Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 25 replies
  • Subscribers 29 subscribers
  • Views 5720 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is IPv6 actually desirable? (rfcat_vk)

Wayne Folta

I've tried to follow rfcat_vk's excellent documentation of the current state of IPv6 in SFOS. And I've been feeling like I'm missing out that my ISP doesn't offer IPv6 (they've said "coming soon" for a year now, maybe more). But the more I look into it, the less benefit I see. I almost don't want it to drop at this point.

It avoids NAT, but NAT doesn't really slow things down and the only IPv4 workaround I'm familiar with that I need is SIP ALG (which in SOFOS appears to work well). With most all critical communications using TLS, it doesn't seem like IPv6 actually adds much for security. In fact, it seems like a security wash in some ways with ICMP becoming so critical to IPv6 working.

It provides a little tracking advantage with the ability to have different, changing IP addresses for each machine that communicates with the outside world. Which is cool.

But at a minimum, I'd have to run the XGS in dual-stack mode indefinitely. For example, I have a VPN and I may need to reach it from an area or an ISP that doesn't provide IPv6, so I'll need IPv4 for that pretty much until IPv4 is turned off in the Western Hemisphere.

My ISP will benefit from IPv6: smaller routing tables, etc. But it really doesn't feel like I have any real draw to get IPv6. An advantage here and there, a new adventure, but pretty much completely balanced out by disadvantages.

What am I not seeing? (Besides my ISP getting IPv6 and setting a deadline after which it won't support IPv4.)

Thanks!



This thread was automatically locked due to age.

Top Replies

  • +1 verified

    Hi Wayne,

    I am not an expert on IPv6.

    The following are my observations as a home user and experimenter. IPv6 has built-in security which IP4 does not have (a search is required for specifics). Your ISP does not need to run CGNAT when using IPv6. My mobile phone provider has migrated to IPv6 only within its network and uses translators (whatever) to provide IP4 traffic to the greater world.

    IPv6 NAT appears to be used when the firewall device does not fully support IPv6 features, compare the UTM with XG for example. Using your example of the VPN, if you have an external address (DNS) then the protocol should be hidden from your user and selected by the connections setup software. When your ISP/RSP moves to tIPv6 only traffic and you are in an IP4 only network then I would expect that your ISP/RSP would have translation gateway into their IPv6 network.

    IPv6 was not designed with a NAT function, this was only added after to accommodate the lazy companies. You can accomodate both NAT and none Nat'ed traffic on your firewall. I haven't worked out how to setup hairpin in IPv6 because I don't have the ability to not use NAT.

    Ian

    Looking at IPv6 from an administrator's point of view, security requirement is a lot more work in configuration and management because your devices end up with at least two real addresses and a link local address unless you use static addressing. User management then comes into play to control access to the internet and application type filtering.

    Jump to answer
Parents
  • 0

    I'm also interested to see if anyone suggests something compelling that I've 'missed'

    I still see it as primarily a solution to deal with running out of IPv4 addresses. I just want to be able to switch over 'overnight' from IPv4 to IPv6 and not have to mess around with supporting a dual environment but so much is clearly not ready.

    i sometimes enjoy playing with the bleeding edge of technology. This is one area where I'll stay well clear until I'm forced to or all the players have their act together.

  • 0 in reply to JasP

    I don't think there's anything compelling unless you're in the middle ground of having a home lab with multiple servers of the same kind (say multiple web servers) that you want to expose to the outside world individually. If you move up a level, you could combine all of them behind something like nginx (I think) and still just DNAT port 80. But if they need to be separately accessible, IPv6 lets you expose all of them and then allow port 80 through to all of them.

    Otherwise, I don't see any advantages for us end users. I think at least some of the advantages years ago have been overcome by circumstances and are no longer straight-up advantages.

    Also, having a dual stack is not much more complicated than IPv6-only or IPv4-only, if at all. So basically, if my ISP goes IPv6-only or dual-stack, I'll follow their lead. (I figure a couple of key places I'd like to VPN back into the Sophos will be late in the switch to IPv6, so somebody, somewhere's gotta bridge the gap -- whether it's dual-stack or some kind of CGNAT-ish thing or whatever.

Reply
  • 0 in reply to JasP

    I don't think there's anything compelling unless you're in the middle ground of having a home lab with multiple servers of the same kind (say multiple web servers) that you want to expose to the outside world individually. If you move up a level, you could combine all of them behind something like nginx (I think) and still just DNAT port 80. But if they need to be separately accessible, IPv6 lets you expose all of them and then allow port 80 through to all of them.

    Otherwise, I don't see any advantages for us end users. I think at least some of the advantages years ago have been overcome by circumstances and are no longer straight-up advantages.

    Also, having a dual stack is not much more complicated than IPv6-only or IPv4-only, if at all. So basically, if my ISP goes IPv6-only or dual-stack, I'll follow their lead. (I figure a couple of key places I'd like to VPN back into the Sophos will be late in the switch to IPv6, so somebody, somewhere's gotta bridge the gap -- whether it's dual-stack or some kind of CGNAT-ish thing or whatever.

Children
No Data