NAT isn't security
The most common reaction to enabling any form of IPv6 on your network is turning it on, seeing your device has a routable IP, and then ignoring it from there. A small voice probably asks if everything on your network is now accessible by anyone from the outside.
But.. it didn't, understanding why takes a bit of unlearning with the idioisms of IPv4. The thing that protected you from that was never really for that.
We've been here before?
A globally routable address on a home computer isn't new territory. It's how the internet started for most of (however, not me, I'm a zoomer).
In the dial-up days, your modem spoke PPP over the phone line to the ISP, and the public address on the other end of that call belonged to your computer.
Not to a router, because there wasn't one. A different address on each call, sure, but real and reachable just as if your computer was a router. The funniest part of that is that Microsoft didn't enable the firewall by default until Windows XP SP2 in 2004.
Early broadband kept a similar arrangement with the modem bridging straight into the PC's network card but the connection never hung up (PPPoE instead of straight PPP). The combination public (and predictable) addressing, no filtering, and always-on are what allowed the Blaster worm to destroy the internet in 2003.
The incident seems to be a big part of why people think NAT is a security-first protocol.
Home routers went mainstream in a similar period bought mostly so another computer can share the same broadband service. Primarily people were buying them so multiple devices could share the internet, but an unintentional effect was a deny inbound ruleset by default. NAT collected the credit for this and now over 20 years later people are nervous to allow devices to route straight to the internet.
The difference this time is that there is a stateful firewall in front of it.
NAT wasn't a security feature
As I said above, NAT isn't a security feature. It was a stop gap to allow RIR's to hold onto some more addresses and to slow the bleed of IPv4 assignments.
The world (IANA) globally ran out of more IPv4 addresses on 31 January 2011. APNIC (my home RIR) was the first one to run out. LACNIC, ARIN, and then AFRINIC were the first to run out, with RIPE running out nearly 8 years later.
On the technical level, think of NAT as a recepionist. When you make a connection outside, they note it down and then put it through to the phone on your desk. But when a random person rings through asking for nobody in particular, they can't connect them anywhere.
That was the protection NAT gave. Unsolicited traffic gets dropped because the router had nowhere to send it. It feels like a firewall, but it was a side effect of emergent bookkeeping.
The real security was hiding in plain sight the whole time, the connection table. It tracks the connections that were started from the inside and only lets maching return traffic come back. This is known as stateful filtering and it's the thing actually doing the grunt work for IPv6. It's keeping the table but throwing away the receptionist.
Routable but not reachable!?
Bit of a shift in thinking here. An addres means a packet can find it's way to your router; your firewall will still decide whether it gets through. Your house has a street address that means anyone in the world can write on an envelope, and that has never once meant a stranger can come through your door. Addressability and access mean different things, NAT bundled them together very tightly for over 20 years (RFC 2663).
A sane router should ship with defaults that look like this:
- Allow anything outbound
- Allow inbound traffic that belongs to a connection a device made on the inside (most call this 'established' and 'related')
- Drop all non-solicited
Read it again. Sound like NAT? It's what the connection tracking was doing, without rewriting all of your packets. If someone on the internet sends through a packet to your laptop, all it's going to do is reach your router, see nothing in the state table, and it'll get dropped. Just as it would on NAT.
With IPv4, you ask 'which ports do I need to forward and to where?', under IPv6 you instead need to be asking 'what traffic in, and from where', same way you would for your internal traffic.
Nothing gets translated, which also means that the traffic that leaves your edge is the same packet that reaches the other end.
ICMPv6 isn't the same as ICMP for IPv4
A big habbit of network engineers and system administrators is to block ICMP from the edge because it feels like a recon tool. Putting aside the technical issues I'll talk to soon, there's no issues with this in IPv6. With the amount of addresses possible in even a /64 prefix, it isn't worth worrying about.
Protocol wise, it will break quite a few things. To start, ARP isn't a thing in IPv6, it was replaced with NDP, this is essentially an ICMPv6 message.
ICMPv6 Message Types [1]
Router Solicitation (RS, ICMPv6 type 133)
Sent by hosts to request immediate Router Advertisements from routers. Destination: FF02::2 (all-routers multicast).
Router Advertisement (RA, ICMPv6 type 134)
Sent by routers periodically or in response to RS. Contains prefixes, MTU, and configuration flags (M/O bits for DHCPv6). Destination: FF02::1 (all-nodes multicast).
Neighbor Solicitation (NS, ICMPv6 type 135)
Used for IPv6-to-MAC resolution, reachability checks, and Duplicate Address Detection (DAD). Sent to a solicited-node multicast address derived from the target IPv6.
Neighbor Advertisement (NA, ICMPv6 type 136)
Response to NS or to announce link-layer changes. Usually unicast to the requester.
Redirect (ICMPv6 type 137)
Sent by routers to inform hosts of a better next-hop for a destination.
It's still a net gain
An explicit firewall is auditable in a way NAT never could be. Want to know what's exposed on your network, read the inbound rules and that is your entire answer. Under IPv4, that has been smeared across port forwarding, helper modules, and whatever your Xbox 360 decided to open up back in 2011 via UPnP. We've let vulnerable devices punch holes in the firewall for far too long using NAT and we called it normal.
IPv6 gives you back the internet the way it was supposed to be, with a proper size that is designed for everyone to have multiple individual devices..