0

At home I have a dual-stack IPv4/IPv6 broadband connection, and I also have a wireless access point. The access point currently bridges all traffic into my LAN, which is not segmented in any way, so all visitors that use my wireless network have the full run of my LAN.

While I certainly do not doubt my friends' good intentions I do see the possibility of their smartphones being compromised, and I'd rather not have compromised devices in my private LAN if I can help it. This, and also the fact that being in my private LAN does not gain my friends any benefits, makes me want to set up a separate wireless guest network, which I would then also use with my own smartphone.

I am currently considering opening all ports for incoming IPv6 TCP and UDP traffic for the devices in this separate guest network.

My reason for doing so is vastly improved service reliability. As a practical example, I use the Conversations XMPP chat app that does support sharing e.g. pictures, but this doesn't work very well while both me and the other person are in our respective home LANs, presumably because neither of us has any ports open (IPv6) or forwarded (IPv4) for our smartphones.

Just to verify this hypothesis I opened all IPv6 ports for my smartphone only. And voilá, sharing pictures has been working flawlessly ever since.

The general implications of opening a router's IPv6 firewall has been extensively discussed here, however I think my situation with the guest network for smartphones and other mobile devices is not quite comparable, because

  • Smartphones are designed for being directly connected to the internet any odd way, and therefore should not have problems with open IPv6 ports
  • It would only pertain to the totally separated guest network, any device in which would, from the view of a device in my LAN, just be any other device out there in the public internet

Is this sound reasoning, or is there something important I am not seeing?

eomanis
  • 1
  • 1
  • I don't know how XMPP works, but if your main concern is XMPP, why not see if there is a way to let it dynamically open ports, like with UPnP? – multithr3at3d Apr 02 '20 at 23:20
  • @multithr3at3d I was hoping I could get by without having to set up UPnP for NAT traversal seeing that the world is moving to NAT-less IPv6. Should it turn out that IPv6 isn't wide-spread enough yet, I might throw in UPnP for legacy IPv4 support, as long as I can blacklist certain ports that are in use for other things already. – eomanis Apr 03 '20 at 15:33
  • IPv6 may be NAT-less, but that certainly doesn't remove the need for stateful firewalls. Why not be safe and only open the ports you need with specific firewall rules? Pretty sure this can still be done with UPnP if not easy manually, but I'd have to do more research on that. – multithr3at3d Apr 04 '20 at 14:18
  • Ah, looks like UPnP does indeed support "firewall pinholing" for IPv6: http://upnp.org/specs/gw/UPnP-gw-WANIPv6FirewallControl-v1-Service.pdf – multithr3at3d Apr 04 '20 at 14:22

0 Answers0