatically blocks all incoming traffic over ipv6 - you have to manually enable ports.

Can't say if this is still the case but when I had a MikroTik Routerboard by default it allowed everything through on IPv6.

This is probably going to be the case for most professional devices that have CLI configuration and expect the user to be familiar with networking.

They don't know what you're going to use it for and in real networks, the sensible home default of "allow outcoming deny incoming" doesn't usually make much sense. You're probably going to have dedicated firewall devices somewhere else in your network.

Any/all consumer routers do stateful packet inspection for IPv6: by default no traffic will get in unless it is a reply to a previous outgoing request.

If you have a Asus/Dlink/whatever there's nothing special to be done.

* https://www.asus.com/support/FAQ/1013638/

* https://www.asus.com/support/FAQ/113990/

You can likely re-enable IPv6 and simply block all incoming IPv6 traffic except for icmp and it'll be quite alright. If you're using OpenWrt for example the default firewall has this exact configuration.

Reply on news.ycombinator.com