63

Of course, I realize the need to go to IPv6 out on the open Internet since we are running out of addresses, but I really don't understand why there is any need to use it on an internal network. I have done zero with IPv6, so I also wonder: Won't modern firewalls do NAT between internal IPv4 addresses, and external IPv6 addresses?

I was just wondering since I have seen so many people struggling with IPv6 questions here, and wonder why bother?

14 Answers 14

59

There is no NAT for IPv6 (as you think of NAT anyway). NAT was an $EXPLETIVE temporary solution to IPv4 running out of addresses (a problem which didn't actually exist, and was solved before NAT was ever necessary, but history is 20/20). It adds nothing but complexity and would do little except cause headaches in IPv6 (we have so many IPv6 Address we unabashedly waste them). NAT66 does exist, and is meant to reduce the number of IPv6 addresses used by each host (it's normal for IPv6 hosts to have multiple addresses, IPv6 is somewhat different than IPv4 in many ways, this is one).

The Internet was supposed to be end-to-end routable, that is part of the reason IPv4 in invented and why it gained acceptance. That is not to say that all address on the Internet were supposed to be reachable. NAT breaks both. Firewalls add layers of security by breaking reachability, but normally that it's at the expense of routability.

You will want IPv6 in your networks as there is no way to specify an IPv6 endpoint with a IPv4 address. The other way around does work, which enables IPv6-only networks using DNS64 and NAT64 to access the IPv4 Internet still. It's actually possible today to ditch IPv4 all together, though it's a bit of hassle setting it up. It would be possible to proxy from IPv4 internal addresses to IPv6 servers. Adding and configuring a proxy server adds configuration, hardware, and maintenance costs to the network; usually much more than simply enabling IPv6.

NAT causes it's own problems too. The Router has to be capable of coordinating every connection running through it, keeping track of endpoints, ports, timeouts, and more. All that traffic is being funneled through that single point usually. Though it's possible to build redundant NAT routers, the technology is massively complex and generally expensive. Redundant simple routers are easy and cheap (comparatively). Also, to re-establish some of the routability, forwarding and translating rules have to be established on the NAT system. This still breaks protocols which embed IP addresses, such as SIP. UPNP, STUN, and other protocols were invented to help with this problem too - more complexity, more maintenance, more that could go wrong.

21
  • 30
    The router the NAT was running on is what separated the networks, that router will still separate the networks, nothing has changed except the router has to be programmed correctly for IPv6. Routable yes, not necessarily reachable (firewall rules will likely block most traffic).
    – Chris S
    May 26, 2011 at 19:26
  • 13
    @Tomtom: Anyone who thinks they need it doesn't know they need a firewall instead. There is literally no problem that NAT is the best solution for, other than problems caused by scarcity of addressing. There is no scarcity of addressing in IPv6 (yet!). It might well be in development, but that doesn't mean it's not a stupid idea :)
    – growse
    May 26, 2011 at 21:32
  • 15
    I know this will sound offensive, so I'm apologizing up front, but if you aren't the cook stay out of the kitchen. People understand if they work on their own car they might break something that causes a world of damage... Same goes for computer security, if you don't know how, you'll likely end up doing more harm than good. You do have a point, that NAT makes some levels of security easier (most notably and almost exclusively that your internal network isn't Internet routable). Even on most NAT routers today this is only a default setting, and the "security" provided by NAT can be disabled.
    – Chris S
    May 27, 2011 at 3:23
  • 10
    Lets not start bandying around words like 'SECURITY' without a sensible discussion about vulnerabilities and threats. What specific vulnerability does NAT protect? What specific 'attacks' are you talking about? Are they the same attacks that the rest of the professional world mitigates with a stateful firewall? If so, NAT's not really buying you much.
    – growse
    Feb 15, 2013 at 14:29
  • 7
    Why is my device's IP address a secret? Why does it need to be hidden? What security risk do I run by having my IP address public?
    – growse
    Feb 16, 2013 at 0:28
24

Running out of internal (rfc1918) ipv4 addresses can also be a very valid reason to go ipv6.

Comcast explained at Nanog37 why they were going ipv6 for their management addresses.

20 Million video customer
x 2.5 STB/customer
x 2 ip addresses/STB
--------------------  
= 100 Millions IP addresses

And this is only for video, not data/modems.

