4 ms·

Collision probability is indeed low if you'll assume perfectly generated prefixes, and even in an unlikely case of /48 collision, those themselves would be pret

by aexaey 11y ago

Collision probability is indeed low if you'll assume perfectly generated prefixes, and even in an unlikely case of /48 collision, those themselves would be pretty sparse, so again assuming perfectly random distribution, chance of collision of say fifty /64s on one side with the same amount from the other network is still pretty low. But bigger point here is that often you will need external connectivity for those ULAs, similar to what everybody used to do in IPv4 world (i.e. NAPT, a.k.a. "nat overload" a.k.a. "IP masquerade"), and that is not something that is available, really. Instead, IPv6 offers prefix translation (a.k.a NPTv6, see RFC6296). So effectively that means that: - for each LAN segment (i.e. /64) you have to have a "private /64" and a "public /64" (or same at coarser granularity up to /49 or even more). Twice the number of networks to configure and keep track of; - "NAT as a security measure" argument flies out of the window, as NPTv6 is stateless. In other words, you get all the hassle of IPv4 NAPT with none of its (meagre) benefits.

simoncion 11y ago
> But bigger point here is that often you will need external connectivity for those ULAs... The whole point of using ULA space is for giving IP addresses to machines that you don't expect to need to contact machines in the globally-routable IP ranges. [0] From the RFC: This document defines an IPv6 unicast address format that is globally unique and is intended for local communications, usually inside of a site. These addresses are not expected to be routable on the global Internet. If it turns out that some of those machines actually need access to globally-routable space, then advertise a globally routable prefix to those machines and either keep advertising the ULA prefix, or -yanno-, don't. :) Fixing this particular network planning error shouldn't be much harder than unsetting some firewall and/or routing rules that break Internet access for machines that have been assigned a globally-routable address. :) [0] On my LAN, I advertise a ULA prefix, as well as a globally-routable prefix. Because my globally-routable prefix is not static, [1] I use the ULA prefix as an ersatz poor-man's Provider-Independent allocation. This setup would be probably be somewhere between unreasonable and silly at a site that does have a static prefix assignment. [1] Well, it's effectively static, but I don't have an SLA, so... ;)
- voltagex_ 11y ago
  I wonder how I do this as a home user.
  - simoncion 11y ago
    I assume that you're asking "How do I advertise a ULA prefix on my LAN, as a home user?". If you're not, then the following probably won't answer your question. If you're already familiar with ULA prefix generation and IPv6 prefix advertisment, and are just trying to find out how to advertise on your home router, almost all of the following will be redundant information. (I'm happy to read the manual for your make and model of router and try to see if you can easily advertise prefixes on it. :) ) I'm not sure how much experience you have with screwing around with router settings, your level of familiarity with IP networking concepts, or even what software you're using on your router, so I'll give some background information on prefix advertisement, and describe prefix generation and how you might actually advertise a ULA prefix on a router running OpenWRT. Because the underlying software that does the work should be the same regardless of router model, reading about how it is done on OpenWRT might give you a starting point to discover how it's done -if it is at all- on your router model. I'm more than happy to clarify anything that's confusing, give additional information, or track down and read documentation for a particular router! Background information: Many routers use a piece of