4 ms·

But why would you use ULA addresses for anything other than internal networking? What benefits does it provide exactly? And even for internal networking, why n

But why would you use ULA addresses for anything other than internal networking? What benefits does it provide exactly? And even for internal networking, why not just use properly addressable IPv6 addresses? Because you're gonna need a firewall either way. I have a couple of /40s to my name. My internal network has an assignment of /48. It's not announced (and is also firewalled off, not that it matters, since there's no routing table entry for it). The chance of collision is nil, because nobody should ever be using addresses within my IP space. Endpoints that require external connectivity simply have 2 addresses on it. One that's routable, and one that isn't.

greyface- 4y ago
> What benefits does it provide exactly? Address stability. If you use the prefix your ISP gives you via DHCPv6-PD or whatever, it might change on you, and then all of your hard-coded configs are wrong. > And even for internal networking, why not just use properly addressable IPv6 addresses? It costs $250/yr (and hours of bureaucracy navigation) to do this in the ARIN service region. If you've got a prefix, it's certainly a good way to use it! But we can't expect everyone to get PI space.
- ninkendo 4y ago
  I finally decided to learn IPv6 and deploy it on my home network this year, and the lack of stability in the prefix I get from my ISP has been by far the biggest letdown. It basically neuters the whole “you don’t need NAT any more!” dream of IPv6. I’ve taken to having both a ULA prefix and a public prefix for hosts in my subnet, but the public one is basically worthless because it changes seemingly every week. I had to put a ton of effort into making a templated pf.conf updated by a dhcpcd hook so that my firewall rules update automatically, but it’s still a shitshow. When my prefix changes, my router doesn’t seem to want to rescind the old RA’s so now I have two public prefixes floating around and half my hosts can’t get to the Internet any more. I had to drop the lifetime to <1hr to mitigate it but it’s a complete joke. If ipv4 fallback didn’t work I’d have a broken network every week. At this point I’m considering just using NPTv6 and dropping the concept of routable IP’s for my internal hosts altogether. It’s just not worth it. At which point, it’s a stretch to even say IPv6 is worth it.
  - sgjohnson 4y ago
    > At which point, it’s a stretch to even say IPv6 is worth it. ISPs being retarded is not a fault of IPv6 though.
    - ninkendo 4y ago
      Sure, I absolutely agree, Comcast deserves to be named and shamed here. But “not worth it” to me doesn’t mean I’m making a judgment against IPv6 as a protocol suite, just that, in practice Comcast’s shitbaggery makes the whole effort hard to justify. They can give you a static IPv6 prefix, too. But you have to pay extra for a static IPv4 address to get it (which makes what kind of sense?) and you must rent their equipment (ie their router, not just a modem) to get it. So that’s easily $30-$40 more a month (equipment rental plus static IP charge) they’re holding your network hostage for. Pay up or get re-prefixed every week. It really makes me want to puke that they’re literally incentivized to fuck up my network to try and make the extra upcharge seem worth it. There’s no reason whatsoever they couldn’t just give me the same prefix forever. There’s no shortage of IPv6 space. If I had literally any other choice in ISP I’d drop them in a heartbeat. They should all be thrown in jail. Somewhere out there there’s a Comcast engineer whose management told them to intentionally configure their DHCP6-PD server to forget (and likely intentionally shuffle) delegations, to pressure customers into ponying up for a static IP. Maybe you’re reading this post some time in the future. I hate you and I wonder how you sleep at night.
      - ArchOversight 4y ago
        I've had the same IPv6 prefix (/60) from Comcast for over 2 years now. I set up my DHCPv6 client with a stable GUID and even after my equipment being off for a couple of days I still pulled the exact same prefix delegation to my CPE. In my old house where I lived for ~9 years, I had the same IPv6 prefix (/60) from Comcast for a little over 5 years since I turned on IPv6 in 2015 and had not changed until I moved to SF. Sounds like there's something wrong with your CPE where it is not sending the same GUID to the DHCPv6 server and thus is getting a new prefix delegation each time.
- sgjohnson 4y ago
  > Address stability. If you use the prefix your ISP gives you via DHCPv6-PD or whatever, it might change on you, and then all of your hard-coded configs are wrong. Right. I've been using my own address space at home for a while now that I've forgot how dumb ISPs can be. I've got a BGP session on a VPS that's located in the same facility as my ISP (my upstream and by ISP are even peering there, over both, v4 and v6. The only thing missing for me is IXP access, which the VPS provider offers, at €50/month, so in this instance it's not worth paying for, but damn I'd love to give my own ISP the routes to my home network myself), so I'm just running a WireGuard tunnel from that box to my home (mainly because my ISP still doesn't offer any IPv6 whatsoever). This setup actually costs me less than a static IP from my ISP would. They charge €15/month for a static IP. My setup costs me €6/month for the VPS and additional €5/month for the BGP session. I could even do iBGP between the VPS and my home router over that tunnel, but that's far too hardcore. I think the /56 I've given for my home network will be enough for a couple of lifetimes. After all, it's 256 subnets of /64, and how many VLANs do I need at home? :D Unfortunately not everyone can do this. :(
- WirelessGigabit 4y ago
  Yea and the home routers rarely support ULAs. Hell, even UniFi which is supposed to be semi-pro: nothing, can't even disable DHCPv6 when you do DHCPv6 PD. And then there is SRM on Synology... the amount of bugs I have reported on that is insane. Which makes me think: is DNSMASQ the right tool for the job? It's extremely complicated in my opinion. If this, then that, but not when you do that thing over there.
  - ninkendo 4y ago
    UniFi technically supports it but you have to be willing to edit your gateway.config.json to do it, which is very error prone and super easy to screw up. So yeah, it’s still pretty awful. I switched to a plain OpenBSD box as my router because I hated UniFi’s IPv6 support so much.
    - WirelessGigabit 4y ago
      Sadly the UDM range doesn't support gateway.config.json. I think the only OS that handles IPv6 correct is Microtik. But they have no decent all-in-ones.

