IPv6 Tunneling and Misconfiguration

Detects network configurations that fail to apply security controls to IPv6, allowing bypass via IPv6 tunneling.

zakirkun Updated

File contents

IPv6 Tunneling and Misconfiguration

Overview

Security controls applied only to IPv4 can be bypassed via IPv6:

  • Firewalls blocking IPv4 but allowing all IPv6
  • SSRF filters blocking 127.0.0.1 but not ::1 (IPv6 loopback)
  • Rate limiters keyed on IPv4 that miss IPv6 addresses
  • DNS rebinding via IPv6 link-local addresses

Remediation

  • Apply identical security rules to IPv4 and IPv6
  • Block ::1 and IPv6 link-local ranges in SSRF filters
  • Test security controls explicitly with IPv6 addresses

zakirkun/ice-tea/tree/main/skills/network/ipv6-tunneling commit 27bb89a50b

Frequently asked questions

npx skillmds@latest add zakirkun/ipv6-tunneling-and-misconfiguration