7 ms·

IMO, IPv6 sucks for home users and labs. Prefix delegation means your routable IP scheme could change underneath you, and firewalling connections using PD addr

IMO, IPv6 sucks for home users and labs. Prefix delegation means your routable IP scheme could change underneath you, and firewalling connections using PD addresses is really hard (unpredictable prefixes, privacy extensions change suffixes constantly), though some routers make it easier, like Google Wifi. I think most will end up NATing a single external IPv6 with a private IPv6 network behind it. I wish IANA and friends would let home users and other smaller entities request global /56 address blocks and force ISPs to peer/announce (nothing crazy, just a default route). EDIT: end users should be able to request static blocks from their ISPs for free, not IANA.

psim1 5y ago
I have done PD of a /60 from Comcast for three years and my prefix never changed. I can't imagine why it would or should.
- bombcar 5y ago
  Mine is pretty stable but anytime the cable modem gets fried by lightning the new one gets a new prefix. I wish it was tied to my account somehow.
  - d00bianista 5y ago
    That's because the DHCPv6 client in the modem generates a unique DUID for itself and the new one cannot know the fried modems DUID.
  - ac29 5y ago
    If your cable modem is regularly getting fried by lightning, you can get lightning arrestors inline on the coax connection.
    - bombcar 5y ago
      I have one now but I suspect the lightning shall … resist arrest.
tialaramex 5y ago
> I wish IANA and friends would let home users and other smaller entities request global /56 address blocks and force ISPs to peer/announce You want portable /56s? You realise that's incredibly expensive for everybody else right? Today's portable /24s are a considerable burden, and you'd like to have far smaller routes assigned for basically your personal convenience. I don't know for sure what it would cost, but certainly thousands of dollars per year each seems like a very modest estimate.
- candiddevmike 5y ago
  Fair point. Let me request them for free from my ISP then. None of this "pay $20/mo for a static prefix" garbage. IPv6 loses all of its benefits if my entire network is ephemeral and has to rely on prefix delegation propagation.
  - tialaramex 5y ago
    You agree it's a "fair point" that this would be incredibly expensive, but then you say you want it to be free. Is it simply that you don't understand why it's incredibly expensive? It means everybody who does network routing has to buy extra hardware to track all this useless noise you've decided ought to be "free", that hardware costs money. Your ISP choosing to charge you for stuff that doesn't cost them anything is completely separate. I would say "Choose an ISP which isn't shit" but you're probably American and have no such choice. Too bad?
    - candiddevmike 5y ago
      My correction is for static prefixes from an ISPs block, I don't see that as an unreasonable free request. No peering, they just static route that block to the IPv6 address they assign you.
      - tialaramex 5y ago
        Sure, yes, there's no reason this should be hard for your ISP to arrange. I guess it might be slightly painful for large ISPs say if you're a huge American ISP and customers can just up and move all their gear from San Francisco to New York and expect the IP addresses to stay the same that's kind of annoying to implement and the service for those customers will either suck (a user in New York finds all their data routes via the West Coast) or cost you more. But in the general case, for a customer who is just using the Internet from the same place as last time, there's no benefit to changing their IP addresses and clearly there's no reason static addressing shouldn't be free, it's just like one database entry for them to do it. I could imagine them explaining OK, you get static BUT it might change if you move home or something, and that feels pretty acceptable to me. For what it's worth I get static IPv6 and IPv4 (although of course the IPv4 is a tiny block, only a /27 IIRC whereas I have a /48 of IPv6) but I'm in the UK and with a specialist ISP that cares a lot about this stuff.
kop316 5y ago
