IPv6 Security — Why You Already Have IPv6 Even If You Did Not Notice

Last updated: May 1, 2026

A common Indian enterprise misconception in 2026: “we run only IPv4.” You almost certainly do not. Windows, macOS, Linux, Android, and iOS all enable IPv6 by default; on any LAN segment with a router advertising IPv6, your hosts auto-configure global IPv6 addresses without anyone touching them. Your IPv4-only firewall and IPv4-only IDS now cover half your traffic, with IPv6 as a parallel path attackers love. This module brings you up to speed.

IPv6 addressing — the parts you must know

128-bit addresses, written as eight 16-bit hex groups: 2001:0db8:85a3:0000:0000:8a2e:0370:7334; abbreviated by zero-collapsing (2001:db8:85a3::8a2e:370:7334). Address types: Link-local (fe80::/10) — required, every IPv6-enabled interface has one, never routed off the link. Unique Local Address (ULA, fc00::/7) — IPv6’s answer to RFC 1918, routable within an organisation, not on the public internet. Global Unicast (2000::/3) — public, routable, attackers can reach it from the internet. Multicast (ff00::/8) replaces broadcast — IPv6 has no broadcast at all. The most important multicast addresses: ff02::1 (all nodes), ff02::2 (all routers), ff02::1:ffXX:XXXX (solicited-node, used for ND). Memorise these — they appear in every IPv6 capture.

SLAAC — the auto-config that nobody asked for

Stateless Address Auto-Configuration: a router on the link sends Router Advertisements (RAs) announcing prefixes; hosts append their own interface identifier (originally EUI-64 from MAC, modern OSes use random/temporary addresses for privacy) and have a global IPv6 address — no DHCP required. The implication: plug a hostile router into your LAN, and every host will auto-configure to use it as gateway. This is the IPv6 equivalent of rogue DHCP, but it works without DHCP. The defence is RA Guard on managed switches: only allow RAs from designated trusted ports. Without RA Guard, an attacker on any LAN port can become the gateway for the entire segment. Many real-world Indian enterprise audits we run find IPv6 enabled, RA Guard not configured, and a clear unmonitored attack path.

Neighbor Discovery — IPv6's ARP replacement and its attack surface

NDP (RFC 4861) replaces ARP with five message types: Router Solicitation, Router Advertisement, Neighbor Solicitation, Neighbor Advertisement, Redirect. Like ARP, none of it is authenticated by default. Attacks: NDP spoofing (claim a target IP’s MAC), RA flooding (overwhelm hosts with thousands of distinct prefixes — historic Windows / Linux DoS), Redirect injection (announce a better route via attacker), DAD spoofing (DoS new hosts by claiming their tentative address). Defences: ND Inspection / RA Guard on switches; static neighbor entries on critical hosts; SeND (Secure Neighbor Discovery, RFC 3971) is the cryptographically-signed alternative but virtually unused in practice. The pragmatic baseline is RA Guard + DHCPv6 Snooping + ICMPv6 ACLs that limit what redirect/RA traffic can reach hosts.

Address scanning — why /64 changes the attacker math

In IPv4, an attacker scans a /24 (256 addresses) in milliseconds. In IPv6, the standard subnet size is /64 — 18 quintillion addresses. Brute-force scanning is infeasible.

This sounds like security through obscurity, but it is notattackers find IPv6 hosts via DNS (every important host has a AAAA record), via the same multicast (ff02::1 reaches every host on the link), and via leaked addresses in mail headers, server logs, certificate transparency logs. The address space is huge but the actual occupied addresses are findable.

The real defence pointSLAAC originally used MAC-derived addresses (EUI-64), making host tracking trivial across networks. RFC 4941 / 7217 introduced privacy addresses and stable opaque interface identifiers; modern OSes use them by default. For server hosts, prefer DHCPv6 with policy assignment so addresses are predictable and audit-friendly.

Dual-stack — the worst of both worlds, the present reality

Dual-stack runs IPv4 and IPv6 simultaneously, each with its own routing, ACLs, firewall, monitoring. This is the default for every operating system in 2026 and almost every Indian ISP-provided uplink. The security risk: configurations diverge. Your IPv4 firewall has 4,000 rules; your IPv6 firewall has 12 placeholder rules from when someone enabled IPv6 in 2019 and never followed up. Hosts that IPv4-ACL says are unreachable are wide open via IPv6. The Tier-1 audit checklist:

IPv6-only and NAT64 — where things are heading

Mobile carriers (Jio, Airtel in India; T-Mobile in US) increasingly run IPv6-only inside their network and use NAT64/DNS64 to translate to IPv4-only legacy services. Apple has required IPv6 support for App Store apps since 2016 — meaning enterprise apps must be tested over IPv6-only paths.

Implications for securityclient-side IPv6-only is the future; servers must publish AAAA records; legacy IPv4-only services rely on NAT64, where the address translation logs are crucial for forensics. Pure IPv6 simplifies things in some ways (no NAT, end-to-end visibility) and complicates others (every host has many addresses; tracking a “user” by IP is harder). The transition is happening; ignoring it costs you more every year.

IPv6 firewall rules — the patterns that survive

Build IPv6 rules around the same zone-based design as IPv4 (M5). Specific to IPv6:

Building an IPv6-aware monitoring stack

Ensure each piece of your visibility stack handles IPv6:

IPv6 deployment in Indian enterprises — the typical maturity ladder

Maturity stages we observe in Indian audits:

Stage 0IPv4-only intent; IPv6 silently enabled on hosts but no infrastructure. Hosts use SLAAC against a non-existent router or self-assign link-local only. Risk: low at the perimeter (no IPv6 routes to internet); high on the LAN (rogue RA attack lands instantly).

