5 ms·

I really wish there were support for an IPv6-only VPC. Terminate inbound IPv4 at ELBs/CloudFront, use 464xlat or similar for outbound IPv4.

• bluejekyll 10y ago
  Out of curiousity, why? IPv6 is much more important on the edge, than inside your VPC. Is it just for the simplicity of your networking? One strategy is to define your IPv4 space inside one of your IPv6 networks such that you have dual addressing with directly mappable addresses. Do you have some other use case than just simplicity of design?
  • dboreham 10y ago
    I'm not the OP but globally unique and optionally reachable from anywhere addresses are super-attractive from a not-going-insane perspective if you manage a non-triviality sized network.
    • bluejekyll 10y ago
      Absolutely, but the OP was talking about a 4-6 NAT, which seems less useful.
      • subway 10y ago
        GP hit it on the head. Every node is globally addressable. Regarding the 464xlat, that's strictly to enable hosts in the internal network to communicate with external IPv4 only hosts. IPv6 is still used as the only internal transport, and primary external transport.
        • bluejekyll 10y ago
          Cool. That makes a lot more sense.
      • cortesoft 10y ago
        The key was the 'outbound' word.
      • deleted 10y ago
        [deleted]
• nodesocket 10y ago
  I am also curious what your use-case is for every instance inside of your VPC having a publically routable IPv6 address. Usually you only need public addresses for your load balancers and ssh jump/bastion host. All other instances inside the VPC are private networking only.
  • jdub 10y ago
    Use case: Never having to maintain a NAT instance (or, worse, but necessary: failover NAT instances). That's how I tend to use AWS at the moment, with IPv4. Almost every resource (except AWS services) has a public IP assigned, few have open inbound security groups, most have open outbound security groups (but the option to restrict is handy).
  • knorrie 10y ago
    An instance might want to reach anything on the internet that's using an IPv6 address is a use case. Also, having instances connect to IPv6 parts of the internet while you can see which subnet of your vpc the traffic originates from, and maybe filter on that fact. Having routable addresses is a different thing than them being public or private, which is determined by the fact if you accept traffic to them or not when it arrives at the last hop before entering your vpc.
  • lmm 10y ago
    It's still nice to be able to give each host a globally unique address even if most of them aren't publicly accessible. It means that you never e.g. have routing clashes when VPNing into your datacenter from public wifi somewhere.