There have been many, many words written about the IPv4-to-IPv6 transition — probably around 340 undecillion words at this point — but perhaps my favorite words came in a recent Slashdot comment by AliasMarlowe:
I believe in the incremental approach to updates; it’s so much safer and usually easier.
So it’s going to be IPv5 for me, while you suckers make a mess of IPv6!
I’ve long been a fan of IPv6. Deploying IPv6 has the obvious benefit of solving the IPv4 address exhaustion problem, as well as making it easier to do local subnetting, and site network architecture, and to some degree internet-scale routing.
But perhaps the greatest benefit of deploying IPv6 is the restoration of end-to-end transparency. IPv6 obviates the need for network address translation (NAT). With IPv6, when your Skype application wants to initiate a call to my Skype application, the apps can address each other directly without relying on hole punching, third-party relaying, or other “clever” NAT-circumvention techniques.
(End-to-end addressing may sound unimportant, but if we could restore this critical Internet design goal to practice then we could party like it’s 1979!)
I recently spoke with some of TCS’s computer network operations students about security considerations for IPv6 deployments. They were surprised when I claimed that NAT is not needed in an IPv6 security plan; several students commented that the NAT on their home network router was the only thing protecting their computers from the evils of the Internet.
A common misperception! There are generally two functions performed by your home network router (or your corporate upstream router, if so configured):
- Firewalling / stateful packet inspection. This is a security function.
- IP masquerading / network address [and port] translation. This is not a security function; it simply allows all the devices on your internal network to share a single external network (IP) address.
With IPv6 you can (and should) still deploy inline firewall appliances to perform function #1. But with the plethora of available addresses in IPv6 — 18,446,744,073,709,551,616 globally routable addresses per standard local subnet — there is no overt need for masquerading.
Of course, masquerading provides ancillary benefits: It somewhat hinders external traffic analysis, such as network mapping, by obfuscating the internal source and destination of traffic. Combining masquerading with private IPv4 addressing also prevents internal addresses from being externally routable.
But similar benefits can be realized in IPv6 without masquerading and therefore without losing the benefits of end-to-end transparency. For example IPv6 privacy extensions can obfuscate your internal network architecture and IPv6 unique local addresses can be used to isolate systems that shouldn’t be visible on external networks.