IPv6 and accidentally exposed services
IPv4 NAT may hide a service while public IPv6 reaches it directly. Audit DNS, listening sockets and firewall policy for both families.
An IPv6 host normally receives a globally routable address without NAT. That is not a flaw, but it means the firewall—not an incidental IPv4 router behaviour—provides protection.
A process bound to :: can also accept IPv4 on some systems, while a stale AAAA record may send users to a server you no longer operate.
Start with DNS and routing
Inspect AAAA records for the domain and subdomains, the default route and global interface addresses. Remove records without an active monitored service.
- Compare local and public resolvers.
- Test from a network with native IPv6.
- Do not assume a CDN proxies every protocol or port.
Listeners and firewall
List processes bound to 0.0.0.0 and ::, then review nftables/ip6tables rules. IPv4 policy does not necessarily cover IPv6 automatically.
Testing and monitoring
Scan both addresses externally, monitor the hostname certificate and record DNS changes. Remove stale AAAA records and rules after migration.
- Test TCP and relevant UDP services.
- Do not treat missing ICMPv6 replies as proof of isolation.
- Keep the ICMPv6 types required for correct networking.
Dual-stack review
- Every AAAA record has an owner.
- Firewall policy covers IPv4 and IPv6.
- Processes do not bind to :: by accident.
- Both families were tested externally.
Put it into practice
Scan IPv4 or IPv6
Select the address family and compare public exposure for the same host.
Scan IPv4 or IPv6Frequently asked questions
Does one configuration fit every environment?
No. Inventory traffic, dependencies and the threat model first, then tighten controls. Verify each change externally and keep a rollback plan.
Where should I start?
Start with a tested backup, current patches and a smaller public attack surface. Then add monitoring and document an owner for every service.
How often should I repeat the review?
After every infrastructure or major-version change and at least quarterly. Monitor critical dependencies, certificates and backup outcomes continuously.