12 ms·

Having "grown up" with IPv4, I'm slow to learn everything necessary to set up an IPv6 infrastructure. The times I did look into it, IPv6 seemed so much more com

Having "grown up" with IPv4, I'm slow to learn everything necessary to set up an IPv6 infrastructure. The times I did look into it, IPv6 seemed so much more complicated than IPv4, but maybe that's just because I'm just not familiar with it. Are there any good resources on setting up IPv6 support from first principles? I still get confused as to the "right" way to set up internal networks for IPv6, especially when DHCPv6 isn't universally supported (I'm looking at you Android).

argulane 4y ago
Everything should get its IPv6 configuration via SLAAC. DHCPv6 is only useful when you plan to provide prefix delegation for extra routers or network boot information.
- stevefan1999 4y ago
  just a funny joke: what about using IBGP/OSPF for prefix delegation?
  - justin_oaks 4y ago
    How does that work you have more than one ISP giving you an IPv6 prefix?
    - justin_oaks 4y ago
      Oops. Meant to reply to parent. Now I can't delete the comment.
- tjoff 4y ago
  So how do you do DNS then? Not sure if this is a good source but it had some history to recap, and it doesn't look pretty... https://www.reddit.com/r/networking/comments/ajb2ec/comment/eex3d2c/?utm_source=reddit&utm_medium=web2x&context=3 https://www.reddit.com/r/networking/comments/ajb2ec/comment/... [...] To be honest because of this hot mess if you want to reliably support any possible client you'll need to do both DHCPv6 and RDNSS for DNS information. [...]
  - porbelm 4y ago
    The SLAAC should not change after the host has generated it during installation / first connection, as long as you don't reinstall the OS etc. It's basically no problem. Even better: I can set my own ::/64 so personal servers at home can be ::d3ad:b33f and accessible from outside without NAT. It's beautiful. Firewall configuration is not hard either these days is it?
    - tjoff 4y ago
      So I have to manually configure every device to be able to use internet? Every friends phone that wants to connect to my wifi needs manual setup? That is a problem. To which the solution is IPv4?
      - yesco 4y ago
        Why do you think this? What led you to assuming these things? You would only need to configure any of this if you want to allow external connections, which isn't much different than setting up port forwarding with IPv4 + NAT, except with IPv6 it's less complicated.
        tjoff 4y ago
        Literally the post I answered. Fact: SLAAC does not do DNS. So, my question then is: how do you do DNS? Answer: "The SLAAC should not change after the host has generated it during installation / first connection, as long as you don't reinstall the OS etc." Since SLAAC does not do DNS that answer implies that you'd enter it during connection/installation to complete the config.
        jeroenhd 4y ago
        SLAAC installations can use RDNSS to configure DNS. Windows, according to Wikipedia, doesn't support it, but if you want to please Microsoft there's stateless DHCPv6 (which does not maintain leases, configure addresses, or do anything else that SLAAC doesn't do already; it can be simple piece of software in comparison). On the other hand, Android and ChromeOS don't support DHCPv6 for DNS server provisioning because of Google's opinion about all matters related to DHCPv6. A pain, but not impossible to overcome either. As for unchanging addresses, SLAAC is bound to the device MAC address so a reinstall should give you the same IP. However, you are/should be running privacy extensions, which means your outgoing IP will rotate to prevent tracking (as your IP is based on your MAC address and using that would make tracking way too easy). You'll still have the same primary IP, though, unless you add a second device to the network with the same MAC address.
- pantalaimon 4y ago
  You can even do prefix delegation with SLAAC, although not really in a standard way https://doc.riot-os.org/group__net__gnrc__ipv6__auto__subnets.html https://doc.riot-os.org/group__net__gnrc__ipv6__auto__subnet...
- justin_oaks 4y ago
  How does that work you have more than one ISP giving you an IPv6 prefix?
unethical_ban 4y ago
Bookmarking for future. I want to fill this out but don't have the info in front of me at the moment.
yesco 4y ago
A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember when working with IPv6 are: - IPv6 is very unidirectional, it's not a giant one way waterfall like IPv4/NAT - Routers don't assign addresses, they advertise "prefixes", usually multiple - Routers will usually have a prefix for: Internet, WAN, Link-Local (last one being advertised only to nodes directly connected to it) - Nodes use prefixes to auto-generate an address - Auto generated addresses are usually in the form of "prefix - device_id" so even if a node has a lot of addresses, they are all mostly the same - Usually nodes can easily communicate back and forth across multiple local routers with little configuration or hierarchy - Internet/non-local IPv6 addresses break the rules a bit and don't use a device_id in their addresses in order to protect user privacy - Even if every node has an external address now, you can still configure your firewall to ensure they are isolated from external connections (which is usually the default anyway). You don't need NAT to securely isolate things. - Once you get the hang of it you will realize how easy it makes everything and despair that support for it sucks and everyone makes it harder than they need to Finally for learning resources I honestly recommend just reading the RFCs, I personally learned this way and believe they provide the most direct understanding of the rational behind everything.
- b1zguy 4y ago
  Thanks for the insightful primer!
- cj 4y ago
  I have the technical ability to set up a well structured VPC in AWS with private/public subnets, but I wouldn't know where to start if asked to set up an ipv6-only network. Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets? There's something about a server not being assigned an IP address at all that makes me sleep easy at night (in ipv4 world, you know that server is truly unreachable via public internet)
AdrianB1 4y ago
Growing up implementing IPv4, then moving to a different part of IT, I never found a reason to learn IPv6; it is something that is out there, but not relevant for me. I cannot tell if this good or bad.

