5 ms·

I really want to love IPv6 but my ISP (Xfinity in California) will not provide a stable prefix. This doesn't matter with IPv4, because all my internal IPv4 add

I really want to love IPv6 but my ISP (Xfinity in California) will not provide a stable prefix. This doesn't matter with IPv4, because all my internal IPv4 addresses are NATed. But with IPv6, although each device on the network can receive a globally routable IPv6 address, the prefix keeps changing, and so the address keeps changing. This makes internal networking a nightmare, since the address of my devices is not under my control. I don't use NPT, but it would fix the problem, so people are going to continue using it until dynamic prefixes go away. Which will probably be never.

zokier 4y ago
As I understand it, the idea is to use many addresses per host. I.e. you don't need to use same addresses for internal networking as global networking.
nomel 4y ago
> Which will probably be never. Wouldn't this be like static bluetooth IDs, where you could be tracked wherever you go? I imagine that's a rare desire, amongst the internet population. I could see requesting static IPs for particular devices, like you used to be able to do.
- unethical_ban 4y ago
  I'm not sure what the best current practices are for mobile, but for residential/business/etc., the most convenient behavior would be for the delegated prefix to be static unless it is requested to be changed. That tends to be the case already with ISPs who grant public IPv4 to customers - it's DHCP whose lease stays the same unless you forcibly change your MAC address or let the lease expire via turning off your modem, and so on. Talking about IPv4 with NAT, a "consumer" with zero server-hosting needs could get away with a changing public IP. Someone with any kind of server needs, like hosting their own Internet-accessible IoT portal, personal VPN, website, game server, etc. would want a stable public IP address. Yeah, that may lead to tracking, but it's the status quo, I suppose is the point. In case it isn't known, IPv6 has so many addresses and is designed in such a way, that it is expected each "network" (think home network) would be given a network prefix of 56 or 60 bits. The "host" portion of an IPv6 address is the final 64 bits of the address. Therefore, each network an ISP issues to a client should have room for something between 16 and 256 subnetworks, each with effectively unlimited client address space.
gerdesj 4y ago
"will not provide a stable prefix" This is pretty horrific. You could investigate ULA which is a bit like RFC1918 addresses for IPv6. You could attach ULA addresses to a few devices such as a local DNS server, printers and the like. NPT would enable you to route your ULA addressed gear to the internets if they don't have a globally routable address.
- throw0101a 4y ago
  > NPT would enable you to route your ULA addressed gear to the internets if they don't have a globally routable address. One convenient thing about ULA+NPTv6 is that, unlike IPv4 NAT, is that an external IPv6 address is basically 1:1 'equivalent' to an internal IPv6 address. The NPTv6 is stateless so that, firewall rules allowing, a connection can come right in without all sorts of contortions for port mapping. Most (residential) gateways by default block incoming requests unless they're a reply to a previous outgoing connection. I know I can ping6 the iMac I'm typing this on, but attempts to (e.g.) SSH in are blocked by default.
  - gerdesj 4y ago
    To spell that out a bit more - a ULA to NPT address is IP based and not port based and is way more useful. When you do a IPv4 "pinhole" port map you get precisely one mapping and it will timeout eventually, which can lead to all sorts of exciting debugging opportunities. IPv4 does have 1:1 NAT but there are so few IPs so whilst I have a /24, 2 x /28 and 2 x /29 to play with and others, I doubt most do. NPTv6 maps an entire address space from A->B and is actually not designed to deal with NATv4 anyway. It is for outbound connections.
    - throw0101a 4y ago
      > To spell that out a bit more - a ULA to NPT address is IP based and not port based and is way more useful. This is implementation specific: on my Asus I can specify to allow in all ports from in via a NPTv6-ULA hole, a port range, or even a single port. If I want to only allow tcp/25 in to a particular IP I can do that, if I want 5900-5910 I can do that too, as well as 1-65535.
fzfaa 4y ago
For your privacy you should be thankful that they do not provide a stable prefix.
- unethical_ban 4y ago
  For anyone wanting to host a service at their home, you should be regretful not getting a stable prefix. Ideally there would be a way to request a new one programmatically, akin to getting a new IPv4 address via DHCP if you change the MAC address.
  - gerdesj 4y ago
    Dynamic DNS is a thing.
    - yardstick 4y ago
      Doesn’t beat a static IP.
      - gerdesj 4y ago
        Well yes and no. It is rather sad that the internet that we have, what 50-70 odd years post invention is so stifled with nonsense about addressing schemes and that. You seem to use the term "static IP" as a talisman. I have zillions (possibly gazillions) of them on IPv6 and roughly a few 100 or 1000 on IPv4 (I own an IT company). Dynamic DNS is a thing, so is ULA for IPv6 which looks quite like IPv4 RFC1918. We have the tools but you do have to use them.
        yardstick 4y ago
        Try connect to your service on a dynamic IP after it has changed and for whatever reason your dynamic dns update has failed. Or your DNS server of choice has failed (even Google and Cloudflare have had DNS outages). Or your domain has expired/been unceremoniously deregistered from you without warning. All these have happened. And they tend to happen when you need access the most.
starfleet_bop 4y ago
I thought best practice for IPv6 is to essentially ‘ignore’ IP addresses as each NIC can have multiple addresses + the extended length making it unwieldy. Instead you either use a combination of zeroconf / Bonjour for DNS registration / service discovery + stateless IP address assignment (SLACC). If you want full control you can use DHCPv6 which can register hosts on a proper DNS service.
- hotpotamus 4y ago
