REDDIT 原始帖子
IPV6 DNS Poisoning Mitigation in Windows Environment?
I have seen people suggesting the fix is to disable IPV6 on the NICs. Doesn’t that put Windows in an unsupported state and potentially break functionality even if you don’t actively use IPV6 networking in your environment?
I have seen people suggesting the fix is to disable IPV6 on the NICs. Doesn’t that put Windows in an unsupported state and potentially break functionality even if you don’t actively use IPV6 networking in your environment?
已收录讨论
I just did exactly that in my environment. Management also wanted DHCPv6 blocked on the LAN which was implemented at the firewalls by policy rule.
You forgot to say that Microsoft, a billion dollar company, has never tested not using IPV6 and wierd things might happen, because they never tested it.
Microsoft, a billion dollar company Trillion. Multiple trillion, actually. One of the few members of the $4t club. A $4 trillion dollar company and they can't even alphabetically sort their fucking sidebars in the admin portals. I'm not surprised they don't test network stuff.
If you’re security conscious, CIS controls for Windows includes disabling IPv6. If you’re not actively using IPv6, turn it off.
https://www.reddit.com/r/ipv6/s/bu9nNc6cWw
18.6.19.2.1 Disable IPv6 (Ensure TCPIP6 Parameter 'DisabledComponents' is set to '0xff (255)') Sign up for a free account and download whichever Windows flavor your environment is currently running. https://www.cisecurity.org/cis-benchmarks
I have seen people suggesting the fix is to disable IPV6 on the NICs. Go ahead and refer those people to r/ShittySysadmin Anyway, disabling IPv6 on Windows NICs is usually not the recommended fix. Even Microsoft has advised against casually disabling IPv6 because Windows components may depend on it, even in environments that primarily use IPv4. For IPv6 DNS poisoning issues, the better approach is to address the actual attack vector: rogue router advertisements, unauthorized DHCPv6, or untrusted DNS servers. Use network controls such as RA Guard, switch protections, firewall rules, and proper DNS management instead.
What type of firewall rules? Windows Firewall or network firewalls? A Windows firewall setting to disable accessing any IPV6 DNS?
This is the way.
I don‘t see any such CIS control.
We used GPO to set it to prefer IPv4 over 6 rather than disable. We did a couple other things but I cannot find the blog article. This is the doc for prefer over 6 https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows
Assuming you're not using IPv6..... Enable DHCPv6 Guard or RA Guard on your switches. Disable. Disable A & AAAA simultaneous queries.... Set windows clients to prefer IPv4....
Our security team doesn't like IPv6 being used on our servers and prefers it disabled.
Just disable llmnr and dhcpv6 if you aren't using it. Disabling IPv6 is a terrible idea and hasn't been recommended for years.
DNSSEC is a thing, has been for a long time. Enable DNSSEC on DNS servers, and reasonably control who/what updates DNS. DNSSEC highly well solves the issue of DNS hijacking and spoofing and the like, and has for a very long time. Also highly backwards compatible, so enabling DNSSEC cost you about nothing.