argulane 4y ago

Everything should get its IPv6 configuration via SLAAC. DHCPv6 is only useful when you plan to provide prefix delegation for extra routers or network boot information.

stevefan1999 4y ago
just a funny joke: what about using IBGP/OSPF for prefix delegation?
- justin_oaks 4y ago
  How does that work you have more than one ISP giving you an IPv6 prefix?
  - justin_oaks 4y ago
    Oops. Meant to reply to parent. Now I can't delete the comment.
tjoff 4y ago
So how do you do DNS then? Not sure if this is a good source but it had some history to recap, and it doesn't look pretty... https://www.reddit.com/r/networking/comments/ajb2ec/comment/eex3d2c/?utm_source=reddit&utm_medium=web2x&context=3 https://www.reddit.com/r/networking/comments/ajb2ec/comment/... [...] To be honest because of this hot mess if you want to reliably support any possible client you'll need to do both DHCPv6 and RDNSS for DNS information. [...]
- porbelm 4y ago
  The SLAAC should not change after the host has generated it during installation / first connection, as long as you don't reinstall the OS etc. It's basically no problem. Even better: I can set my own ::/64 so personal servers at home can be ::d3ad:b33f and accessible from outside without NAT. It's beautiful. Firewall configuration is not hard either these days is it?
  - tjoff 4y ago
    So I have to manually configure every device to be able to use internet? Every friends phone that wants to connect to my wifi needs manual setup? That is a problem. To which the solution is IPv4?
    - yesco 4y ago
      Why do you think this? What led you to assuming these things? You would only need to configure any of this if you want to allow external connections, which isn't much different than setting up port forwarding with IPv4 + NAT, except with IPv6 it's less complicated.
      - tjoff 4y ago
        Literally the post I answered. Fact: SLAAC does not do DNS. So, my question then is: how do you do DNS? Answer: "The SLAAC should not change after the host has generated it during installation / first connection, as long as you don't reinstall the OS etc." Since SLAAC does not do DNS that answer implies that you'd enter it during connection/installation to complete the config.
        jeroenhd 4y ago
        SLAAC installations can use RDNSS to configure DNS. Windows, according to Wikipedia, doesn't support it, but if you want to please Microsoft there's stateless DHCPv6 (which does not maintain leases, configure addresses, or do anything else that SLAAC doesn't do already; it can be simple piece of software in comparison). On the other hand, Android and ChromeOS don't support DHCPv6 for DNS server provisioning because of Google's opinion about all matters related to DHCPv6. A pain, but not impossible to overcome either. As for unchanging addresses, SLAAC is bound to the device MAC address so a reinstall should give you the same IP. However, you are/should be running privacy extensions, which means your outgoing IP will rotate to prevent tracking (as your IP is based on your MAC address and using that would make tracking way too easy). You'll still have the same primary IP, though, unless you add a second device to the network with the same MAC address.
pantalaimon 4y ago
You can even do prefix delegation with SLAAC, although not really in a standard way https://doc.riot-os.org/group__net__gnrc__ipv6__auto__subnets.html https://doc.riot-os.org/group__net__gnrc__ipv6__auto__subnet...
justin_oaks 4y ago
How does that work you have more than one ISP giving you an IPv6 prefix?

unethical_ban 4y ago

Bookmarking for future. I want to fill this out but don't have the info in front of me at the moment.

yesco 4y ago

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember when working with IPv6 are: - IPv6 is very unidirectional, it's not a giant one way waterfall like IPv4/NAT - Routers don't assign addresses, they advertise "prefixes", usually multiple - Routers will usually have a prefix for: Internet, WAN, Link-Local (last one being advertised only to nodes directly connected to it) - Nodes use prefixes to auto-generate an address - Auto generated addresses are usually in the form of "prefix - device_id" so even if a node has a lot of addresses, they are all mostly the same - Usually nodes can easily communicate back and forth across multiple local routers with little configuration or hierarchy - Internet/non-local IPv6 addresses break the rules a bit and don't use a device_id in their addresses in order to protect user privacy - Even if every node has an external address now, you can still configure your firewall to ensure they are isolated from external connections (which is usually the default anyway). You don't need NAT to securely isolate things. - Once you get the hang of it you will realize how easy it makes everything and despair that support for it sucks and everyone makes it harder than they need to Finally for learning resources I honestly recommend just reading the RFCs, I personally learned this way and believe they provide the most direct understanding of the rational behind everything.

b1zguy 4y ago
Thanks for the insightful primer!
cj 4y ago
I have the technical ability to set up a well structured VPC in AWS with private/public subnets, but I wouldn't know where to start if asked to set up an ipv6-only network. Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets? There's something about a server not being assigned an IP address at all that makes me sleep easy at night (in ipv4 world, you know that server is truly unreachable via public internet)

AdrianB1 4y ago

Growing up implementing IPv4, then moving to a different part of IT, I never found a reason to learn IPv6; it is something that is out there, but not relevant for me. I cannot tell if this good or bad.