MS IPv6 Blog: Hi, I am Christian Huitema, Distinguished Engineer in Windows, and the author of the Teredo protocol specification RFC 4380. For those who don’t know what Teredo is, Teredo provides IPv6 access in environments otherwise limited to IPv4 and NAT. It enables application developers to deal with NAT traversal by simply using IPv6, instead of relying on a variety of proxying and tunneling techniques. Recently I have seen and heard some commentary on the security implications of using Teredo and I would like to address some concerns being discussed.

In Windows Vista, we implemented Teredo responsibly, using the principle of “least exposure”. Teredo connectivity is not turned on before an application has been specifically authorized to use it. When it is turned on, its connectivity services are limited to these authorized applications, and not usable by other applications that may be resident on the same PC. If Windows Vista detects that it is connected to an enterprise network, Teredo will not be turned on by default, even if some applications are authorized. With these precautions, I believe that Windows Vista is adopting the right security posture. In Windows Vista, Teredo provides controlled connectivity in unmanaged networks, without creating risks for enterprises networks.