So at work we're playing with using freenet6 to get an IPv6 tunnel up and running. That's working great and all, and I've got it set to advertise the route, and all of the test boxes now have publicly-routable IPv6 addresses. So I went into each box and started to lock down the local firewall (Windows Firewall), and there's a billion rules, and each rule appears at least twice - once for Domain and once for Private, and many also occur under the Public role. The public and private ones are set for local subnet only, but the domain ones are set for any IP / public access. Given that they are on a domain network, that means that those ports are wide open - apparently Microsoft assumes if you're on a domain network you have a firewall protecting your network. But if you're using freenet or another tunnel onto a box inside the network, you don't.
Yes, I could setup a Linux VM and run it under there, but I'm trying to keep this a Windows-based network for ease of administration, particularly once we go into production.
I'd like, ideally, to specify in a Group Policy that things should be locked down, but there are services on each machine that will be accessible. Is there some kind of order to the firewall rules, or a priority? Is there some way I can import the existing firewall rules so I can tweak them in the group policy?
How are other network admins dealing with IPv6 - is everyone just using nice high-priced Cisco and Juniper firewalls? I wish my firewall could run IPv6, but it's just running dd-wrt (which apparently doesn't support IPv6 except on certain models). Do I just need to bite down and setup an Ubuntu or Debian box and use iptables?