They exhausted the RFC1918 pools in 2005. Then they used public addresses pools (as nat isn't an option for management), and went ipv6 to solve their needs.

4
  • 3
    What about the non-mega corporations?
    – Cypher
    May 26, 2011 at 20:55
  • 1
    well, there is still all other answers ;)
    – petrus
    May 26, 2011 at 23:17
  • I don't think that any corporation is going use more than 16,777,216 INTERNALLY...Sure, externally for their customers. Nobody disputes that we need more public IP addresses.
    – KCotreau
    May 26, 2011 at 23:18
  • 6
    I wasn't talking about the public/wan ip address of a router, but the management ip addresses on a cable modem or set-top box. So yes, Comcast and all large cable providers do need more than 2^24 ip @.
    – petrus
    May 26, 2011 at 23:27
15

Couple of reasons:

  • IPv6 doesn't support broadcasting. It is replaced with multicasting. Broadcasting enables one node to send traffic to all nodes on a subnet. Management of broadcast domains is a major issue with keeping large IPv4 networks running fast and smoothly. Multicasting requires that nodes that want to receive "broadcast"-style actually "sign-up" for it, so the network isn't flooded with traffic that hits all hosts.

  • IPv6 supports IPsec style encryption natively.

  • IPv6 supports autoconfiguration. It's possible for hosts behind a router to configure themselves without the need for DHCP, although you still need a DHCP server to hand out DHCP options such as DNS server, TFTP server, etc.

3
  • 3
    IPv6 allows renumbering of an entire subnet with almost no complication. It also allows merging of subnets. It has incredibly granular control over multicast traffic... there are even more reasons but its been forever since I took my IPv6 course.
    – Matthew
    May 26, 2011 at 20:43
  • 4
    These are all popular myths, here's the bit more info: IPv6's multicasting is mandatory for basic functionality: for example to do a IPv4's ping broadcast equivallent you ping6 to FF02::1 for all regular nodes, and FF02::2 for all routers. IPv6's IPSec does not change ANYTHING from IPv4. You don't get any security for free. Still gotta configure all the modes, and deal with key distribution. IPv6's autoconfiguration is utter junk; by default it's as insecure as MAC<->IPv4, and it does NOT hand out DNS. If you want DNS you gotta install DHCPv6, so no gain there.
    – Marcin
    Jun 15, 2011 at 3:18
  • 1
    I consider the 3rd point a weakness of ip6. How many times have you checked to see whether a machine had received an IP as part of the troubleshooting process? That part just got more difficult.
    – Joel Coel
    Jun 20, 2011 at 23:41
14

My old job, at a large University, would use an IPv6 allocation internally. They were assigned an IPv4 /16 back in the day and even today is passing out IPv4 addresses to nearly every internal client. The RFC1918 networks were restricted to the telecom-only network and certain specialized usages (the PCI standards required RFC1918 usage until October 2010).

Because of this, they were actively planning to use IPv6 internally as well. There were some hardware issues still to work out, the edge switches weren't supporting v6 well enough, but the core was ready. The idea was that getting v6 support at the publicly visible end (okay, the publicly responsive end) of the network would involve 70% of the work to deploy it to everyone, may as well do the extra 30% and go end-to-end with it.

Having lived with a public IP allocation for so long, our people were very aware of the adage: "just because it is public, does not mean it is reachable." As Chris S said, routeable does not imply reachable.

That is why at least one class of organization would deploy IPv6 internally: because they're already using non-RFC1918 IPv4 internally.

11

Working for a small company I can only think of reasons NOT to use IPv6.

  • We don't even have an IPv6 public address, so why on Earth would we run it internally?
  • We would have to replace our firewall, which I love dearly, as it doesn't (yet) support IPv6
  • We don't have a way to assign, let alone control, IPv6 addresses
  • Only half of our PCs supports IPv6
  • None of our manufacturing plant supports IPv6
  • Our switches don't support IPv6
  • I've never even seen a printer that supports IPv6
  • IPv6 is much harder to use from the command line - pretty important point for me
  • I would need to get fully up to speed on IPv6 - hard to do when I'm uninterested
  • ... and a whole lot of other reasons I can't think of just now

It just doesn't make sense for a company like ours to make the change, as it would take considerable expense and effort with absolutely nothing to gain from it.

