With the global IPv4 address pool completely exhausted,the large-scale deployment of IPv6 has become an irreversible trend.IPv6 is not simply about"longer addresses";it differs fundamentally from IPv4 in protocol design,address structure,and security scale,leading to differences in firewall configuration.

In the IPv4 era,NAT(Network Address Translation)technology acted as a"hidden firewall"to some extent,isolating internal networks from the public internet.However,the core concept of IPv6 is"end-to-end communication,"where each device can have a globally unique public IPv6 address,meaning devices are directly exposed to the public network.Firewalls are no longer merely"access control"tools but assume the core responsibility of being the"first line of defense"for network security.

This article will systematically outline the core differences in IPv4 and IPv6 firewall configuration,provide practical guidelines for mainstream operating systems,and explore security policy design in a dual-stack environment,helping readers build a secure,stable,and scalable next-generation network firewall architecture.

Core Differences Between IPv4 and IPv6 Firewalls

Address Structure and Rule Expression IPv4 addresses are 32 bits,typically represented in dotted decimal notation(e.g.,`192.168.1.1`);IPv6 addresses are 128 bits,represented in colon-separated hexadecimal notation(e.g.,`2001:db8::1`).This difference is directly reflected in firewall rule writing:

-IPv4 rules:Matching based on 32-bit addresses and subnet masks.

-IPv6 rules:Matching based on 128-bit addresses and prefix length,supporting more flexible address aggregation and segmentation.

ICMP's"Role Upgrade"

In IPv4,ICMP is often considered an"optional auxiliary protocol,"and many administrators choose to block ICMP outright for security reasons.However,in IPv6,ICMPv6 is a core protocol for normal network operation—NDP(Neighbor Discovery Protocol)relies on ICMPv6 to complete critical functions such as router discovery,address resolution,and redirection.

Therefore,IPv6 firewalls cannot simply block all ICMPv6;they must selectively allow necessary ICMPv6 types(such as types 133-137),otherwise network malfunctions will occur.

The Absence of NAT and Security Model Restructuring

In IPv4 networks,NAT naturally hides the internal topology,making it difficult for external attackers to directly locate internal hosts.IPv6 abandons NAT,emphasizing end-to-end transparent communication,requiring firewalls to shift from"NAT-based passive protection"to"policy-based active protection."

This means:all inbound traffic requires explicit allowance rules;auditing and control of outbound traffic becomes more important;and stateful inspection becomes a standard capability.

IPv6 Firewall Configuration Practices on Mainstream Operating Systems

Linux Systems:iptables and ip6tables

The Linux kernel supports packet filtering for both IPv4 and IPv6 through the Netfilter framework.IPv4 uses the`iptables`command,while IPv6 uses the separate`ip6tables`command.

Basic configuration examples(allowing HTTP/HTTPS traffic):

Allow inbound HTTP traffic(port 80)for IPv6

ip6tables-A INPUT-p tcp--dport 80-j ACCEPT

Allow inbound HTTPS traffic(port 443)for IPv6

ip6tables-A INPUT-p tcp--dport 443-j ACCEPT

Allow necessary ICMPv6(do not block all)

ip6tables-A INPUT-p icmpv6-j ACCEPT

Allow access from specific IPv6 addresses:

ip6tables-A INPUT-s 2001:db8::/32-j ACCEPT

Set the default denial policy:

ip6tables-P INPUT DROP

ip6tables-P FORWARD DROP

Persist with rules(retain after reboot):

apt install iptables-persistent

netfilter-persistent Save

Configuration files are typically stored in`/etc/sysconfig/ip6tables`(CentOS/RHEL)or managed via`iptables-persistent`(Debian/Ubuntu).

UFW(Uncomplicated Firewall)is a more user-friendly front-end tool for Debian/Ubuntu systems.Its rules apply to both IPv4 and IPv6 by default(i.e.,"dual-stack"mode).Before enabling it,you need to ensure that`IPv6=yes`is set in`/etc/default/ufw`.

Windows Systems:Advanced Security Firewall

Windows Defender firewall natively supports IPv6.Rule configuration can be done through a graphical interface or PowerShell.

Adding IPv6 rules via PowerShell:

Allow inbound SSH(port 22)from a specific IPv6 subnet

New-NetFirewallRule

-Name"Allow-SSH-From-IPv6-Subnet"

-DisplayName"Allow SSH from 2001:db8::/32"

-Direction Inbound

-Protocol TCP

-LocalPort 22

-RemoteAddress"2001:db8::/32"

-Action Allow

-Enabled True

Blocking a specific IPv6 address

New-NetFirewallRule

-Name"Block-IPv6-Address"

-DisplayName"Block 2001:db8::bad:actor"

-Direction Inbound

-RemoteAddress"2001:db8::bad:ac70"-Action Block

-Enabled True

Allows necessary ICMPv6 types

New-NetFirewallRule

-Name"Allow-ICMPv6-Essential"

-DisplayName"Allow Essential ICMPv6"

-Direction Inbound

-Protocol ICMPv6

-IcmpType 133,134,135,136,137

-Action Allow

-Enabled True

Configure via graphical interface:

1.Open"Windows Firewall with Advanced Security"(run`wf.msc`)

2.Select"Inbound Rules"or"Outbound Rules"

3.Click"New Rule"→Select"Custom"

4.In the"Protocols and Ports"step,select"IPv6"as the protocol type

5.Configure the remote IP address in the"Scope"step

via netsh command(traditional method):

cmd

netsh advfirewall firewall add rule name="Allow IPv6 HTTPS"protocol=TCP dir=in localport=443 remoteip=::/0 action=allow

The evolution from IPv4 to IPv6 represents a profound change in network architecture concepts and security models.Firewall configuration logic must be upgraded accordingly—shifting from"passive hiding relying on NAT"to"policy-based proactive defense."