software called radvd to advertise IPv6 routes. Radvd -effectively- takes a list of network interfaces, each with a list of router advertisment options, and transmits advertisements on those interfaces. radvd has a config file whose syntax is documented here [0]. A minimal radvd config file would look like interface eth0 { AdvSendAdvert on; prefix ::/64 { AdvOnLink on; AdvAutonomous on; }; }; This would instruct radvd to advertise whatever prefix had been assigned to the interface named eth0 to machines attached to eth0. Note that an interface section can have multiple prefix sections. If you have a particular prefix that you want to advertise, replace "::/64" with that prefix. The overwhelming majority of options in the radvd config file are both entirely optional, and entirely unneeded in most situations. Now, I suspect that on most routers that support prefix advertisement, you'll never need to touch an radvd config file. Like I said, this is just background information. So, let's get to generating your ULA prefix: Generating your ULA prefix: Get the MAC address of a computer that you control. Go to https://www.sixxs.net/tools/grh/ula/ https://www.sixxs.net/tools/grh/ula/ and plug that MAC address into the MAC address field on the page. You'll get a value back that of the form: fdaa:aaaa:aaaa::/48 This is your ULA prefix. Advertising a /48 is kind of awkward for downstream devices. You need to carve out a /64. So, take that ULA prefix, add a colon and four zeroes to it and replace the /48 with a /64 like so: fdaa:aaaa:aaaa:0000::/64 You can now go to advertise this on your LAN. [1] Advertising the prefix: I actually have no idea what the prefix advertisement option is called on most consumer routers, or if it even exists on your router. A quick look at Belkin's and Linksys's support sites didn't turn up anything promising. I would dig around in the IPv6 settings tabs until I found something that looked promising, or had exhausted all options. [2] If you're using a recent version of OpenWRT (That is, OpenWRT Barrier Breaker or later), /etc/config/network has a ula_prefix option in the globals section that's used for exactly this. [3][4] If you're using a version of OpenWRT earlier than Barrier Breaker, you can tell radvd to advertise your ULA on your LAN interfaces. The prefix section of /etc/config/radvd is used for this. /etc/config/radvd is documented here [6]. You can have multiple prefix sections for each LAN interface. [7] Now, reload the network config (Call /etc/init.d/network with either the reload or restart option, I can't remember which.), wait for a minute or two, and machines on your LAN should have a new IPv6 address in the /64 that we carved out of the ULA. If everything's working, -optionally- register your newly-generated prefix with SixXS at the page where you generated your ULA prefix. Feel free to ask any questions that you have. :D [0] http://linux.die.net/man/5/radvd.conf http://linux.die.net/man/5/radvd.conf [1] Note that you can create 16 bits worth of networks out of your /48, not just one network. [2] If you can tell me the make and model of your router, I'd be happy to try to find and read the documentation for it. :) [3] http://wiki.openwrt.org/doc/uci/network http://wiki.openwrt.org/doc/uci/network [4] Though, to be frank, I can't remember if you plug in the /48 and it automatically creates /64s for each LAN interface that you have configured [5], or if you can only plug a single /64 into it. I would try the /48 first. [5] OpenWRT lets you set up multiple LAN interfaces. I found this useful when I was using VLANs to make isolated WiFi guest networks. [6] http://wiki.openwrt.org/doc/uci/radvd http://wiki.openwrt.org/doc/uci/radvd [7] So, if you have IPv6 service from your ISP, you can advertise the ISP-provided prefix and your ULA prefix. Have one prefix section that contains no prefix option, and a second prefix section that contains a prefix option whose value is the /64 that you created earlier.