greyface- 4y ago

> What benefits does it provide exactly? Address stability. If you use the prefix your ISP gives you via DHCPv6-PD or whatever, it might change on you, and then all of your hard-coded configs are wrong. > And even for internal networking, why not just use properly addressable IPv6 addresses? It costs $250/yr (and hours of bureaucracy navigation) to do this in the ARIN service region. If you've got a prefix, it's certainly a good way to use it! But we can't expect everyone to get PI space.

ninkendo 4y ago
I finally decided to learn IPv6 and deploy it on my home network this year, and the lack of stability in the prefix I get from my ISP has been by far the biggest letdown. It basically neuters the whole “you don’t need NAT any more!” dream of IPv6. I’ve taken to having both a ULA prefix and a public prefix for hosts in my subnet, but the public one is basically worthless because it changes seemingly every week. I had to put a ton of effort into making a templated pf.conf updated by a dhcpcd hook so that my firewall rules update automatically, but it’s still a shitshow. When my prefix changes, my router doesn’t seem to want to rescind the old RA’s so now I have two public prefixes floating around and half my hosts can’t get to the Internet any more. I had to drop the lifetime to <1hr to mitigate it but it’s a complete joke. If ipv4 fallback didn’t work I’d have a broken network every week. At this point I’m considering just using NPTv6 and dropping the concept of routable IP’s for my internal hosts altogether. It’s just not worth it. At which point, it’s a stretch to even say IPv6 is worth it.
- sgjohnson 4y ago
  > At which point, it’s a stretch to even say IPv6 is worth it. ISPs being retarded is not a fault of IPv6 though.
  - ninkendo 4y ago
    Sure, I absolutely agree, Comcast deserves to be named and shamed here. But “not worth it” to me doesn’t mean I’m making a judgment against IPv6 as a protocol suite, just that, in practice Comcast’s shitbaggery makes the whole effort hard to justify. They can give you a static IPv6 prefix, too. But you have to pay extra for a static IPv4 address to get it (which makes what kind of sense?) and you must rent their equipment (ie their router, not just a modem) to get it. So that’s easily $30-$40 more a month (equipment rental plus static IP charge) they’re holding your network hostage for. Pay up or get re-prefixed every week. It really makes me want to puke that they’re literally incentivized to fuck up my network to try and make the extra upcharge seem worth it. There’s no reason whatsoever they couldn’t just give me the same prefix forever. There’s no shortage of IPv6 space. If I had literally any other choice in ISP I’d drop them in a heartbeat. They should all be thrown in jail. Somewhere out there there’s a Comcast engineer whose management told them to intentionally configure their DHCP6-PD server to forget (and likely intentionally shuffle) delegations, to pressure customers into ponying up for a static IP. Maybe you’re reading this post some time in the future. I hate you and I wonder how you sleep at night.
    - ArchOversight 4y ago
      I've had the same IPv6 prefix (/60) from Comcast for over 2 years now. I set up my DHCPv6 client with a stable GUID and even after my equipment being off for a couple of days I still pulled the exact same prefix delegation to my CPE. In my old house where I lived for ~9 years, I had the same IPv6 prefix (/60) from Comcast for a little over 5 years since I turned on IPv6 in 2015 and had not changed until I moved to SF. Sounds like there's something wrong with your CPE where it is not sending the same GUID to the DHCPv6 server and thus is getting a new prefix delegation each time.
sgjohnson 4y ago
> Address stability. If you use the prefix your ISP gives you via DHCPv6-PD or whatever, it might change on you, and then all of your hard-coded configs are wrong. Right. I've been using my own address space at home for a while now that I've forgot how dumb ISPs can be. I've got a BGP session on a VPS that's located in the same facility as my ISP (my upstream and by ISP are even peering there, over both, v4 and v6. The only thing missing for me is IXP access, which the VPS provider offers, at €50/month, so in this instance it's not worth paying for, but damn I'd love to give my own ISP the routes to my home network myself), so I'm just running a WireGuard tunnel from that box to my home (mainly because my ISP still doesn't offer any IPv6 whatsoever). This setup actually costs me less than a static IP from my ISP would. They charge €15/month for a static IP. My setup costs me €6/month for the VPS and additional €5/month for the BGP session. I could even do iBGP between the VPS and my home router over that tunnel, but that's far too hardcore. I think the /56 I've given for my home network will be enough for a couple of lifetimes. After all, it's 256 subnets of /64, and how many VLANs do I need at home? :D Unfortunately not everyone can do this. :(
WirelessGigabit 4y ago
Yea and the home routers rarely support ULAs. Hell, even UniFi which is supposed to be semi-pro: nothing, can't even disable DHCPv6 when you do DHCPv6 PD. And then there is SRM on Synology... the amount of bugs I have reported on that is insane. Which makes me think: is DNSMASQ the right tool for the job? It's extremely complicated in my opinion. If this, then that, but not when you do that thing over there.
- ninkendo 4y ago
  UniFi technically supports it but you have to be willing to edit your gateway.config.json to do it, which is very error prone and super easy to screw up. So yeah, it’s still pretty awful. I switched to a plain OpenBSD box as my router because I hated UniFi’s IPv6 support so much.
  - WirelessGigabit 4y ago
    Sadly the UDM range doesn't support gateway.config.json. I think the only OS that handles IPv6 correct is Microtik. But they have no decent all-in-ones.