3 ms·

Stupid question: Just in case you want some nets to not be globally routeable, you guys are aware of the Unique Local Addressing block?

buffoon 11y ago
Yes aware of that. There are some gotchas with that, particularly address space collision between two sites with a tunnel between them. I've never seen one in v6 but one of our clients had a 10.0.0.0/8 and so did we and I don't want to get into that state of affairs again. I'd only use that for totally airgapped networks.
- simoncion 11y ago
  There's a mechanism for randomly generating a /48 with a low probability of collision. [0] SixXS maintains a list of "allocated" prefixes, [1][2] but who knows how complete it is? Edit: Also, you might be interested in reading about the NETMAP iptables/ip6tables target. See iptables-extensions(8) for more info. [0] https://tools.ietf.org/html/rfc4193#section-3.2 https://tools.ietf.org/html/rfc4193#section-3.2 [1] https://www.sixxs.net/tools/grh/ula/ https://www.sixxs.net/tools/grh/ula/ [2] https://www.sixxs.net/tools/grh/ula/list/ https://www.sixxs.net/tools/grh/ula/list/
  - sanderjd 11y ago
    You seem to know a lot about this so I thought I'd ask: is there a good book getting into this level of detail about IPv6?
    - simoncion 11y ago
      I'm sure that such a book exists, but I have no idea what it is. I've picked up what I know by reading RFCs, Wikipedia pages, and the like and experimenting on my LAN. It's been quite some time, and the details are hazy, but I remember the process of getting a tunnelbroker.net tunnel configured, and the subsequent (totally optional) series of knowledge tests required to unblock IRC over the tunnel taught me a fair bit about IPv6 and some about (reverse DNS? forward DNS?) glue records. Figuring out the meaning of all of the options available in an radvd config file was also rather educational. (20->40% of the educational value was in reading about things that were tangentially related to whatever the radvd configuration item was.)
aexaey 11y ago
You can make a non-routable subnet if you need one by configuring a firewall/access list. Pretty much any router can do that. Plus you get way better granularity in controlling access - office-local subnet, DC-local, branch-local, country-local, whatever-local access - unlike venerable RFC1918. But never use non-globally-unique addresses as other commentators suggest with wonky probabilistic allocations. There is absolutely zero benefits for that, and it will inevitably end up to be a huge PITA down the line. IPv6 used to have 6-to-6 NAT and site-local addresses, but sanity won, and both were dropped from the current slew of RFCs.
- simoncion 11y ago
  Sure, you can go to all that hassle. Or, you can use RFC4193 (AKA ULA) space, which allocates a /48 and is designed to be non-routable, unless an admin chooses to make it routable. RFC4193 specifies a prefix generation method and lays out the probability of collision. If you join two networks together, you've a (1.81x10^-10)% chance of prefix collision. If you join ten-thousand networks together, you have a 0.0045% chance of collision. [0] If my math is right [1], this means that you'd need to join 2,500,000 networks [2] together to have a 1% chance of a prefix collision. I am squarely in the "If there's a chance that it can happen, it will happen." camp. However, I'm rather okay with those odds. [0] Either my figures are right here, or you need to take those percentages and divide them by 1000 to arrive at the correct figure. [1] And it may not be right! [2] Networks -each with its own /48- as opposed to hosts.
  - aexaey 11y ago
    Collision probability is indeed low if you'll assume perfectly generated prefixes, and even in an unlikely case of /48 collision, those themselves would be pretty sparse, so again assuming perfectly random distribution, chance of collision of say fifty /64s on one side with the same amount from the other network is still pretty low. But bigger point here is that often you will need external connectivity for those ULAs, similar to what everybody used to do in IPv4 world (i.e. NAPT, a.k.a. "nat overload" a.k.a. "IP masquerade"), and that is not something that is available, really. Instead, IPv6 offers prefix translation (a.k.a NPTv6, see RFC6296). So effectively that means that: - for each LAN segment (i.e. /64) you have to have a "private /64" and a "public /64" (or same at coarser granularity up to /49 or even more). Twice the number of networks to configure and keep track of; - "NAT as a security measure" argument flies out of the window, as NPTv6 is stateless. In other words, you get all the hassle of IPv4 NAPT with none of its (meagre) benefits.