Quite frankly, I like NAT and the benefits we get from dealing with local addresses. If it ever becomes necessary (as opposed to being a geek want-to-do) for us to interact with IPv6 on the Internet we'll do so at the gateway.

I'm not expecting this current IPv6 fad to become a necessity for the very vast majority of the world, internally at least, for a decade or more. As I expect to be retired by then there's not a whole lot of incentive for me personally to waste time and effort on it.

Edit:

I'm getting downvotes but not a single logical and sensible opposing view. Makes me think it's just a bunch of bandwagon jumping geeks who want to follow the trend without thinking about it. There has to be a REASON to make such a drastic change to a network and I don't have one. Further, I strongly suspect only a very few SF users do have one.

8
  • 3
    1. ask your ISP for an allocation.. Unlike IPv4, you can't just request a block. you have to have the ability to use up X amount of them within 6 months.
    – Brian
    Jun 15, 2011 at 5:31
  • 2
    3. you assign by setting up your router with a IPv6 address, and let the machines autoconfigure themselves. (or setup Dhcp6)
    – Brian
    Jun 15, 2011 at 5:31
  • 5
    4. Windows XP SP2 supports IPv6. 6. Switches don't talk IP. They talk layer 2. they work fine with Ipv6 I have run Ipv6 over some 2001 3com switches. You might need to support ipv4 still to get to the management of some of them.. Any HP printer with a jetdirect card sold in the last 5 years (or is it more) support IPv6
    – Brian
    Jun 15, 2011 at 5:34
  • 1
    @Brian, no point having IPv6 coming in of our firewall can't talk it. As for the other points, there's nothing there that gives me any reason to implement IPv6, which is really the whole point - I have no reason to run IPv6 but plenty of reasons not to. If most people were honest with themselves they would have to admit the same. Jun 15, 2011 at 7:54
  • 2
    "Our switches don't support IPv6". Not a problem. "I've never even seen a printer that supports IPv6" I do, it is 6 years old and sitting next to me. (A cheap Dell laser). "I would need to get fully up to speed on IPv6 - hard to do when I'm uninterested" Aye. Here I agree. Learning something new is hard. But being the only one which understands it (and you will need it in a few years) is quite an advantage.
    – Hennes
    Feb 16, 2013 at 0:39
7

IPv6 does offer some potential real-world improvements over IPv4, such as a simpler auto-configuration and auto-discovery mechanism, it's also safer in the sense that it becomes unfeasible for malware to replicate across a network by port-scanning an IP range -- there are just too many IPs. But those improvements aren't particularly dramatic, and certainly not worth the switching cost.

But note that it's not an either/or decision, you can run both in parallel, and if you develop software, you probably should, as many people have mentioned, for testing purposes. There's no reliable way to make a program IPv6-compatible without having an internal IPv6 infrastructure to test on. Most modern OSes will set up an internal IPv6 network automatically between them -- it's just a matter of using it.

10 years ago I built a bit of software for an employer customers use to fetch program updates. When building the network component, I had to decide between building in IPv6 compatibility, or just assuming all IP addresses will be 4 bytes. I decided to take the simple route, saving myself about 4 hours of work, and made the application IPv4-only. I figured it would be replaced in a few years anyway. They're still using it today, and are therefore locked out of some smaller markets.

6

We are talking two things here - running internal network on pure IPv6 or running IPv4/IPv6 dual-stack. I think it is premature to talk about running pure IPv6 - on many operating systems it is even impossible using IPv6 without IPv4. However, you may consider running dual-stack for the following reasons (a) if you develop software (b) in order to prepare your network for inevitable migration to IPv6. If you situation is A then you should act now, if it is B then by my estimate you have about 1-2 years to think about it (but the sooner you start the more prepared you will be).

My situation is A and we are running dual-stack for 6 month now. During this time we identified and solved some issues with our public/private DNS, address allocation, DHCP, routing, firewalling and we could not even anticipate many of these issues without trying. Now, we are fully IPv6 ready and we even have IPv6 public access via tunneling. From my experience I can say with confidence that IPv6 is much simpler and more elegant solution in comparison to ageing IPv4, so I'll be very happy when time comes to switch to IPv6, but before this time comes - dual-stack is the way to go.