  Is SLACC still used? I thought it used EUI-64 assignments which leaks MAC addresses which is supposed to be a problem for some reason.
  - throw0101a 4y ago
    > I thought it used EUI-64 assignments which leaks MAC addresses which is supposed to be a problem for some reason. You're about a decade (2007) behind the times: Nodes use IPv6 stateless address autoconfiguration to generate addresses using a combination of locally available information and information advertised by routers. Addresses are formed by combining network prefixes with an interface identifier. On an interface that contains an embedded IEEE Identifier, the interface identifier is typically derived from it. On other interface types, the interface identifier is generated through other means, for example, via random number generation. This document describes an extension to IPv6 stateless address autoconfiguration for interfaces whose interface identifier is derived from an IEEE identifier. Use of the extension causes nodes to generate global scope addresses from interface identifiers that change over time, even in cases where the interface contains an embedded IEEE identifier. Changing the interface identifier (and the global scope addresses generated from it) over time makes it more difficult for eavesdroppers and other information collectors to identify when different addresses used in different transactions actually correspond to the same node. * https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941 This document describes an extension to IPv6 Stateless Address Autoconfiguration that causes hosts to generate temporary addresses with randomized interface identifiers for each prefix advertised with autoconfiguration enabled. Changing addresses over time limits the window of time during which eavesdroppers and other information collectors may trivially perform address-based network-activity correlation when the same address is employed for multiple transactions by the same host. Additionally, it reduces the window of exposure of a host as being accessible via an address that becomes revealed as a result of active communication. This document obsoletes RFC 4941. * https://datatracker.ietf.org/doc/html/rfc8981 https://datatracker.ietf.org/doc/html/rfc8981 * https://en.wikipedia.org/wiki/IPv6_address#Stateless_address_autoconfiguration https://en.wikipedia.org/wiki/IPv6_address#Stateless_address...
throw0101a 4y ago
See also "Reaction of IPv6 Stateless Address Autoconfiguration (SLAAC) to Flash-Renumbering Events": In scenarios where network configuration information related to IPv6 prefixes becomes invalid without any explicit and reliable signaling of that condition (such as when a Customer Edge router crashes and reboots without knowledge of the previously employed prefixes), hosts on the local network may continue using stale prefixes for an unacceptably long time (on the order of several days), thus resulting in connectivity problems. This document describes this issue and discusses operational workarounds that may help to improve network robustness. Additionally, it highlights areas where further work may be needed. * https://datatracker.ietf.org/doc/html/rfc8978 https://datatracker.ietf.org/doc/html/rfc8978
skimo8 4y ago
I use a ULAs (https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address) for this. I have a private, non-routeable subnet, and another non-stable prefix for globally routable addresses. In effect, it's not much different than how IPv4 works with unstable WAN DHCP addresses from your provider, and I don't have the headaches that NAT brings with it. It's a different way to think about the problem, but I've actually found it to be pretty nice.
- josho 4y ago
  Thank you for this! I've been trying to make Link Local Addresses work (https://en.wikipedia.org/wiki/Link-local_address https://en.wikipedia.org/wiki/Link-local_address). But, for tools like ping6 I have to specify the network interface like 'ping6 fe80::1%en1' otherwise routing doesn't work, and doing that complicates everything.
  - thedougd 4y ago
    Try adding mDNS to the mix. Works pretty well for link local addresses.
- dmm 4y ago
  That approach makes a lot of sense. Does your router assign each ULA or do you configure each host with a static one?
- hackeraccount 4y ago
  This is the setup I've ended up on. Seems to work.
littlecranky67 4y ago
Your internal networking should not be affected when you use ULA - those won't change, and IPv6 devices tend to have multiple IPv6. Yes, it won't allow you to address your internal nodes from the external network, but that is something that you didn't have with IPv4+NAT either.
- klysm 4y ago
  How does it work with peering/VPN?
soupbowl 4y ago
I use OPNsense router, ULAs for my devices that need a static local ip. I also host many services over ipv6 with dynamic prefixes by using a DDNS client that scans for ipv6 prefix changes and updates my dns. OPNsense can automatically adjust firewall rules as prefix changes, but your hosted services cannot use ipv6 "privacy addresses". For local lan services I make a dns entry in my router pointing to the ULA. I have had no issues but it took awhile to figure everything out. I host matrix chat and many other services using ipv6 without issues. YMMV.
MisterTea 4y ago
Same but worse with Verizon's FiOS: No ipv6 at all.
- klysm 4y ago
  Iirc FIOS in at least my area is getting v6 this year
sidewndr46 4y ago
Spectrum gives me /128. So I guess I can say they can give me a stable prefix.
- Arnavion 4y ago
  The /128 is what your router gets. After that your router would request a delegated prefix to serve to the LAN, which would be a /64 or bigger. Casual internet search says Spectrum supports delegating /56's.
  - sidewndr46 4y ago
    Even when I request a larger prefix, Spectrum gives me a /128
    - Arnavion 4y ago
      A delegated prefix cannot be smaller than a /64 so no, that's not possible. If you only see one /128 as the IP of your router's WAN interface and nothing else, then that is the /128 assigned to your router by DHCP and nothing to do with prefix delegation.
      - sidewndr46 4y ago
        Yes, a /64 comes in. But the first IPV6 address I use in a prefix, that is the only one that they ever seem to accept traffic for. So functionally, it's a /128.