buffoon 11y ago

Yes aware of that. There are some gotchas with that, particularly address space collision between two sites with a tunnel between them. I've never seen one in v6 but one of our clients had a 10.0.0.0/8 and so did we and I don't want to get into that state of affairs again. I'd only use that for totally airgapped networks.

simoncion 11y ago
There's a mechanism for randomly generating a /48 with a low probability of collision. [0] SixXS maintains a list of "allocated" prefixes, [1][2] but who knows how complete it is? Edit: Also, you might be interested in reading about the NETMAP iptables/ip6tables target. See iptables-extensions(8) for more info. [0] https://tools.ietf.org/html/rfc4193#section-3.2 https://tools.ietf.org/html/rfc4193#section-3.2 [1] https://www.sixxs.net/tools/grh/ula/ https://www.sixxs.net/tools/grh/ula/ [2] https://www.sixxs.net/tools/grh/ula/list/ https://www.sixxs.net/tools/grh/ula/list/
- sanderjd 11y ago
  You seem to know a lot about this so I thought I'd ask: is there a good book getting into this level of detail about IPv6?
  - simoncion 11y ago
    I'm sure that such a book exists, but I have no idea what it is. I've picked up what I know by reading RFCs, Wikipedia pages, and the like and experimenting on my LAN. It's been quite some time, and the details are hazy, but I remember the process of getting a tunnelbroker.net tunnel configured, and the subsequent (totally optional) series of knowledge tests required to unblock IRC over the tunnel taught me a fair bit about IPv6 and some about (reverse DNS? forward DNS?) glue records. Figuring out the meaning of all of the options available in an radvd config file was also rather educational. (20->40% of the educational value was in reading about things that were tangentially related to whatever the radvd configuration item was.)

aexaey 11y ago

You can make a non-routable subnet if you need one by configuring a firewall/access list. Pretty much any router can do that. Plus you get way better granularity in controlling access - office-local subnet, DC-local, branch-local, country-local, whatever-local access - unlike venerable RFC1918. But never use non-globally-unique addresses as other commentators suggest with wonky probabilistic allocations. There is absolutely zero benefits for that, and it will inevitably end up to be a huge PITA down the line. IPv6 used to have 6-to-6 NAT and site-local addresses, but sanity won, and both were dropped from the current slew of RFCs.

simoncion 11y ago
Sure, you can go to all that hassle. Or, you can use RFC4193 (AKA ULA) space, which allocates a /48 and is designed to be non-routable, unless an admin chooses to make it routable. RFC4193 specifies a prefix generation method and lays out the probability of collision. If you join two networks together, you've a (1.81x10^-10)% chance of prefix collision. If you join ten-thousand networks together, you have a 0.0045% chance of collision. [0] If my math is right [1], this means that you'd need to join 2,500,000 networks [2] together to have a 1% chance of a prefix collision. I am squarely in the "If there's a chance that it can happen, it will happen." camp. However, I'm rather okay with those odds. [0] Either my figures are right here, or you need to take those percentages and divide them by 1000 to arrive at the correct figure. [1] And it may not be right! [2] Networks -each with its own /48- as opposed to hosts.
- aexaey 11y ago
  Collision probability is indeed low if you'll assume perfectly generated prefixes, and even in an unlikely case of /48 collision, those themselves would be pretty sparse, so again assuming perfectly random distribution, chance of collision of say fifty /64s on one side with the same amount from the other network is still pretty low. But bigger point here is that often you will need external connectivity for those ULAs, similar to what everybody used to do in IPv4 world (i.e. NAPT, a.k.a. "nat overload" a.k.a. "IP masquerade"), and that is not something that is available, really. Instead, IPv6 offers prefix translation (a.k.a NPTv6, see RFC6296). So effectively that means that: - for each LAN segment (i.e. /64) you have to have a "private /64" and a "public /64" (or same at coarser granularity up to /49 or even more). Twice the number of networks to configure and keep track of; - "NAT as a security measure" argument flies out of the window, as NPTv6 is stateless. In other words, you get all the hassle of IPv4 NAPT with none of its (meagre) benefits.