4

Aside from lager address space, absence of broadcast, IPSec and simpler auto-configuration there are some "not so known" advantages of IPv6:

  1. Bigger address space means that address has more bits that can be used as data storage. For example hop-count between two nodes then can be a function of their IPv6 addresses e.g.:
    IPv6 address can be in format PREFIX:Country&Region:DC&Line:Rack&Unit:VM&ID so closer nodes will have more Most-Significant-Bits same. This is just an example, of course "closeness" metrics could be stored in some kind of external database like DNS TXT|SRV records.

  2. There are some techniques of using address space of IPv6 for cryptographic purposes such as Cryptographically Generated Addresses (CGA) and SEND (SEcure Neighbor Discovery)

  3. When IPv6 is enabled all nodes in network have link-local IPv6 address(if not configured otherwise). So there is a chance that you can access even mis-configured node.

  4. You can get nodes' MAC addresses directly from link-local IPv6 address (if IPv6 privacy extensions are not configured)

  5. There is no way you can possibly use IPv4 in subnets with thousands of nodes - your network will be overloaded with broadcast traffic (e.g. ARP).

  6. You can query node for additional information using node information, e.g. in BSD you can query host for ICMPv6 Node Information Node Addresses:

$ ping6 -a Aacgsl ::1

PING6(72=40+8+24 bytes) ::1 --> ::1
136 bytes from ::1: 
  fe80::beae:c5ff:fe43:44a(TTL=infty)
  fe80::beae:c5ff:fe43:212(TTL=infty)
  ::1(TTL=infty)
  fe80::1(TTL=infty)
  2a02::9222(TTL=infty)
2

I can think of two reasons to use IPv6 for an internal host.

  1. You may find in the future that this host now needs to be externally available at least on certain ports.

  2. You may find that this host needs to connect to another host who has also chosen the same internal address. For example you need to connect to 10.0.0.5 at Acme corporation and your own address at Emca corporation is also 10.0.0.5. I remember this happening at a previous job, we had both used the same internal addresses.

I would say that in the modern world most computers are not 100% internal. Most desktops can make some limited connections to the outside world or vice versa.

1

The only good reason to go IPv6 internally is to be ready when the world switches to IPv6, and I think that's a pretty bad reason, given the rate of adoption. Since most internal IPs won't be externally reachable, it wouldn't be a big deal to translate the rest.

My corporation will probably never switch to IPv6 internally. It would require a fundamental shift in policy so massive I can't honestly conceive how it could come about. A lot of people would have to get killed, and a lot of inexplicable hiring choices would have to be made. Likewise, any attempt by individual business units to switch to IPv6 on their LANs would be squashed with prejudice by the corporate networking overlords based on interoperability and maintainablity concerns (we allow a lot of leeway locally, but not that much.)

Basically, if switching to IPv6 was painless, we'd have done it years ago.

17
  • 16
    "My corporation will probably never switch to IPv6 internally." <- that's a pretty bold and perhaps naive statement IMHO.
    – EEAA
    May 26, 2011 at 20:00
  • 4
    @erika: They will when it becomes difficult to get hardware that supports IPv4. Until then, no. There is no business case for it. They'd be more likely to ditch internal networking entirely, and host their entire business in the cloud somewhere. May 26, 2011 at 20:05
  • 3
    What happens when Google or some other external service drops support for IPv4. Not being able to connect to people outside of your network will be a problem in the future.
    – Zoredache
    May 26, 2011 at 20:40
  • 3
    @zoredache: We're talking internal support here. Even now, it's not hard to bridge IPv4 to IPv6, as long as you don't need every machine to be available externally. Hell, our current hardware supports that. May 26, 2011 at 20:44
  • 2
    Remember that all windows boxes since vista run dual stack out of the box. There is no reason NOT to let it stay on as implemented
    – Jim B
    May 26, 2011 at 21:39
0

IPv4 was intended that every device be directly on the Internet...until we ran out of address space. Then, we've spent the last 20 years locking it all down. Now, IPv6 by design wants to, once again, place every device directly on the Internet... the outcome will be the same. I totally agree that NAT is one layer of security that is not going to be abandoned without an equally effective, or better, replacement.

