3 ms·

> I've found vultr.com to have solid IPv6. They give you a true /64 How is that solid IPv6? You can't even trivially subnet it! Sure, it's marginally better th

> I've found vultr.com to have solid IPv6. They give you a true /64 How is that solid IPv6? You can't even trivially subnet it! Sure, it's marginally better than the 16 address madness of other hosters, but it's still terrible. Especially so, given that you need an NDP proxy hack ... WTF?

api 10y ago
Does anyone actually give you a real /64? The NDP proxy hack is easy: https://github.com/DanielAdolfsson/ndppd https://github.com/DanielAdolfsson/ndppd See also: https://www.zerotier.com/community/topic/69/default-route-override-a-k-a-full-tunnel-in-1-1-6 https://www.zerotier.com/community/topic/69/default-route-ov...
- agwa 10y ago
  Yes, Linode will route /64 and /48 subnets to you. They'll even give you several of each if you ask, and the subnets can be failed over to other nodes for high availability. Linode are the only ones I have seen do IPv6 correctly. I wish they also knew how to do security correctly; unfortunately I can no longer recommend them in good conscience.
- afics 10y ago
  At vultr you have the option to "bring your own ip", as they call it. This really just allows you to use BGP to announce whatever prefixes you own. You could have a /40 behind each of your servers if you wanted to.
  - zAy0LfpBZLC8mAC 10y ago
    Which is great to have as an option--but otherwise, it's a stupid idea. The whole point of having such a large address space with IPv6 is to enable aggregation of routes. So, every vultr datacenter should have at most one route in the global IPv6 routing table, for a huge prefix that all their customers are aggregated under. Having customers announce their own provider independent address space might well have its legitimate uses, but it adds additional routing table entries to the global routing table, which is why it's a terrible idea to do this instead of just assigning customers /48s from their provider aggregated space.
- zAy0LfpBZLC8mAC 10y ago
  Yes, good providers give you a real /48, routed to a link-local address, so it's all under your very own control, trivial to create subnets, tunnels, whatever, without any need for any hacks whatsoever. As for the NDP proxy hack being easy: Well, sure, there are more difficult things (and yes, I once wrote an NDP proxy deamon myself, which wasn't particularly difficult either). But it still adds complexity, for no real reason. The question isn't whether you can work around this deficiency. The question is: What is the point of this deficiency in the first place? Plus, you still only have one /64, which is just braindead. And, with a proxy NDP setup, you are vulnerable to NDP cache DoS: Your upstream router needs to do NDP resolution for each individual address (instead of just the one router address that your prefix is routed to), which enterprising attackers can DoS by simply sending packets to a few thousand to million of your addresses which then will overload the NDP cache of that router, leading to your machine(s) potentially being unreachable.

api 10y ago

Does anyone actually give you a real /64? The NDP proxy hack is easy: https://github.com/DanielAdolfsson/ndppd https://github.com/DanielAdolfsson/ndppd See also: https://www.zerotier.com/community/topic/69/default-route-override-a-k-a-full-tunnel-in-1-1-6 https://www.zerotier.com/community/topic/69/default-route-ov...

agwa 10y ago
Yes, Linode will route /64 and /48 subnets to you. They'll even give you several of each if you ask, and the subnets can be failed over to other nodes for high availability. Linode are the only ones I have seen do IPv6 correctly. I wish they also knew how to do security correctly; unfortunately I can no longer recommend them in good conscience.
afics 10y ago
At vultr you have the option to "bring your own ip", as they call it. This really just allows you to use BGP to announce whatever prefixes you own. You could have a /40 behind each of your servers if you wanted to.
- zAy0LfpBZLC8mAC 10y ago
  Which is great to have as an option--but otherwise, it's a stupid idea. The whole point of having such a large address space with IPv6 is to enable aggregation of routes. So, every vultr datacenter should have at most one route in the global IPv6 routing table, for a huge prefix that all their customers are aggregated under. Having customers announce their own provider independent address space might well have its legitimate uses, but it adds additional routing table entries to the global routing table, which is why it's a terrible idea to do this instead of just assigning customers /48s from their provider aggregated space.
zAy0LfpBZLC8mAC 10y ago
Yes, good providers give you a real /48, routed to a link-local address, so it's all under your very own control, trivial to create subnets, tunnels, whatever, without any need for any hacks whatsoever. As for the NDP proxy hack being easy: Well, sure, there are more difficult things (and yes, I once wrote an NDP proxy deamon myself, which wasn't particularly difficult either). But it still adds complexity, for no real reason. The question isn't whether you can work around this deficiency. The question is: What is the point of this deficiency in the first place? Plus, you still only have one /64, which is just braindead. And, with a proxy NDP setup, you are vulnerable to NDP cache DoS: Your upstream router needs to do NDP resolution for each individual address (instead of just the one router address that your prefix is routed to), which enterprising attackers can DoS by simply sending packets to a few thousand to million of your addresses which then will overload the NDP cache of that router, leading to your machine(s) potentially being unreachable.