4 ms·

What I haven't quite fathomed with IPv6 is that as a home user without my own AS, am I supposed to use my ISP provided addresses in my internal network? ISP pro

by zokier 5y ago

What I haven't quite fathomed with IPv6 is that as a home user without my own AS, am I supposed to use my ISP provided addresses in my internal network? ISP provided addresses that I have no control over and could change at any time? With IPv4, I just use RFC1918 addresses as I like and I have full control over the addresses and their allocation and I can then very easily set up iptables rules, dhcp pools, dns records etc. Then I just NAT at the edge of my network, and the configuration is practically completely isolated from my ISP and whatever addressing they do.

BitPirate 5y ago
If you don't have a static subnet, you can still use ULAs.
- BenjiWiebe 5y ago
  Exactly. With IPv6 you are expected to have multiple addresses. Some to access the internet with that may change, some that don't change and aren't globally routable to access your own stuff with. Though you can also (if your router supports it) assign hostnames to your devices so you can access them via their non-static global addresses.
  - nicolas314 5y ago
    If I understood correctly, the link between ULA-based address and host name is done through a DUID. This is assuming that DUID values do not change over time and can easily be harvested from everything you want to connect to the local network. What guarantees that DUIDs are fixed and easily collectable? What are the solutions if they aren't?
benttoothpaste 5y ago
In addition IPv6 has this weird restrictions on which prefixes are valid. For example if your ISP gives you /64 prefix, most consumer routers will not recognize it as valid. And even if you have a very configurable router it will take lots of work to configure that - even though in theory you should have tons of addresses available. And if you get a /128 prefix, good luck that - NATs are apparently disallowed in IPV6 world.
- zekica 5y ago
  NAT is not disallowed in IPv6, it's just discouraged as it breaks end-to-end principle. You can still have stateful firewalls that work for the majority of cases and you can also use NPT (network prefix translation also called 1-to-1 NAT) if you want. There is even a RFC specifying on how to do NPT without creating compute overhead for routers by making the packets have the same CRC.
  - Spivak 5y ago
    NAT is actually probably preferred too for homelabbers one because you don’t have to re-address things ever and also because you can use your whole ISP assignment as a pool of dynamically assignable/attachable public addresses.
    - DarylZero 5y ago
      Are you thinking of prefix translation?
      - Spivak 5y ago
        Not that I know of. I’m using ip6tables with an, honestly garbage, script to give me similar functionality to AWS Elastic IPs. - Everything inside the network gets a private address from DHCPv6. - I have a pool of some of my assigned prefix designated as generic outbound which use masquerading and multipath routing so my home traffic isn’t all coming from a single address. This is mostly useless but was fun to set up. - Then for the rest of the prefix I can create “attachments” where traffic from one of the public ips in the pool is routed to the private address using DNAT and then all outbound traffic from that host is SNATted to come from that public ip. So the internal hosts can have zero knowledge that they even have a public address, their privates will just start receiving traffic from the internet. When I get a new assignment from my ISP nothing internal will have to change. It’s port forwarding on steroids!
        DarylZero 5y ago
infiniteloop0 5y ago
You can do this with IPV6, these days it's called ULAs (unique unicast local addresses)[0]. Previously there was a formal prefix allocation to solve for this (site local addresses), however they have been deprecated for a bit now. [0]: https://blog.apnic.net/2020/05/20/getting-ipv6-private-addressing-right/ https://blog.apnic.net/2020/05/20/getting-ipv6-private-addre...
infiniteloop0 5y ago
franga2000 5y ago
IPv6 has private addresses too. In my network, all computers have 3 addresses: public, private and link-local. All local services use the private ones and those never change. (I don't think they're called "private" in the spec, but the idea is the same)
chungy 5y ago
IPv6 has fc00::/7 (everything from fc00:: to fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) as the equivalent to RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). You can set some private v6 subnet in DHCPv6 and be happy (or do static assignments or whatever suits you). Also, honestly, using IPv4 on LANs still makes sense no matter what trend the internet goes for.

by zokier 5y ago

BitPirate 5y ago

If you don't have a static subnet, you can still use ULAs.

BenjiWiebe 5y ago
Exactly. With IPv6 you are expected to have multiple addresses. Some to access the internet with that may change, some that don't change and aren't globally routable to access your own stuff with. Though you can also (if your router supports it) assign hostnames to your devices so you can access them via their non-static global addresses.
- nicolas314 5y ago
  If I understood correctly, the link between ULA-based address and host name is done through a DUID. This is assuming that DUID values do not change over time and can easily be harvested from everything you want to connect to the local network. What guarantees that DUIDs are fixed and easily collectable? What are the solutions if they aren't?

benttoothpaste 5y ago

In addition IPv6 has this weird restrictions on which prefixes are valid. For example if your ISP gives you /64 prefix, most consumer routers will not recognize it as valid. And even if you have a very configurable router it will take lots of work to configure that - even though in theory you should have tons of addresses available. And if you get a /128 prefix, good luck that - NATs are apparently disallowed in IPV6 world.

zekica 5y ago
NAT is not disallowed in IPv6, it's just discouraged as it breaks end-to-end principle. You can still have stateful firewalls that work for the majority of cases and you can also use NPT (network prefix translation also called 1-to-1 NAT) if you want. There is even a RFC specifying on how to do NPT without creating compute overhead for routers by making the packets have the same CRC.
- Spivak 5y ago
  NAT is actually probably preferred too for homelabbers one because you don’t have to re-address things ever and also because you can use your whole ISP assignment as a pool of dynamically assignable/attachable public addresses.
  - DarylZero 5y ago
    Are you thinking of prefix translation?
    - Spivak 5y ago
      Not that I know of. I’m using ip6tables with an, honestly garbage, script to give me similar functionality to AWS Elastic IPs. - Everything inside the network gets a private address from DHCPv6. - I have a pool of some of my assigned prefix designated as generic outbound which use masquerading and multipath routing so my home traffic isn’t all coming from a single address. This is mostly useless but was fun to set up. - Then for the rest of the prefix I can create “attachments” where traffic from one of the public ips in the pool is routed to the private address using DNAT and then all outbound traffic from that host is SNATted to come from that public ip. So the internal hosts can have zero knowledge that they even have a public address, their privates will just start receiving traffic from the internet. When I get a new assignment from my ISP nothing internal will have to change. It’s port forwarding on steroids!
      - DarylZero 5y ago

infiniteloop0 5y ago

You can do this with IPV6, these days it's called ULAs (unique unicast local addresses)[0]. Previously there was a formal prefix allocation to solve for this (site local addresses), however they have been deprecated for a bit now. [0]: https://blog.apnic.net/2020/05/20/getting-ipv6-private-addressing-right/ https://blog.apnic.net/2020/05/20/getting-ipv6-private-addre...

infiniteloop0 5y ago

franga2000 5y ago

IPv6 has private addresses too. In my network, all computers have 3 addresses: public, private and link-local. All local services use the private ones and those never change. (I don't think they're called "private" in the spec, but the idea is the same)

chungy 5y ago

IPv6 has fc00::/7 (everything from fc00:: to fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) as the equivalent to RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). You can set some private v6 subnet in DHCPv6 and be happy (or do static assignments or whatever suits you). Also, honestly, using IPv4 on LANs still makes sense no matter what trend the internet goes for.