zokier 4y ago

As I understand it, the idea is to use many addresses per host. I.e. you don't need to use same addresses for internal networking as global networking.

nomel 4y ago

> Which will probably be never. Wouldn't this be like static bluetooth IDs, where you could be tracked wherever you go? I imagine that's a rare desire, amongst the internet population. I could see requesting static IPs for particular devices, like you used to be able to do.

unethical_ban 4y ago
I'm not sure what the best current practices are for mobile, but for residential/business/etc., the most convenient behavior would be for the delegated prefix to be static unless it is requested to be changed. That tends to be the case already with ISPs who grant public IPv4 to customers - it's DHCP whose lease stays the same unless you forcibly change your MAC address or let the lease expire via turning off your modem, and so on. Talking about IPv4 with NAT, a "consumer" with zero server-hosting needs could get away with a changing public IP. Someone with any kind of server needs, like hosting their own Internet-accessible IoT portal, personal VPN, website, game server, etc. would want a stable public IP address. Yeah, that may lead to tracking, but it's the status quo, I suppose is the point. In case it isn't known, IPv6 has so many addresses and is designed in such a way, that it is expected each "network" (think home network) would be given a network prefix of 56 or 60 bits. The "host" portion of an IPv6 address is the final 64 bits of the address. Therefore, each network an ISP issues to a client should have room for something between 16 and 256 subnetworks, each with effectively unlimited client address space.

gerdesj 4y ago

"will not provide a stable prefix" This is pretty horrific. You could investigate ULA which is a bit like RFC1918 addresses for IPv6. You could attach ULA addresses to a few devices such as a local DNS server, printers and the like. NPT would enable you to route your ULA addressed gear to the internets if they don't have a globally routable address.