That was my experience as well. I have three seperate VLANs (Untrusted Devices, Servers, Normal) which is easy with IPv4/NAT/HAProxy. IPv6 was unpredictable in how I could get more than a /64 subnet (so no VLANs allowed). After guessing at how to get it for a few hours, I was able to get a /56 subnet, and set it up. I even disabled IPv4 (dual stack caused it's own set of issues). IPv6 was much, much slower. I was unable to track down why it was so much slower, so I ended up just doing back to IPv4.
admax88qqq 5y ago
The address size, and pains of the IP scheme changing underneath might hopefully push mDNS and other naming systems to really catch up so that we can stop using IP addresses for things like firewall rules. I would much rather have a local network naming system that works and use human readable names in all situations where I want to specify firewall rules. It's a shame that this still really isn't an option, the technology is there, it just needs some polish to not require so much tweaking.
- iptrans 5y ago
  Having to do a DNS lookup for each firewall rule is going to suck. Not to mention blackholing traffic when cached DNS replies are out of sync with the actual IP.
  - vetinari 5y ago
    I can see that there is a user-space daemon, that watches TTLs in the resolved DNS records and if they change, updates an corresponding ip set in the firewall.
  - admax88qqq 5y ago
    Doesn't have to be DNS, could be any sort of cache on the router that updates when new hosts come online or the prefix changes. Plus blackholing temporarily due to a stale cache is better than blackholing permanently due to a stale rule pointing to an old IP.
    - blibble 5y ago
      how do client firewalls deal with that? the don't know the router lost its connection
10000truths 5y ago
This is an ISP problem, not an IPv6 problem. With the greatly expanded address space, nothing stops an ISP from allocating each customer a static prefix. To not do so is, in my eyes, just another undignified attempt at rent seeking.
snuxoll 5y ago
The solution I've come up with here is to use ULA's in addition to the public prefix. If my public prefix changes it can cause a temporary disruption in service availability from outside my home, but on the inside everything uses the ULA prefix for communication so I don't have giant messes during re-addressing. This has also tackled my issues with inter-vlan routing, since my switch does not have the ability to take a prefix delegation but can route static IPv6 subnets just fine. My big issue remains multi-homing for smaller setups like my homelab and SMB's. When doing NAT (and I could do NPT with my v6 network) all my policy is at the gateway - what traffic goes over what link, etc. I lose all that with IPv6, and I'm still trying to figure out how to deal with it - what used to be simple policies like "my home office uses CenturyLink and only fails over to Sparklight if that's down while everything else does the opposite" now require some way to push down the client or more sophisticated IFTT style setups on the router (if this gateway goes down depreciate the prefix and advertise this one instead).
- aidenn0 5y ago
  Do you use SLAAC or DHCP6 for assigning the ULAs? I'm looking for something that lets me use ipv6 on my home network, and my ISP changes my /64 PD disturbingly often.
  - snuxoll 5y ago
    I use SLAAC - I actually use my main switch (Juniper EX2300) to advertise those since it can handle routing the inter-vlan traffic on my network, and then my router/firewall handles the public prefixes.
- candiddevmike 5y ago
  Are you assigning a public and private IP to everything, or just private and using NAT on the gateway?
  - snuxoll 5y ago
    Everything gets a public address as well as a ULA one.
mindslight 5y ago
I also haven't found it compelling to implement IPv6 on my small network. If I use v6 addressing for my own nodes, what do I gain? I don't need my internal network to be routeable. And even if I could come up with some use, relying on those addresses being routeable creates a single point of failure at the tunnel gateway. Alternatively, I could setup a v6 tunnel for my home network and each of my remote nodes that doesn't have native v6, "beyondcorp" style. But I want to have an "internal" network where everything is definitely running over wireguard. But wireguard over v6 just means more bytes on the wire and suboptimal routing, and v6 over wireguard falls under the first point. Now it's true that if one of my VPS's was v6 only, then I'd start to care about v6 reachability to keep my wireguard mesh a full mesh. But at this time I just don't see the use, and without a use anything I setup for kicks will eventually fall apart like my previous few tests of IPv6 did.
