up vote 4 down vote favorite
1
share [g+] share [fb]

It is my understanding that network address translation (NATing) goes away with IPv6. How do we isolate network resources to those that need them from the rest of the internet? I am specifically thinking about allowing access to internal network resources like file servers or VM hosts to remote users, such as those working from home.

A similar scenario also comes up in IPv4 today. At many universities, including my own, each network device gets a publicly routable IP. I'd like to run a file server, but don't really want it publicly accessible. Ideally it too would have a public IP and VPN would not be necessary.

Comments?

link|improve this question
60% accept rate
feedback

3 Answers

up vote 6 down vote accepted

How do we isolate network resources to those that need them from the rest of the internet?

That's what stateful firewalls are for. The isolation that NAT provides really provides only a false sense of security, and is not good for anything other than security by obscurity.

That said, while NAT will needed on a much less frequent basis after migration to IPv6, it's not going away anytime soon. In fact, for better or worse, NATv6 implementations already exist and are in production in various organizations today.

Just because a device has a public IP address does not mean in any way that it's publically-accessible. Your default firewall policy should be default deny, and then only allow traffic to/from specific ports or subnets as needed.

link|improve this answer
Also, you can subnet. Then you have a range of IP addresses that you know is only reachable by a specific router under your control. – ultrasawblade Apr 4 '11 at 19:53
feedback
up vote 2 down vote

You can use unique local addresses for resources that shouldn't be available on the public Internet. The ULA range is fc00::/7, which is outside the global range (2000::/3).

link|improve this answer
Or if all you need is communication with nodes on your segment, you can just use the automatically generated/activated link-local addresses. – Marcin Apr 5 '11 at 3:56
Actually, ULA's, while being marked as private, are still supposed to be globally unique. One of the RFC's lays out an algorithm to follow to generate a random, 40-bit number (global ID), and then you have to further randomize the 16bit subnet ID after the global ID. The only explanation for this that I've found is either to simplify the merging of two enterprise networks or if someone accidentally plugs a ULA-addressed device into a public router port, it wouldn't screw up the existing routes with other devices using the same ULA. That last one is a utopian pipe dream, IMHO. – Kumba Apr 6 '11 at 5:08
@Marcin: link-local addresses are very hard to memorize. If whoever designed that spec up has just used a straight MAC address, it'd be a lot easier. But I don't understand the thinking behind dropping a 16-bit value smack in the middle of the MAC. Why not prepend it or suffix it instead? – Kumba Apr 6 '11 at 5:09
feedback
up vote 0 down vote

The point of VPN is not to work around NAT, but to enforce authentication and connection security. VPN will still be a big part of secure remote access. (ie, just because you have the address space to expose services to the net, doesn't mean you should expose everything)

Firewall your IPv6 devices off from the internet, providing access only to services that should be publicly accessible. Users who need to access internal resources should still VPN in, and potentially have a different set of firewall rules applied to them (or just full access to the internal network; depends on your security policy).

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.