4 ms·

Ok so here's a question for the HN community: I have IPv6 from my ISP, and as an experiment, I want to primarily use IPv6 to connect to my different home server

Ok so here's a question for the HN community: I have IPv6 from my ISP, and as an experiment, I want to primarily use IPv6 to connect to my different home servers. I use automatic address selection, so no DHCP. So this means that when a server reboots, chances are their address changes. Other than setting up a custom DNS server and $somehow ensuring that each server registers itself at this DNS server at boot, are there any elegant solutions to this?

starfox64_ 7y ago
Is there anything preventing you from assigning static IPv6 addresses on your machines?
- stingraycharles 7y ago
  Not necessarily. How would I go about making these IPs easily discoverable by other hosts? DNS again?
  - teddyh 7y ago
    Or mDNS: http://www.multicastdns.org/ http://www.multicastdns.org/ As used by Apple’s Bonjour implementation of the Zeroconf networking stack. If using Debian or the like, just apt install avahi-daemon and libnss-mdns, and access your hosts on the local network as servername.local.
  - starfox64_ 7y ago
    Yes, you would probably then have to allow inbound traffic to these addresses in your ISP router's firewall or whatever you have. If your router's default configuration is sane it should (by default) only allow returning connections and drop any other.
- magicalhippo 7y ago
  In my case, I get a new prefix every time my router reboots or otherwise loses connection. Then there's the case of firewall rules. My router gets a new prefix which causes my server to get a new IP, how do I get my firewall (pfSense) to update my firewall pass rules to point to the new IP? I must admit I haven't tried really hard, so there might be some obvious ways I'm missing.
  - fulafel 7y ago
    If your prefix is always skipping, you have to complain to your ISP and meanwhile automate your network renumbering. Is there a reason you are not using the pfsense device to do routing and (put the cpe device to bridge mode)? Then you don't need to worry about your firewall not knowing about reboots, and the firewall rules will just work (assuming pfsense supports using prefix relative rules, vs hardcoding the prefix to all firewall rules...)
    - magicalhippo 7y ago
      The cable modem is a dumb bridge, and the pfSense is doing the routing (AFAIK). I can't see any way to do relative rules though, which is what makes it difficult. Maybe I'm missing something though.
      - fulafel 7y ago
        The manual seems to talk about host and network aliases, which might be what you want. Hopefully there are magic aliases for the interface networkts. edit: https://docs.netgate.com/pfsense/en/latest/firewall/firewall-rule-basics.html https://docs.netgate.com/pfsense/en/latest/firewall/firewall... also talks about "LAN net" and "WAN net" aliases.
cesarb 7y ago
> I use automatic address selection, so no DHCP. This means you're using SLAAC instead of DHCPv6, right? In that case, your servers should have a fixed IPv6 address derived from their MAC address. Even if they also have privacy addresses (and prefer to use them for outbound connections), they should still have the non-privacy address which you could use for inbound connections. Or is it the problem that, when your router reboots, the IPv6 prefix changes? That is a harder problem (and would be the same in IPv4).
zamadatix 7y ago
If you want outside-of-your-home things to reach dynamically assigned public IP space then DDNS is your only option (there are public servers you can use if you're willing to make that trade as well). If you just want your local stuff to have public IPv6 outbound and static IPv6 inside your home then you can just multinet. That is add a static private IPv6 to the same interface you get your public IPv6 via SLAAC.

starfox64_ 7y ago

Is there anything preventing you from assigning static IPv6 addresses on your machines?

stingraycharles 7y ago
Not necessarily. How would I go about making these IPs easily discoverable by other hosts? DNS again?
- teddyh 7y ago
  Or mDNS: http://www.multicastdns.org/ http://www.multicastdns.org/ As used by Apple’s Bonjour implementation of the Zeroconf networking stack. If using Debian or the like, just apt install avahi-daemon and libnss-mdns, and access your hosts on the local network as servername.local.
- starfox64_ 7y ago
  Yes, you would probably then have to allow inbound traffic to these addresses in your ISP router's firewall or whatever you have. If your router's default configuration is sane it should (by default) only allow returning connections and drop any other.
magicalhippo 7y ago
In my case, I get a new prefix every time my router reboots or otherwise loses connection. Then there's the case of firewall rules. My router gets a new prefix which causes my server to get a new IP, how do I get my firewall (pfSense) to update my firewall pass rules to point to the new IP? I must admit I haven't tried really hard, so there might be some obvious ways I'm missing.
- fulafel 7y ago
  If your prefix is always skipping, you have to complain to your ISP and meanwhile automate your network renumbering. Is there a reason you are not using the pfsense device to do routing and (put the cpe device to bridge mode)? Then you don't need to worry about your firewall not knowing about reboots, and the firewall rules will just work (assuming pfsense supports using prefix relative rules, vs hardcoding the prefix to all firewall rules...)
  - magicalhippo 7y ago
    The cable modem is a dumb bridge, and the pfSense is doing the routing (AFAIK). I can't see any way to do relative rules though, which is what makes it difficult. Maybe I'm missing something though.
    - fulafel 7y ago
      The manual seems to talk about host and network aliases, which might be what you want. Hopefully there are magic aliases for the interface networkts. edit: https://docs.netgate.com/pfsense/en/latest/firewall/firewall-rule-basics.html https://docs.netgate.com/pfsense/en/latest/firewall/firewall... also talks about "LAN net" and "WAN net" aliases.

cesarb 7y ago

> I use automatic address selection, so no DHCP. This means you're using SLAAC instead of DHCPv6, right? In that case, your servers should have a fixed IPv6 address derived from their MAC address. Even if they also have privacy addresses (and prefer to use them for outbound connections), they should still have the non-privacy address which you could use for inbound connections. Or is it the problem that, when your router reboots, the IPv6 prefix changes? That is a harder problem (and would be the same in IPv4).

zamadatix 7y ago

If you want outside-of-your-home things to reach dynamically assigned public IP space then DDNS is your only option (there are public servers you can use if you're willing to make that trade as well). If you just want your local stuff to have public IPv6 outbound and static IPv6 inside your home then you can just multinet. That is add a static private IPv6 to the same interface you get your public IPv6 via SLAAC.