d00bianista 5y ago
I'd like to disagree on IPv6 sucking and would like to steer this blame towards whoever decided to not be persistent. Firewalls can handle changing prefixes by masking it. Hosts can request certain addresses. Cheap dual-homing is something that IPv6 does not quite do, because that requires NAT66, which is controversial. Also, RIPE tells us to do persistent delegations: https://www.ripe.net/publications/docs/ripe-690#5-2--why-non-persistent-assignments-are-considered-harmful https://www.ripe.net/publications/docs/ripe-690#5-2--why-non...
- aidenn0 5y ago
  AFAICT pretty much all home ISPs don't offer persistent delegations. Mine changes with every power outage plus a few other times a year. You can upgrade to their "business plan" and pay 4x as much for 1/2 the bandwidth to get a persistent delegation of a /48, but "Having more than one device on the internet" shouldn't require a business plan these days, and so the choice is NAT66 or having all the issues that that RIPE publication calls out.
whoknowswhat11 5y ago
The irony for me is that I pretty easily get a static IPv4 block from my ISP (they do it for free for me, but should be $5/month or something). Trying to get a static IPv6 prefix is not possible. So there is actually LESS availability of static IPv6 for some reason - even through the address space is so massive, the rules around using it are so restrictive you can't get something static. This ripples into absolutely everything - now doing firewall rules is a total pain. Additionally the machines and devices are constantly changing IP addresses (on IPv6). So the old small business setup model where a DHCP server is setup, some static IPs configured then reservations in DHCP made, then everything works great no matter what happens in DNS or other servers etc is gone, which feeds mgmt dashboards so you can easily do a alerts or period end report - so and so used 5TB, is something wrong with their machine type stuff - get's harder. I am curious what recommended IPv6 solution is for this classic small biz situations. Dual WAN, primary ATT, secondary comcast (for failover). Local DHCP server for addressing. Monitoring / reporting by User/IP. VPN terminating at a sonicwall or similar. 1) Without a static IP - what do I give my VPN users? 2) With all the IP address changes, how do I assign IP's to users to get my monitoring tools to play well with everything. 3) With PD, how do I get my failover working well?
- gerdesj 5y ago
  NPt - eg: https://docs.netgate.com/pfsense/en/latest/nat/npt.html https://docs.netgate.com/pfsense/en/latest/nat/npt.html or NAT66 and friends for outbound. DNS for inbound. Sadly most VPNs don't support SRV or similar. Wireguard perhaps. It's not pretty 8(
  - slownews45 5y ago
    This is the issue. I wish we could have had (static) PD, then locally define a netmask, and then DHCP or straight static for local devices. Internally, you'd ignore PD for routing within netmask - so regardless of where WAN link went you'd still be ok locally. But because address space is so big, and PD is so big, these local addresses were also (with PD attached) globally routable. I'd also love if IPv6 only devices had an EASY way to hit IPv4 (ie, xxx:ipv4 in IPv6 address space, with the border device which could be dual stack translating over to IPv4) as a default transition config. One problem is that IPv6 put so many new concepts in it doesn't map as cleanly as maybe IPv5 might have (just an extension in size of space).
deleted 5y ago
[deleted]
p1mrx 5y ago
What we really need is to decouple IP service from the last-mile cable/DSL/fiber ISP, so they provide a dumb pipe to a nearby PoP where you can choose your IPv4/IPv6 provider. This system would need to support MTU >= 1500, and enforce geographical locality so it doesn't get banned by Netflix.
throw0101a 5y ago
> IMO, IPv6 sucks for home users and labs. […] EDIT: end users should be able to request static blocks from their ISPs for free, not IANA. This is a technical argument for IPv6, because there is no reason to worry about exhaustion and scarcity with it. The issue here is on the business side of things. As others have mentioned: as a kludge you can assign ULA on your network and then use NPTv6 for when the prefix you're delegated changes in the non-static scenario.