Stage 1ISP-provided IPv6 active; internet edge has IPv6 routes; IPv4-only firewall rules. Risk: high — entire IPv6 attack surface is unfiltered.

Stage 2Dual-stack with parallel IPv6 ACLs that mirror IPv4. Risk: medium — divergence over time as rules drift.

Stage 3Dual-stack with rule parity enforced by tooling (firewall management platform validates parity); IPv6 monitoring fully equivalent. Risk: low.

Stage 4IPv6-only or IPv6-preferred internal segments with NAT64 for legacy IPv4. Risk: low; future-proofed. Most Indian enterprises in 2026 are at Stage 1 or 2; the path to Stage 3 is policy + automation, not technology.

A practical IPv6 audit you can run in two hours

Two-hour IPv6 audit any practitioner can perform on their network:

IPv6-only labs — a quick exercise to build intuition

Spin up two Linux VMs on a private network, disable IPv4 explicitly (ip addr flush and remove default route), and try to make them communicate. The exercise forces you to confront ND, link-local addresses, and IPv6 routing without IPv4 fallback. Then add a third VM as router (advertises a /64 prefix via radvd with SLAAC) and watch the others auto-configure. Add NAT64 (with a tool like tayga or jool) and reach an IPv4-only website from your IPv6-only VM. By the end of an afternoon you understand IPv6 in a way that no amount of reading produces. Use this lab to test firewall rules, RA Guard behaviour, and any new IPv6-relevant tooling before you push to production.

For Indian engineersthis kind of structured hands-on time is a competitive advantage — most teams have only theoretical IPv6 exposure, so the practitioner with lab time stands out.

Diagrams

  fe80::/10       Link-local       (every interface, never routed)
  fc00::/7        ULA              (org-internal, RFC 1918 analogue)
  2000::/3        Global unicast   (public, routed on internet)
  ff00::/8        Multicast        (replaces broadcast)
    ff02::1         all nodes on the link
    ff02::2         all routers on the link
    ff02::1:ffXX    solicited-node (used by NDP)
  ::/128          unspecified      (think 0.0.0.0)
  ::1/128         loopback         (think 127.0.0.1)

Host                                          Router on link
  | -- Router Solicitation (ff02::2)  ----------> |
  |                                               |
  | <- Router Advertisement (prefix=2001:db8::/64)|
  |    + flags + lifetime                          |
  |                                               |
 Host computes own address:
   prefix:host-part = 2001:db8::ab12:3456:7890:cdef
  |                                               |
  | -- Neighbor Solicitation (DAD on tentative) ->|
  |   (no response → address is unique → host)    |
  |                                               |
  Host configures address + default route via the RA source.

References & deeper reading

• RFC 8200 — IPv6 (current)
• RFC 4861 — Neighbor Discovery for IPv6
• RFC 4941 — IPv6 Privacy Extensions
• RFC 6164 — IPv6 /127 prefix length
• NIST SP 800-119 (IPv6 deployment)
• Cisco IPv6 First-Hop Security
• NIXI — Indian IPv6 deployment

FAQ

Should I just disable IPv6 and avoid the problem?

Tempting, but disabling IPv6 on Windows is officially unsupported by Microsoft and breaks several services (notably HomeGroup, Direct Access, parts of Hyper-V). On Linux, you can disable per-interface, but you lose IPv6-only connectivity to mobile and modern cloud services. The right answer in 2026 is to operate IPv6 properly, not pretend it does not exist.

My ISP gave me a /48 — is that normal?

For business connectivity, yes; consumer typically gets /56 or /64. The /48 gives you 65,536 /64 subnets — enough for any enterprise, ever. Plan address space hierarchically: /48 globally, /56 per site, /64 per VLAN. Do not be parsimonious; IPv6 was designed for abundance.

Is there an IPv6 equivalent of NAT?

NAT66 exists but is discouraged. The IPv6 design philosophy is end-to-end addressing; the security boundary is the firewall, not the address translator. Use ULA + perimeter firewall for “private but no internet exposure” patterns. NAT64 is a translation between IPv6 and IPv4, used at the dual-stack edge of mobile carriers.

Does my SIEM understand IPv6?

It should. Verify by ingesting a known-IPv6 source (router log, DNS log, Wi-Fi controller) and checking the parser identifies the address fields correctly. Many enterprise SIEM rules were written against IPv4 patterns and silently miss IPv6 addresses; review your top 20 rules and update.

What about IPv6 in cloud?

AWS, Azure, GCP all support dual-stack VPCs / VNets and increasingly IPv6-only subnets. Security Groups apply to both stacks; NACLs apply to both; flow logs capture both. The same audit checklist applies: verify rules cover both protocol families.

How do I find every IPv6 address on my network?

Active scan: nmap -6 --script targets-ipv6-multicast-echo,targets-ipv6-multicast-mld -e eth0 ::1/128 finds responsive multicast members. Passive: capture for an hour and grep for IPv6 addresses; correlate with DHCP/SLAAC sources. Most enterprise inventory tools (Lansweeper, Tenable, Qualys) discover IPv6 if they were installed after 2019.

Are IPv6 ULAs a good idea?

Yes for “private but routable internally” — direct analogue to RFC 1918 in IPv4. Use fd00::/8 with a randomly-generated 40-bit Global ID to avoid conflicts in mergers. Combine with a perimeter firewall that blocks ULA at the egress boundary.

⚖️ Legal: Use any techniques described here only on networks you own or have explicit written authorisation to test. In India, unauthorised access is punishable under IT Act §66 (up to 3 years + fine). Pair offensive testing with a signed Statement of Work / Rules of Engagement; pair forensic activity with §65B-aligned chain of custody.