Will the network equipment work with IPv6

ipipv6networking

As Steve Gibson said in last "security now" podcast, almost all current network equipment is not working with IPv6 packets for now. Is that really the case ?

Edit from initial post: Hub and switches are working on level 2 and so, not concerned.

If so, do you think manufacturer (like Cisco, Netgears, 3Com and so on) will release firmware update to upgrade them to fix that issue ?
Or will they tell us to buy new stuff ?

Also, by the way, as IPv6 are much bigger than IPv4 address, will upgraded network equipment performance be much slower than with IPv4 (because addresses cache will contains less IPv6 address than IPv4 ones, and cos more processing power will surely be necessary to process packet) ?

I know IPv6 is not really needed inside a LAN today (because NAT is working great) but I would have your opinions on that subject.

Best Answer

Lots of current service provider/enterprise routers support IPv6. This is somewhat misleading though; while most equipment you buy today will support IPv6, large swathes of the Internet is built on hardware that dates from several years ago, back when IPv6 support (particularly in hardware) was not a priority. Also, IPv6 implementations in consumer routers are still in their infancy.

In terms of firmware upgrades for existing kit; lots of equipment is built with hardware designed for the efficient forwarding of IPv4 packets, with 32-bit addresses. It's not really feasible to upgrade these types of devices to be IPv6 compatible. For CPU based platforms, with no specific packet forwarding hardware, a firmware upgrade is possible. However, as you have pointed out, given the size of IPv6 addresses, older devices will most likely lack the memory/cache to perform well in an IPv6 environment. (Although with the reduced NAT requirement in IPv6, a large chunk of memory is freed up for use).

Also, have a look at this question, regarding how much IPv6 is really in use today.

Related Solutions

Barriers to IPv6 deployment: addressing

Here are things I've noticed after working with IPv6 addresses:

Don't use "full" addresses. The :: abbreviation goes a long way.
Inside your organization you'll probably deal with a single prefix. This means you can all but ignore the first part of the address.
Unless you're using glass teletypes copy and paste exists. Use it.
As @TomTom points out, DNS exists. Use it.
When you start working with v6 addresses patterns will quickly emerge. You start to recognize things like organizational prefixes (HE, Cisco, etc), Teredo, ISATAP, and stateless autoconfiguration.

IPv6 address don't have to be complex. For example, this is the address of a large company's public web server:

2001:420:80:1::5

I'm assuming the "80" is a subnet reserved for web servers. Unlike IPv4 you could also use the subnet "443" for HTTPS-only servers.

Linux – NATing IPv4 while routing IPv6

you can achieve that with proxy ARP, if I was trying to pseudo bridge ipv4 I would do this:

echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp
echo 1 > /proc/sys/net/ipv4/ip_forward

You need to setup both your NICs with the EXACT same information (ip_address, netmask and gateway), not sure if DD-WRT will allow that, for sure it won't on the web ui but it might allow you to do this from the console, then recheck your gateway, make sure you only have gateway pointed to the interface that goes to the ISP, something like this:

ip route del default dev eth0
ip route del default dev eth1

ip route del $LAN_NETWORK dev eth0
ip route del $LAN_NETWORK dev eth1
ip route add $DEFAULT_GATEWAY dev eth0
ip route add $LAN_NETWORK dev eth1

ip route add default via $DEFAULT_GATEWAY dev eth0

This is for an IPv4 Pseudo Bridge using Proxy-ARP, I guess you can do the same using IPv6.

On the other hand and as I said on the other question, you can still NAT IPv4 even if it's bridged in layer 2.

You would need to setup both your IPv4 public address and IPv4 lan address on the BR0 interface, and then NAT them as I told you before

iptables -t nat -A POSTROUTING -j SNAT -s $LAN_NETWORK --to-source $WAN_IP_ADDRESS

That would solve both your problems without the hassle of proxy arp. Problem is most of this stuff won't work from DD-WRT's interface.

As a better and cleaner alternative you might add a subinterface on the bridge to the LAN side, something like

ifconfig br0:1 192.168.1.1 netmask 255.255.255.0

And use the same NAT line I said above

Best Answer

Related Solutions

Barriers to IPv6 deployment: addressing

Linux – NATing IPv4 while routing IPv6

Related Topic