3 ms·

OK, dig responses: DNS1 8.8.8.8 (google, obviously) """ dig -t AAAA ipv4only.arpa @8.8.8.8 ; <<>> DiG 9.18.13 <<>> -t AAAA ipv4only.arpa @8.8.8.8 ;; global opt

OK, dig responses: DNS1 8.8.8.8 (google, obviously) """ dig -t AAAA ipv4only.arpa @8.8.8.8 ; <<>> DiG 9.18.13 <<>> -t AAAA ipv4only.arpa @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19770 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;ipv4only.arpa. IN AAAA ;; AUTHORITY SECTION: ipv4only.arpa. 568 IN SOA sns.dns.icann.org. noc.dns.icann.org. 2022072100 7200 3600 604800 3600 ;; Query time: 14 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP) ;; WHEN: Mon May 01 14:10:21 EDT 2023 ;; MSG SIZE rcvd: 99 """ DNS2 209.244.0.3 (it's at Level3) """ dig -t AAAA ipv4only.arpa @209.244.0.3 ; <<>> DiG 9.18.13 <<>> -t AAAA ipv4only.arpa @209.244.0.3 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14893 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;ipv4only.arpa. IN AAAA ;; AUTHORITY SECTION: ipv4only.arpa. 1481 IN SOA sns.dns.icann.org. noc.dns.icann.org. 2022072100 7200 3600 604800 3600 ;; Query time: 10 msec ;; SERVER: 209.244.0.3#53(209.244.0.3) (UDP) ;; WHEN: Mon May 01 14:11:08 EDT 2023 ;; MSG SIZE rcvd: 88 """ Major question: is something like this feasible with Opnsense as a router, or should I only try it with a Linux solution? Minor related questions: * How much does this complicate my firewalling? * Do I deal with firewalling IPV6 only from the outside world? * Or do I need to worry about RFC1918 addresses on my LAN "leaking" out to the IPv4 world via the IPv6 connection?

csdvrx 3y ago
> Major question: is something like this feasible with Opnsense as a router, or should I only try it with a Linux solution? It should be possible but I'm not familiar with opensense. If you can't use clatd there, you will need some other implementation of 464XLAT. Then, if you want to offer IPv4 on your network, you'll have to use DHCP on a RFC1918 block (ex: offer IPs in 10.1.2.3) and masquerade to the 192.0.0.1 gateway you've created with your 464XLAT implementation (whether clatd or something else) Here you'll have to use tayga as you don't seem to have a GW provided by your ISP level3. > How much does this complicate my firewalling Not much. The ip4 rules would be as before, but the clat interface would be your default ipv4 route so you'd need to replace all instances of `eth0` or `wlan0` by `clat` in your scripts on the machine running clatd > Do I deal with firewalling IPV6 only from the outside world? It depends if you want to firewall IPv6? If you fear some services are reachable by IPv6 while they shouldn't be, use ip6tables. Just remember in IPv6 you should keep icmp flowing as it serves many purposes. You can also decide to not offer IPv6 at all on your lan (making it IPv4 only on 10.1.2.3, with the packets going to clatd 192.0.0.1 on your router) > Or do I need to worry about RFC1918 addresses on my LAN "leaking" out to the IPv4 world via the IPv6 connection? It shouldn't: IIRC 464XLAT implementations will only route non RFC1918 packets. Check the RFCs if you want to be sure, or forge packets to try.

csdvrx 3y ago

> Major question: is something like this feasible with Opnsense as a router, or should I only try it with a Linux solution? It should be possible but I'm not familiar with opensense. If you can't use clatd there, you will need some other implementation of 464XLAT. Then, if you want to offer IPv4 on your network, you'll have to use DHCP on a RFC1918 block (ex: offer IPs in 10.1.2.3) and masquerade to the 192.0.0.1 gateway you've created with your 464XLAT implementation (whether clatd or something else) Here you'll have to use tayga as you don't seem to have a GW provided by your ISP level3. > How much does this complicate my firewalling Not much. The ip4 rules would be as before, but the clat interface would be your default ipv4 route so you'd need to replace all instances of `eth0` or `wlan0` by `clat` in your scripts on the machine running clatd > Do I deal with firewalling IPV6 only from the outside world? It depends if you want to firewall IPv6? If you fear some services are reachable by IPv6 while they shouldn't be, use ip6tables. Just remember in IPv6 you should keep icmp flowing as it serves many purposes. You can also decide to not offer IPv6 at all on your lan (making it IPv4 only on 10.1.2.3, with the packets going to clatd 192.0.0.1 on your router) > Or do I need to worry about RFC1918 addresses on my LAN "leaking" out to the IPv4 world via the IPv6 connection? It shouldn't: IIRC 464XLAT implementations will only route non RFC1918 packets. Check the RFCs if you want to be sure, or forge packets to try.