throw0101a 4y ago
> NPT would enable you to route your ULA addressed gear to the internets if they don't have a globally routable address. One convenient thing about ULA+NPTv6 is that, unlike IPv4 NAT, is that an external IPv6 address is basically 1:1 'equivalent' to an internal IPv6 address. The NPTv6 is stateless so that, firewall rules allowing, a connection can come right in without all sorts of contortions for port mapping. Most (residential) gateways by default block incoming requests unless they're a reply to a previous outgoing connection. I know I can ping6 the iMac I'm typing this on, but attempts to (e.g.) SSH in are blocked by default.
- gerdesj 4y ago
  To spell that out a bit more - a ULA to NPT address is IP based and not port based and is way more useful. When you do a IPv4 "pinhole" port map you get precisely one mapping and it will timeout eventually, which can lead to all sorts of exciting debugging opportunities. IPv4 does have 1:1 NAT but there are so few IPs so whilst I have a /24, 2 x /28 and 2 x /29 to play with and others, I doubt most do. NPTv6 maps an entire address space from A->B and is actually not designed to deal with NATv4 anyway. It is for outbound connections.
  - throw0101a 4y ago
    > To spell that out a bit more - a ULA to NPT address is IP based and not port based and is way more useful. This is implementation specific: on my Asus I can specify to allow in all ports from in via a NPTv6-ULA hole, a port range, or even a single port. If I want to only allow tcp/25 in to a particular IP I can do that, if I want 5900-5910 I can do that too, as well as 1-65535.

fzfaa 4y ago

For your privacy you should be thankful that they do not provide a stable prefix.

unethical_ban 4y ago
For anyone wanting to host a service at their home, you should be regretful not getting a stable prefix. Ideally there would be a way to request a new one programmatically, akin to getting a new IPv4 address via DHCP if you change the MAC address.
- gerdesj 4y ago
  Dynamic DNS is a thing.
  - yardstick 4y ago
    Doesn’t beat a static IP.
    - gerdesj 4y ago
      Well yes and no. It is rather sad that the internet that we have, what 50-70 odd years post invention is so stifled with nonsense about addressing schemes and that. You seem to use the term "static IP" as a talisman. I have zillions (possibly gazillions) of them on IPv6 and roughly a few 100 or 1000 on IPv4 (I own an IT company). Dynamic DNS is a thing, so is ULA for IPv6 which looks quite like IPv4 RFC1918. We have the tools but you do have to use them.
      - yardstick 4y ago
        Try connect to your service on a dynamic IP after it has changed and for whatever reason your dynamic dns update has failed. Or your DNS server of choice has failed (even Google and Cloudflare have had DNS outages). Or your domain has expired/been unceremoniously deregistered from you without warning. All these have happened. And they tend to happen when you need access the most.

starfleet_bop 4y ago

I thought best practice for IPv6 is to essentially ‘ignore’ IP addresses as each NIC can have multiple addresses + the extended length making it unwieldy. Instead you either use a combination of zeroconf / Bonjour for DNS registration / service discovery + stateless IP address assignment (SLACC). If you want full control you can use DHCPv6 which can register hosts on a proper DNS service.

hotpotamus 4y ago
Is SLACC still used? I thought it used EUI-64 assignments which leaks MAC addresses which is supposed to be a problem for some reason.
- throw0101a 4y ago
  > I thought it used EUI-64 assignments which leaks MAC addresses which is supposed to be a problem for some reason. You're about a decade (2007) behind the times: Nodes use IPv6 stateless address autoconfiguration to generate addresses using a combination of locally available information and information advertised by routers. Addresses are formed by combining network prefixes with an interface identifier. On an interface that contains an embedded IEEE Identifier, the interface identifier is typically derived from it. On other interface types, the interface identifier is generated through other means, for example, via random number generation. This document describes an extension to IPv6 stateless address autoconfiguration for interfaces whose interface identifier is derived from an IEEE identifier. Use of the extension causes nodes to generate global scope addresses from interface identifiers that change over time, even in cases where the interface contains an embedded IEEE identifier. Changing the interface identifier (and the global scope addresses generated from it) over time makes it more difficult for eavesdroppers and other information collectors to identify when different addresses used in different transactions actually correspond to the same node. * https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941 This document describes an extension to IPv6 Stateless Address Autoconfiguration that causes hosts to generate temporary addresses with randomized interface identifiers for each prefix advertised with autoconfiguration enabled. Changing addresses over time limits the window of time during which eavesdroppers and other information collectors may trivially perform address-based network-activity correlation when the same address is employed for multiple transactions by the same host. Additionally, it reduces the window of exposure of a host as being accessible via an address that becomes revealed as a result of active communication. This document obsoletes RFC 4941. * https://datatracker.ietf.org/doc/html/rfc8981 https://datatracker.ietf.org/doc/html/rfc8981 * https://en.wikipedia.org/wiki/IPv6_address#Stateless_address_autoconfiguration https://en.wikipedia.org/wiki/IPv6_address#Stateless_address...

