Blocking Teredo

Teredo is intended to be a consumer technology and has generally not been recommended for enterprises because Teredo requires the edge device to allow all outbound UDP traffic. For example, because of security reasons, many enterprise administrators do not want client computers on the corporate network to be directly accessible from the Internet, and in that case turning off Teredo is a good idea. If administrators want to disable Teredo on their client computers or simply prevent it from working, they can do so in one of three ways:

• Block all outbound UDP traffic by default. (This is the only reliable "external" method.)
• Block name resolution of the Teredo DNS host name, which by default on computers running Windows 7 is teredo.ipv6.microsoft.com. (This method, however, leaves an easy workaround, because the user can hard-code IP addresses.)
• Use Group Policy or a script to create the following DWORD registry value, which turns off Teredo on targeted computers running Windows 7. (This registry setting is not exposed by default in Group Policy but can be pushed down using a custom ADMX file.)
  HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents
  You can specify the following settings for this value:
  • 0x10 Setting this value will disable Teredo only on the computer.
  • 0x01 Setting this value will disable all tunnel interfaces on the computer.

If administrators want to support only native IPv6 in their networks or if they don't want to support any IPv6 traffic until they deploy native IPv6, they can choose to turn off all tunneling technologies using the second choice in the preceding list.