Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'd like to switch from private-IPv4-subnet-behind-NAT to IPv6, but of course I have no intention of exposing my users' workstations "unprotected" to the net.

Some obvious points up-front:

  • Allow access to provided services
  • Deny access to workstations

Is there a recommended firewall setup guideline that talks about the details and experiences with such setups?

share|improve this question

3 Answers 3

up vote 8 down vote accepted

The advice is largely unchanged from public-IPv4-subnet-behind-Firewall setups that we've had in the .EDU space since the beginning of the commercial Internet. Since early .EDU subnet allocations were rather generous (my old work has an IPv4 /16 allocation, and I know of another institution our size that has a /16 and another /18 for good measure) these institutions have deep experience protecting publicly routeable IP addresses behind firewalls. Heck, that setup was what the original IP creators had in mind.

The principles (from memory):

  • Do not allow external access to internal IP addresses unless there is a specific business need (default deny).
  • Allow ICMP to internal addresses as the IP protocols rely on it to determine network conditions.
    • Ping-sweeps should be blocked by your IPS config.
    • Keep in mind that just because a machine in ping-able, does not mean it is connectable!
  • Reverse DNS lookups do matter for some use-cases, so be sure that they're working right.

A short list, I know. But the basic firewall principle going back 20 years is the same: allow access only to those IP:port combinations you want to permit, deny everything else.

share|improve this answer
    
I like short lists :-) The main point I take away from here is that there are no fundamental changes in security (policy). At least as long as NAT is an "implementation detail" ;-) –  David Schmitt May 25 '11 at 9:32
    
Nothing fundamentally changed about security, that is right. But do not use NAT with IPv6, even if your routing devices can do that - it's ugly. It has been ugly (but unfortunately necessary) for IPv4, it stays ugly (but absolutely superfluous) for IPv6. If you need a simple way to mimic the functionality security-wise, use stateful filtering allowing only "outbound" connections instead. –  the-wabbit May 25 '11 at 10:12

If your rules hitherto consisted of "only traffic initiated internally" (NAT) with some exceptions for published services (port forwarding), you can stick to that and simply transfer it to IPv6.

You will have additional implications with the tunneling and encryption capabilities that come with v6 which you will want to address, but in general, everything that applied to v4 does still apply to v6. Recommended reading: Building Internet Firewalls (Zwicky, Cooper, Chapman).

share|improve this answer
    
+1 for an interesting reference book. –  David Schmitt May 25 '11 at 9:34

In addition to the answers here, you should check out RFC 4890 which outlines a lot of the information you need to understand about ICMP6 through firewalls. Also see Google's IPv6 Info Center

share|improve this answer
    
Very nice. Now I have something to read for the weekend ;-) –  David Schmitt May 27 '11 at 9:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.