throw0101a 4y ago

See also "Reaction of IPv6 Stateless Address Autoconfiguration (SLAAC) to Flash-Renumbering Events": In scenarios where network configuration information related to IPv6 prefixes becomes invalid without any explicit and reliable signaling of that condition (such as when a Customer Edge router crashes and reboots without knowledge of the previously employed prefixes), hosts on the local network may continue using stale prefixes for an unacceptably long time (on the order of several days), thus resulting in connectivity problems. This document describes this issue and discusses operational workarounds that may help to improve network robustness. Additionally, it highlights areas where further work may be needed. * https://datatracker.ietf.org/doc/html/rfc8978 https://datatracker.ietf.org/doc/html/rfc8978

skimo8 4y ago

I use a ULAs (https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address) for this. I have a private, non-routeable subnet, and another non-stable prefix for globally routable addresses. In effect, it's not much different than how IPv4 works with unstable WAN DHCP addresses from your provider, and I don't have the headaches that NAT brings with it. It's a different way to think about the problem, but I've actually found it to be pretty nice.

josho 4y ago
Thank you for this! I've been trying to make Link Local Addresses work (https://en.wikipedia.org/wiki/Link-local_address https://en.wikipedia.org/wiki/Link-local_address). But, for tools like ping6 I have to specify the network interface like 'ping6 fe80::1%en1' otherwise routing doesn't work, and doing that complicates everything.
- thedougd 4y ago
  Try adding mDNS to the mix. Works pretty well for link local addresses.
dmm 4y ago
That approach makes a lot of sense. Does your router assign each ULA or do you configure each host with a static one?
hackeraccount 4y ago
This is the setup I've ended up on. Seems to work.

littlecranky67 4y ago

Your internal networking should not be affected when you use ULA - those won't change, and IPv6 devices tend to have multiple IPv6. Yes, it won't allow you to address your internal nodes from the external network, but that is something that you didn't have with IPv4+NAT either.

klysm 4y ago
How does it work with peering/VPN?

soupbowl 4y ago

I use OPNsense router, ULAs for my devices that need a static local ip. I also host many services over ipv6 with dynamic prefixes by using a DDNS client that scans for ipv6 prefix changes and updates my dns. OPNsense can automatically adjust firewall rules as prefix changes, but your hosted services cannot use ipv6 "privacy addresses". For local lan services I make a dns entry in my router pointing to the ULA. I have had no issues but it took awhile to figure everything out. I host matrix chat and many other services using ipv6 without issues. YMMV.

MisterTea 4y ago

Same but worse with Verizon's FiOS: No ipv6 at all.

klysm 4y ago
Iirc FIOS in at least my area is getting v6 this year

sidewndr46 4y ago

Spectrum gives me /128. So I guess I can say they can give me a stable prefix.

Arnavion 4y ago
The /128 is what your router gets. After that your router would request a delegated prefix to serve to the LAN, which would be a /64 or bigger. Casual internet search says Spectrum supports delegating /56's.
- sidewndr46 4y ago
  Even when I request a larger prefix, Spectrum gives me a /128
  - Arnavion 4y ago
    A delegated prefix cannot be smaller than a /64 so no, that's not possible. If you only see one /128 as the IP of your router's WAN interface and nothing else, then that is the /128 assigned to your router by DHCP and nothing to do with prefix delegation.
    - sidewndr46 4y ago
      Yes, a /64 comes in. But the first IPV6 address I use in a prefix, that is the only one that they ever seem to accept traffic for. So functionally, it's a /128.