4
  • 1
    Like a firewall? Mar 2, 2016 at 1:21
  • 3
    NAT is not security. A firewall is what gives you security, not NAT. Firewalls don't need NAT. Both IPv4 and IPv6 firewalls work perfectly well without enabling NAT, you can enable NAT on a router which doesn't firewall, and firewalls don't even need to route. You can't seem to look pat the all-in-one consumer devices. It is often convenient to NAT, route, and firewall in a single device, but they are separate functions.
    – Ron Maupin
    Mar 2, 2016 at 1:53
  • 2
    Why do people still say things like this? NAT is not even a layer of security, and it wasn't designed to be one. It's just an ugly hack around inadequately long addresses. It's not an obstacle to most attackers. Downvoting because it's wrong and doesn't answer the question. Mar 2, 2016 at 1:56
  • that post make me smile ;-) at first, then I thought, both thoughts are right - 1.) "the outcome will be the same." if we think long term, like countable number of years ahead for humanity. 2) "not going to be abandoned without an equally effective, or better, replacement." - again correct, the replacement is here already, but the point is correct. Dec 18, 2019 at 10:37
-3

Unfortunately, there is a lot of bad information in the vast majority of these answers and comments. It is so sad to see the blind leading the blind on this in such a prolific way.

NAT is not going anywhere and people that tell you "Oh, that NAT, what a terrible thing it is"..."Oh that NAT, it was nothing but a work around"...ad nasueum If they start using language like that, move on to a real professional network architect for advice, not a weekend networking armchair warrior.

Do you need to load balance traffic to internal servers from the Internet? Well guess what, with IPv6 you can't do it the way you have been doing it....unless you use NAT!

Yes, it is true. Some will say, oh you just use DSR/Direct server return load balancing. But they forget to tell you that you have to give up 1) Cookie insertion 2) Application acceleration 3) Port address translation

So if you want to run your internal servers on port 8080 but your external on port 80...Oh, so sad, no can do with IPv6....unless you are using good ole NAT! Not even with DSR.

Then add to that the "boasting" that people say "Oh, yeah all the IPv6 NAT proposals have failed...thank goodness" (and the empire dies to the sound of applause) You know what that means? NAT is going to be terrible, if it even works at all with IPv6, because all the IPv6 zealots are in denial about the need for NAT/PAT intrinsically and the people doing it are doing it reluctantly. So sad, so poorly managed

So what do you do now that the truth has set you free and you can rise above the throngs of lemmings trying to use scare tactics to force your compliance?

You buy or continue to use a Loadbalancer or Firewall that acts as the public/private broder of your network. Public side interfaces host the same VIPs you already have but with a complimenting IPv6 address if you need it. Everything north of the Loadbalancer/Firewall layer is also dual stack IPv4/IPv6. On the inside interfaces of the Loadbalancer/Firewall they are all IPv4 and your entire internal network is IPv4 and it stays that way as long as you like. It is only your business. The Loadbalancer does NAT/PAT between outside and inside...because it already is and needs to for full featured load balancing and because now it also solves your external IPv6 problem.

Oh and to the sarcastic person who asked "What single security purpose does NAT serve"

Security is about Availability at the most fundamental level. Think about it, before you dismiss it.

Load balancers provide that Availability/Security and you HAVE to use NAT/PAT to do it properly regardless of the version of IP you are using.

Citation regarding DSR fail: https://devcentral.f5.com/articles/the-disadvantages-of-dsr-direct-server-return

k thnx

1
  • 2
    I think your answer is trying to say that one needs NAT to have a nontrivial load balancer, but that is obviously not the case and does not address the question... Mar 5, 2016 at 10:38
-4

It is not a very good idea to use IPv6 on an internal network as many legacy devices would fail to communicate. Old copier / multifunction printers, medical equipment, old printing machines, older servers and network devices. The IPv4 scheme is much easier to manage imo.

-12

The accepted answer is misleading

Chris S concepts on NAT are way wrong; one of the best features of NAT besides the artificial expansion of IPv4 schema is SECURITY. NAT is the layer that hides the real IP of a host that if directly connected to Internet can be the target of all the imaginable attacks. Happily talking about getting rid of NAT without encouraging extra security measures is just plain ignorance on the topic.

1
  • 5
    How exactly is NAT a security layer?
    – MDMarra
    Mar 30, 2013 at 9:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .