justbits
More fiber than ATT can handle
Premium
join:2003-01-08
Chicago, IL
 ·AT&T Midwest
| reply to eyetack
Re: IPv6 Consumer Routers ?
You're ignoring some important functions of IPv6. A link-local IPv6 address can be used to isolate IPv6 packets from being routed to the Internet. All IPv6 capable network interfaces automatically configure themselves with a IPv6 link-local address by default.
An IPv6 capable thermostat does not need to listen to IPv6 router advertisements and could ignore any site-local IPv6 configuration. If the IPv6 thermostat you buy does listen to IPv6 router advertisements, well the device manufacturer is supposed to provide a way to control access to the device (firewall, authentication).
Think of it like this: a device obtaining a link-local address can talk to other hosts that are on the same LAN (think Zeroconf, link-local IPv4 addresses like 169.x.x.x). A device configured to use site-local addresses would be using an IPv4 private-network (192.168.x.x, 10.x.x.x, 172.blah) similar address.
IPv6 devices are not required to listen to or participate in router advertisements. If a device ignores router advertisements and only deals with link-local addresses, that device would effectively be isolated on your home network. Someone would need to hack into a link-local interface on your router to get at your link-local thermostat.
So, if you really have to web surf from your IPv6 compatible fridge or your toaster, go ahead and buy one that listens to router advertisments. If you think you can't trust that IPv6 toaster or IPv6 fridge, then, yes, the weakest link in your security is your toaster or fridge. And again, it's up to the network admin or the customer to know what security policy they need and what security policy the device implements.
Yes, I agree that consumer routers are deficient by not providing good GUIs for firewalling IPv6, but with IPv6, it's not a requirement that a router protect every device on the network. 2^64 or even 2^48 is a lot of address space to protect! Sure, it would be a nice added value feature to be able to easily firewall new IPv6 hosts, but I'm saying it isn't a necessity if the IPv6 capable device just doesn't obtain an Internet routable IPv6 address in the first place. |
