4 ms·

I don't think software is there yet for creating a home IPv6 network. Docker doesn't have good IPv6 support, for instance. It felt like going back to the stone

I don't think software is there yet for creating a home IPv6 network. Docker doesn't have good IPv6 support, for instance. It felt like going back to the stone ages of IPv4 and specifying all IP addresses manually vs doing some kind of DHCP-like automatic assignment like IPv4 does. Maybe it's possible, but I haven't been able to get it to work.

how_gauche 6y ago
You're supposed to use DHCPv6 or Neighbor Discovery -- like everything else in IPv6-land, it's significantly more complicated than it is over IPv4. I don't run the whole network IPv6 -- for hosts I care about having an IPv6 egress for, I use a Wireguard tunnel in IPv6 private address space to a bastion host. If I want to expose a port, I forward it from the other side. It's a sad state of affairs :-(
- gertrunde 6y ago
  I'm not sure it's that much more complicated as such, beyond being different/unfamiliar. Just setting up SLAAC is very straightforward, probably (ignoring any unfamiliarity issues) more simple than DHCP? Pulling addresses from your service provider via prefix delegation can be a bit funny, and could do with being a lot more polished. Instructions/community support in particular can be problematic as ISPs tend to use different prefix lengths, rather than just standardising on /56. And also less relevant if you have a static allocation, which is potentially more likely with IPv6 than IPv4. And DNS becomes more important, as does firewalling, no more relying on the somewhat dubious NAT safety net.
- Havoc 6y ago
  Is your wireguard ipv6 setup a security consideration or working around a technical issue with your ISP? My ISP seems to have ipv6 out of the box, but a little worried about security given it's NAT-less nature
  - how_gauche 6y ago
    It's mainly so I can "road warrior" to my internal resources from my laptop transparently. IPv6 is a good choice for this since it won't conflict with any NAT address space you're likely to be on.
xfalcox 6y ago
Docker works fine with IPv6. Don't get me wrong, it had it's fair share of bugs over the years, but recent releases are in a usable shape.
- selfhoster11 6y ago
  It didn't work for me on my IPv6 ISP, until I started assigning addresses manually. It felt like a big step back. I wasn't willing to waste more time on research, so I decided to go with IPv4. For a home network/SME-scale, I don't see the value proposition of IPv6. It takes time to retrain staff, incurs hardware and software replacement costs in some cases (not to mention licensing changes from vendors) and ties up developer/IT time during the process of upgrading and troubleshooting IPv6 teething issues (as I've found in my case). The outcome is that the network can now handle more addresses and more advanced workloads, but becomes harder to maintain. Most home/SME-scale networks don't need even half of the 10.0.0.0/8 address space and don't take advantage of the new features, so it becomes pointless to upgrade unless you outgrow IPv4's capabilities or know you're on track to doing so.
- Leo_Verto 6y ago
  Docker doesn't support Prefix Delegation which makes it unusable on home networks with dynamic ipv6 prefixes. What worked for me was running https://github.com/robbertkl/docker-ipv6nat https://github.com/robbertkl/docker-ipv6nat which allows you to run containers with NATed ipv6 addrsses exactly the same way you'd run ipv4.

how_gauche 6y ago

You're supposed to use DHCPv6 or Neighbor Discovery -- like everything else in IPv6-land, it's significantly more complicated than it is over IPv4. I don't run the whole network IPv6 -- for hosts I care about having an IPv6 egress for, I use a Wireguard tunnel in IPv6 private address space to a bastion host. If I want to expose a port, I forward it from the other side. It's a sad state of affairs :-(

gertrunde 6y ago
I'm not sure it's that much more complicated as such, beyond being different/unfamiliar. Just setting up SLAAC is very straightforward, probably (ignoring any unfamiliarity issues) more simple than DHCP? Pulling addresses from your service provider via prefix delegation can be a bit funny, and could do with being a lot more polished. Instructions/community support in particular can be problematic as ISPs tend to use different prefix lengths, rather than just standardising on /56. And also less relevant if you have a static allocation, which is potentially more likely with IPv6 than IPv4. And DNS becomes more important, as does firewalling, no more relying on the somewhat dubious NAT safety net.
Havoc 6y ago
Is your wireguard ipv6 setup a security consideration or working around a technical issue with your ISP? My ISP seems to have ipv6 out of the box, but a little worried about security given it's NAT-less nature
- how_gauche 6y ago
  It's mainly so I can "road warrior" to my internal resources from my laptop transparently. IPv6 is a good choice for this since it won't conflict with any NAT address space you're likely to be on.

xfalcox 6y ago

Docker works fine with IPv6. Don't get me wrong, it had it's fair share of bugs over the years, but recent releases are in a usable shape.

selfhoster11 6y ago
It didn't work for me on my IPv6 ISP, until I started assigning addresses manually. It felt like a big step back. I wasn't willing to waste more time on research, so I decided to go with IPv4. For a home network/SME-scale, I don't see the value proposition of IPv6. It takes time to retrain staff, incurs hardware and software replacement costs in some cases (not to mention licensing changes from vendors) and ties up developer/IT time during the process of upgrading and troubleshooting IPv6 teething issues (as I've found in my case). The outcome is that the network can now handle more addresses and more advanced workloads, but becomes harder to maintain. Most home/SME-scale networks don't need even half of the 10.0.0.0/8 address space and don't take advantage of the new features, so it becomes pointless to upgrade unless you outgrow IPv4's capabilities or know you're on track to doing so.
Leo_Verto 6y ago
Docker doesn't support Prefix Delegation which makes it unusable on home networks with dynamic ipv6 prefixes. What worked for me was running https://github.com/robbertkl/docker-ipv6nat https://github.com/robbertkl/docker-ipv6nat which allows you to run containers with NATed ipv6 addrsses exactly the same way you'd run ipv4.