Unit 2: Addresses and subnets · Lesson 6 of 7 · 20 min

IPv6 blind spots

Find the database port that is closed on IPv4 and open on IPv6, and the laptop handing out its own IPv6 router.

mission

You are
The analyst checking whether IPv6 is filtered as carefully as IPv4.
Situation
Every modern laptop and server speaks IPv6 by default, even when the team only planned for IPv4. db01's firewall was written last year and a capture from the server network is in ipv6.pcap.
Goal
Find what IPv6 can reach that IPv4 cannot, and any device acting as an IPv6 router that should not.
Hand in
The exposed port, the rule that misses it, and the rogue router's host name.

Two doors into the same server

  1. laptop-rpatelhas 10.10.0.57 and 2001:db8:10::57
  2. IPv4 to db01:3306dropped by table ip filter
  3. IPv6 to db01:3306no IPv6 rules at all
  4. db01MySQL answers on both
01

Read db01's firewall family

nftables tables have a family. ip covers IPv4 only, ip6 IPv6 only, and inet both.

analyst@net-lab
head -n 1 db01-rules.nft
table ip filter {
grep -c ip6 db01-rules.nft
0

you should see The rules live in an IPv4-only table and nothing mentions IPv6.

02

Compare the two attempts

Same laptop, same server, same port, two address families.

analyst@net-lab
tshark -r ipv6.pcap -Y ip -T fields -e ip.src -e ip.dst -e tcp.dstport
10.10.0.57	10.20.0.12	3306
tshark -r ipv6.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==1' -T fields -e ipv6.src -e ipv6.dst -e tcp.srcport
2001:db8:20::12	2001:db8:10::57	3306

you should see The IPv4 attempt gets no answer. Over IPv6, db01 answers on 3306.

03

List the routers on the segment

Hosts learn their IPv6 router from router advertisements (ICMPv6 type 134). Anyone on the segment can send one.

analyst@net-lab
tshark -r ipv6.pcap -Y 'icmpv6.type == 134' -T fields -e eth.src -e ipv6.src -e icmpv6.opt.prefix
02:42:0a:0a:00:01	fe80::42:aff:fe0a:1	2001:db8:10::
02:42:0a:0a:00:3e	fe80::42:aff:fe0a:3e	2001:db8:66::
02:42:0a:0a:00:01	fe80::42:aff:fe0a:1	2001:db8:10::
02:42:0a:0a:00:3e	fe80::42:aff:fe0a:3e	2001:db8:66::

you should see Two routers advertise. One uses the gateway's MAC, the other a laptop's MAC with a different prefix.

04

Name the rogue router

Match the MAC address against DHCP leases.

analyst@net-lab
grep 0a:00:3e dhcp-leases.txt
1760436610 02:42:0a:0a:00:3e 10.10.0.62 laptop-osaid 01:02:42:0a:0a:00:3e

you should see laptop-osaid is advertising itself as a router. That can be misconfigured sharing software or someone positioning to intercept traffic.

defender tip Turn on RA Guard on access switch ports, so only uplinks may send router advertisements.

db01's rules

IPv4 only
table ip filter {
  ... tcp dport 3306 from web01 ...
}

IPv6 traffic never meets these rules.

Both families
table inet filter {
  ip saddr 10.20.0.11 tcp dport 3306 accept
  ip6 saddr 2001:db8:20::11 tcp dport 3306 accept
}

One table, one policy, both address families.

What a defender takes away

  1. 1If a host has an IPv6 address, your rules need to cover IPv6.
  2. 2Use inet tables so one ruleset filters both families.
  3. 3Rogue router advertisements are stopped at the switch with RA Guard.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.