by aexaey 11y ago

simoncion 11y ago

> But bigger point here is that often you will need external connectivity for those ULAs... The whole point of using ULA space is for giving IP addresses to machines that you don't expect to need to contact machines in the globally-routable IP ranges. [0] From the RFC: This document defines an IPv6 unicast address format that is globally unique and is intended for local communications, usually inside of a site. These addresses are not expected to be routable on the global Internet. If it turns out that some of those machines actually need access to globally-routable space, then advertise a globally routable prefix to those machines and either keep advertising the ULA prefix, or -yanno-, don't. :) Fixing this particular network planning error shouldn't be much harder than unsetting some firewall and/or routing rules that break Internet access for machines that have been assigned a globally-routable address. :) [0] On my LAN, I advertise a ULA prefix, as well as a globally-routable prefix. Because my globally-routable prefix is not static, [1] I use the ULA prefix as an ersatz poor-man's Provider-Independent allocation. This setup would be probably be somewhere between unreasonable and silly at a site that does have a static prefix assignment. [1] Well, it's effectively static, but I don't have an SLA, so... ;)

voltagex_ 11y ago
I wonder how I do this as a home user.
- simoncion 11y ago
  I assume that you're asking "How do I advertise a ULA prefix on my LAN, as a home user?". If you're not, then the following probably won't answer your question. If you're already familiar with ULA prefix generation and IPv6 prefix advertisment, and are just trying to find out how to advertise on your home router, almost all of the following will be redundant information. (I'm happy to read the manual for your make and model of router and try to see if you can easily advertise prefixes on it. :) ) I'm not sure how much experience you have with screwing around with router settings, your level of familiarity with IP networking concepts, or even what software you're using on your router, so I'll give some background information on prefix advertisement, and describe prefix generation and how you might actually advertise a ULA prefix on a router running OpenWRT. Because the underlying software that does the work should be the same regardless of router model, reading about how it is done on OpenWRT might give you a starting point to discover how it's done -if it is at all- on your router model. I'm more than happy to clarify anything that's confusing, give additional information, or track down and read documentation for a particular router! Background information: Many routers use a piece of software called radvd to advertise IPv6 routes. Radvd -effectively- takes a list of network interfaces, each with a list of router advertisment options, and transmits advertisements on those interfaces. radvd has a config file whose syntax is documented here [0]. A minimal radvd config file would look like interface eth0 { AdvSendAdvert on; prefix ::/64 { AdvOnLink on; AdvAutonomous on; }; }; This would instruct radvd to advertise whatever prefix had been assigned to the interface named eth0 to machines attached to eth0. Note that an interface section can have multiple prefix sections. If you have a particular prefix that you want to advertise, replace "::/64" with that prefix. The overwhelming majority of options in the radvd config file are both entirely optional, and entirely unneeded in most situations. Now, I suspect that on most routers that support prefix advertisement, you'll never need to touch an radvd config file. Like I said, this is just background information. So, let's get to generating your ULA prefix: Generating your ULA prefix: Get the MAC address of a computer that you control. Go to https://www.sixxs.net/tools/grh/ula/ https://www.sixxs.net/tools/grh/ula/ and plug that MAC address into the MAC address field on the page. You'll get a value back that of the form: fdaa:aaaa:aaaa::/48 This is your ULA prefix. Advertising a /48 is kind of awkward for downstream devices. You need to carve out a /64. So, take that ULA prefix, add a colon and four zeroes to it and replace the /48 with a /64 like so: fdaa:aaaa:aaaa:0000::/64 You can now go to advertise this on your LAN. [1] Advertising the prefix: I actually have no idea what the prefix advertisement option is called on most consumer routers, or if it even exists on your router. A quick look at Belkin's and Linksys's support sites didn't turn up anything promising. I would dig around in the IPv6 settings tabs until I found something that looked promising, or had exhausted all options. [2] If you're using a recent version of OpenWRT (That is, OpenWRT Barrier Breaker or later), /etc/config/network has a ula_prefix option in the globals section that's used for exactly this. [3][4] If you're using a version of OpenWRT earlier than Barrier Breaker, you can tell radvd to advertise your ULA on your LAN interfaces. The prefix section of /etc/config/radvd is used for this. /etc/config/radvd is documented here [6]. You can have multiple prefix sections for each LAN interface. [7] Now, reload the network config (Call /etc/init.d/network with either the reload or restart option, I can't remember which.), wait for a minute or two, and machines on your LAN should have a new IPv6 address in the /64 that we carved out of the ULA. If everything's working, -optionally- register your newly-generated prefix with SixXS at the page where you generated your ULA prefix. Feel free to ask any questions that you have. :D [0] http://linux.die.net/man/5/radvd.conf http://linux.die.net/man/5/radvd.conf [1] Note that you can create 16 bits worth of networks out of your /48, not just one network. [2] If you can tell me the make and model of your router, I'd be happy to try to find and read the documentation for it. :) [3] http://wiki.openwrt.org/doc/uci/network http://wiki.openwrt.org/doc/uci/network [4] Though, to be frank, I can't remember if you plug in the /48 and it automatically creates /64s for each LAN interface that you have configured [5], or if you can only plug a single /64 into it. I would try the /48 first. [5] OpenWRT lets you set up multiple LAN interfaces. I found this useful when I was using VLANs to make isolated WiFi guest networks. [6] http://wiki.openwrt.org/doc/uci/radvd http://wiki.openwrt.org/doc/uci/radvd [7] So, if you have IPv6 service from your ISP, you can advertise the ISP-provided prefix and your ULA prefix. Have one prefix section that contains no prefix option, and a second prefix section that contains a prefix option whose value is the /64 that you created earlier.