psim1 5y ago

I have done PD of a /60 from Comcast for three years and my prefix never changed. I can't imagine why it would or should.

bombcar 5y ago
Mine is pretty stable but anytime the cable modem gets fried by lightning the new one gets a new prefix. I wish it was tied to my account somehow.
- d00bianista 5y ago
  That's because the DHCPv6 client in the modem generates a unique DUID for itself and the new one cannot know the fried modems DUID.
- ac29 5y ago
  If your cable modem is regularly getting fried by lightning, you can get lightning arrestors inline on the coax connection.
  - bombcar 5y ago
    I have one now but I suspect the lightning shall … resist arrest.

tialaramex 5y ago

> I wish IANA and friends would let home users and other smaller entities request global /56 address blocks and force ISPs to peer/announce You want portable /56s? You realise that's incredibly expensive for everybody else right? Today's portable /24s are a considerable burden, and you'd like to have far smaller routes assigned for basically your personal convenience. I don't know for sure what it would cost, but certainly thousands of dollars per year each seems like a very modest estimate.

candiddevmike 5y ago
Fair point. Let me request them for free from my ISP then. None of this "pay $20/mo for a static prefix" garbage. IPv6 loses all of its benefits if my entire network is ephemeral and has to rely on prefix delegation propagation.
- tialaramex 5y ago
  You agree it's a "fair point" that this would be incredibly expensive, but then you say you want it to be free. Is it simply that you don't understand why it's incredibly expensive? It means everybody who does network routing has to buy extra hardware to track all this useless noise you've decided ought to be "free", that hardware costs money. Your ISP choosing to charge you for stuff that doesn't cost them anything is completely separate. I would say "Choose an ISP which isn't shit" but you're probably American and have no such choice. Too bad?
  - candiddevmike 5y ago
    My correction is for static prefixes from an ISPs block, I don't see that as an unreasonable free request. No peering, they just static route that block to the IPv6 address they assign you.
    - tialaramex 5y ago
      Sure, yes, there's no reason this should be hard for your ISP to arrange. I guess it might be slightly painful for large ISPs say if you're a huge American ISP and customers can just up and move all their gear from San Francisco to New York and expect the IP addresses to stay the same that's kind of annoying to implement and the service for those customers will either suck (a user in New York finds all their data routes via the West Coast) or cost you more. But in the general case, for a customer who is just using the Internet from the same place as last time, there's no benefit to changing their IP addresses and clearly there's no reason static addressing shouldn't be free, it's just like one database entry for them to do it. I could imagine them explaining OK, you get static BUT it might change if you move home or something, and that feels pretty acceptable to me. For what it's worth I get static IPv6 and IPv4 (although of course the IPv4 is a tiny block, only a /27 IIRC whereas I have a /48 of IPv6) but I'm in the UK and with a specialist ISP that cares a lot about this stuff.

kop316 5y ago

That was my experience as well. I have three seperate VLANs (Untrusted Devices, Servers, Normal) which is easy with IPv4/NAT/HAProxy. IPv6 was unpredictable in how I could get more than a /64 subnet (so no VLANs allowed). After guessing at how to get it for a few hours, I was able to get a /56 subnet, and set it up. I even disabled IPv4 (dual stack caused it's own set of issues). IPv6 was much, much slower. I was unable to track down why it was so much slower, so I ended up just doing back to IPv4.

admax88qqq 5y ago

The address size, and pains of the IP scheme changing underneath might hopefully push mDNS and other naming systems to really catch up so that we can stop using IP addresses for things like firewall rules. I would much rather have a local network naming system that works and use human readable names in all situations where I want to specify firewall rules. It's a shame that this still really isn't an option, the technology is there, it just needs some polish to not require so much tweaking.

iptrans 5y ago
Having to do a DNS lookup for each firewall rule is going to suck. Not to mention blackholing traffic when cached DNS replies are out of sync with the actual IP.
- vetinari 5y ago
  I can see that there is a user-space daemon, that watches TTLs in the resolved DNS records and if they change, updates an corresponding ip set in the firewall.
- admax88qqq 5y ago
  Doesn't have to be DNS, could be any sort of cache on the router that updates when new hosts come online or the prefix changes. Plus blackholing temporarily due to a stale cache is better than blackholing permanently due to a stale rule pointing to an old IP.
  - blibble 5y ago
    how do client firewalls deal with that? the don't know the router lost its connection

10000truths 5y ago

This is an ISP problem, not an IPv6 problem. With the greatly expanded address space, nothing stops an ISP from allocating each customer a static prefix. To not do so is, in my eyes, just another undignified attempt at rent seeking.

snuxoll 5y ago

The solution I've come up with here is to use ULA's in addition to the public prefix. If my public prefix changes it can cause a temporary disruption in service availability from outside my home, but on the inside everything uses the ULA prefix for communication so I don't have giant messes during re-addressing. This has also tackled my issues with inter-vlan routing, since my switch does not have the ability to take a prefix delegation but can route static IPv6 subnets just fine. My big issue remains multi-homing for smaller setups like my homelab and SMB's. When doing NAT (and I could do NPT with my v6 network) all my policy is at the gateway - what traffic goes over what link, etc. I lose all that with IPv6, and I'm still trying to figure out how to deal with it - what used to be simple policies like "my home office uses CenturyLink and only fails over to Sparklight if that's down while everything else does the opposite" now require some way to push down the client or more sophisticated IFTT style setups on the router (if this gateway goes down depreciate the prefix and advertise this one instead).

aidenn0 5y ago
Do you use SLAAC or DHCP6 for assigning the ULAs? I'm looking for something that lets me use ipv6 on my home network, and my ISP changes my /64 PD disturbingly often.
- snuxoll 5y ago
  I use SLAAC - I actually use my main switch (Juniper EX2300) to advertise those since it can handle routing the inter-vlan traffic on my network, and then my router/firewall handles the public prefixes.
candiddevmike 5y ago
Are you assigning a public and private IP to everything, or just private and using NAT on the gateway?
- snuxoll 5y ago
  Everything gets a public address as well as a ULA one.

