3 ms·

I have an example from my ISP. While it theoretically started with IPv6 all the way back in around 2012, their IPv6 infrastructure still remains quite crippled

I have an example from my ISP. While it theoretically started with IPv6 all the way back in around 2012, their IPv6 infrastructure still remains quite crippled -- they won't even assign you static prefixes, all you get is a DHCPv6 /56 (meaning you can't set a PTR). And the example revolves exactly around filtering and firewalls -- on IPv4 they drop outgoing packets whose source address isn't a part of their subnet -- they prevent source spoofing of other addresses. But on IPv6 they do not do that. I noticed this when their router somehow lost the prefix route to me -- I was informed that their DHCP server adds router dynamically to routers -- and I could still send packets. But I couldn't just send packets from my prefix, but also from any other address, including stuff like 2000::.

jeroenhd 3y ago
That's pretty silly. I wouldn't have much faith in my ISP if they'd mess up that badly. Perhaps the good network engineer that got IPv4 working right left before they could implement IPv6? Or maybe they don't provide enough of a training budget for their engineers to stay up to date on networking technology? Either way, if their core business is doing networking, I'd expect them to be better at this!
eqvinox 3y ago
> their router somehow lost the prefix route to me -- I was informed that their DHCP server adds router dynamically to routers for the curious, that's (in most cases) DHCPv6-PD relay agent operation, https://www.rfc-editor.org/rfc/rfc8987.html#name-general https://www.rfc-editor.org/rfc/rfc8987.html#name-general "Delegating relay": Delegating relay: A delegating relay acts as an intermediate device, forwarding DHCPv6 messages containing IA_PD and IAPREFIX options between the client and server. The delegating relay does not implement a DHCPv6 server function. The delegating relay is also responsible for routing traffic for the delegated prefixes. It's generally done by having the relay be a passive observer of the DHCPv6-PD packets it is relaying between client and server, installing and updating routes for prefixes as needed. That RFC also goes into detail on problems with these setups. What you experienced was probably the loss of state described in section 3.2.
- jesprenj 3y ago
  Thank you!
davidmurdoch 3y ago
I think that's what my ISP (spectrum) does, which has thus prevented me from enabling IPV6 on my router. It works for a little bit, then just stops. Support won't help since I want to use my own hardware.

jeroenhd 3y ago

That's pretty silly. I wouldn't have much faith in my ISP if they'd mess up that badly. Perhaps the good network engineer that got IPv4 working right left before they could implement IPv6? Or maybe they don't provide enough of a training budget for their engineers to stay up to date on networking technology? Either way, if their core business is doing networking, I'd expect them to be better at this!

eqvinox 3y ago

> their router somehow lost the prefix route to me -- I was informed that their DHCP server adds router dynamically to routers for the curious, that's (in most cases) DHCPv6-PD relay agent operation, https://www.rfc-editor.org/rfc/rfc8987.html#name-general https://www.rfc-editor.org/rfc/rfc8987.html#name-general "Delegating relay": Delegating relay: A delegating relay acts as an intermediate device, forwarding DHCPv6 messages containing IA_PD and IAPREFIX options between the client and server. The delegating relay does not implement a DHCPv6 server function. The delegating relay is also responsible for routing traffic for the delegated prefixes. It's generally done by having the relay be a passive observer of the DHCPv6-PD packets it is relaying between client and server, installing and updating routes for prefixes as needed. That RFC also goes into detail on problems with these setups. What you experienced was probably the loss of state described in section 3.2.

jesprenj 3y ago
Thank you!

davidmurdoch 3y ago

I think that's what my ISP (spectrum) does, which has thus prevented me from enabling IPV6 on my router. It works for a little bit, then just stops. Support won't help since I want to use my own hardware.