3 ms·
Ugh, I was under really looking forward to trying out NAT64 one day. Potential complications with DNSSEC never occurred to me. Thanks for the reality check.
by russdill 4y ago
Ugh, I was under really looking forward to trying out NAT64 one day. Potential complications with DNSSEC never occurred to me. Thanks for the reality check.
- neurostimulant 4y agoJust rent a small vps somewhere with dual stack ipv6 and ipv4 and run Tayga on it to make your own NAT64 endpoint.
- jeroenhd 4y agoLuckily (or sadly) many clients still don't do any actual DNSSEC validation instead relying on the outdated mechanism of validating the records on the DNS server and flagging them as secure. You can keep the level of protection most people get from their DNS servers by doing the same; validating DNSSEC before NAT64 before rewriting them and disabling additional validation on the clients if enabled. This does require trust in the connection between your devices and your server, but if you were planning on altering the DNS records automatically anyway, this shouldn't be too much of an issue. Another thing to keep in mind is that some (headless) browsers will switch to DoH automatically depending on your network configuration. To fix this, you can run a DoH server next to the NAT64 server quite easily and configure your devices to use that, or disable DoH entirely. As far as I know only Firefox is enabling DoH in some privacy unfriendly countries, so you'll probably be fine if you forget, but this is something to check if your browser starts having weird issues. TL;DR it'll probably still work