mindslight 5y ago

I also haven't found it compelling to implement IPv6 on my small network. If I use v6 addressing for my own nodes, what do I gain? I don't need my internal network to be routeable. And even if I could come up with some use, relying on those addresses being routeable creates a single point of failure at the tunnel gateway. Alternatively, I could setup a v6 tunnel for my home network and each of my remote nodes that doesn't have native v6, "beyondcorp" style. But I want to have an "internal" network where everything is definitely running over wireguard. But wireguard over v6 just means more bytes on the wire and suboptimal routing, and v6 over wireguard falls under the first point. Now it's true that if one of my VPS's was v6 only, then I'd start to care about v6 reachability to keep my wireguard mesh a full mesh. But at this time I just don't see the use, and without a use anything I setup for kicks will eventually fall apart like my previous few tests of IPv6 did.

d00bianista 5y ago

I'd like to disagree on IPv6 sucking and would like to steer this blame towards whoever decided to not be persistent. Firewalls can handle changing prefixes by masking it. Hosts can request certain addresses. Cheap dual-homing is something that IPv6 does not quite do, because that requires NAT66, which is controversial. Also, RIPE tells us to do persistent delegations: https://www.ripe.net/publications/docs/ripe-690#5-2--why-non-persistent-assignments-are-considered-harmful https://www.ripe.net/publications/docs/ripe-690#5-2--why-non...

aidenn0 5y ago
AFAICT pretty much all home ISPs don't offer persistent delegations. Mine changes with every power outage plus a few other times a year. You can upgrade to their "business plan" and pay 4x as much for 1/2 the bandwidth to get a persistent delegation of a /48, but "Having more than one device on the internet" shouldn't require a business plan these days, and so the choice is NAT66 or having all the issues that that RIPE publication calls out.

whoknowswhat11 5y ago

The irony for me is that I pretty easily get a static IPv4 block from my ISP (they do it for free for me, but should be $5/month or something). Trying to get a static IPv6 prefix is not possible. So there is actually LESS availability of static IPv6 for some reason - even through the address space is so massive, the rules around using it are so restrictive you can't get something static. This ripples into absolutely everything - now doing firewall rules is a total pain. Additionally the machines and devices are constantly changing IP addresses (on IPv6). So the old small business setup model where a DHCP server is setup, some static IPs configured then reservations in DHCP made, then everything works great no matter what happens in DNS or other servers etc is gone, which feeds mgmt dashboards so you can easily do a alerts or period end report - so and so used 5TB, is something wrong with their machine type stuff - get's harder. I am curious what recommended IPv6 solution is for this classic small biz situations. Dual WAN, primary ATT, secondary comcast (for failover). Local DHCP server for addressing. Monitoring / reporting by User/IP. VPN terminating at a sonicwall or similar. 1) Without a static IP - what do I give my VPN users? 2) With all the IP address changes, how do I assign IP's to users to get my monitoring tools to play well with everything. 3) With PD, how do I get my failover working well?

gerdesj 5y ago
NPt - eg: https://docs.netgate.com/pfsense/en/latest/nat/npt.html https://docs.netgate.com/pfsense/en/latest/nat/npt.html or NAT66 and friends for outbound. DNS for inbound. Sadly most VPNs don't support SRV or similar. Wireguard perhaps. It's not pretty 8(
- slownews45 5y ago
  This is the issue. I wish we could have had (static) PD, then locally define a netmask, and then DHCP or straight static for local devices. Internally, you'd ignore PD for routing within netmask - so regardless of where WAN link went you'd still be ok locally. But because address space is so big, and PD is so big, these local addresses were also (with PD attached) globally routable. I'd also love if IPv6 only devices had an EASY way to hit IPv4 (ie, xxx:ipv4 in IPv6 address space, with the border device which could be dual stack translating over to IPv4) as a default transition config. One problem is that IPv6 put so many new concepts in it doesn't map as cleanly as maybe IPv5 might have (just an extension in size of space).

deleted 5y ago

[deleted]

p1mrx 5y ago

What we really need is to decouple IP service from the last-mile cable/DSL/fiber ISP, so they provide a dumb pipe to a nearby PoP where you can choose your IPv4/IPv6 provider. This system would need to support MTU >= 1500, and enforce geographical locality so it doesn't get banned by Netflix.

throw0101a 5y ago

> IMO, IPv6 sucks for home users and labs. […] EDIT: end users should be able to request static blocks from their ISPs for free, not IANA. This is a technical argument for IPv6, because there is no reason to worry about exhaustion and scarcity with it. The issue here is on the business side of things. As others have mentioned: as a kludge you can assign ULA on your network and then use NPTv6 for when the prefix you're delegated changes in the non-static scenario.