5 ms·

I have a few devices on my home internet, on a handful of 192.168 subnets The other week I moved my ISP. The AS my house belonged to obviously changed to the n

I have a few devices on my home internet, on a handful of 192.168 subnets The other week I moved my ISP. The AS my house belonged to obviously changed to the new ISP, and I got a new v4 IP All I had to do was update my Wan router to forward trafffic from the new Ip. Instead with ipv6 I would have to change every node on my network, update my internal DNS. Now in theory I could have my own /48 which I take with me. That relies on my new ISP being willing to advertise it (which my current one does) but it’s not particularly common. However a week ago my phone line was cut. I got a 5g mifi out and moved my wan connectivity through that until the cable was fixed. Again a nice simple masquerade on that interface and all was good (well not that good - very poor signal where I live) But the elephant in the room is of course all that ipv6 stuff aside, I still need to run a dual stack (or use trashy nat abstractions). It increases my work for no benefit. But taking about work, how about there? I have a fleet of vehicles on internal 172.16/12 subnets, they plug together and route to each other, and route from where they are via a variety of vpn connectivity (hoping that at least one method will work, as there’s rarely a signal in the basements these park) If I moved them to ipv6 then again I’m back to having to move my /48s. Except these vehicles get internet from various sporting venues - most of which struggle to turn off MITM/443 or unblock UDP, that’s just not going to work in a world where they turn up at 10am Saturday morning and need to be working 2 hours later. What business benefit is there for me to double the workload and double the risk by moving to dual stack?

pixl97 3y ago
I do believe there is some kind of 1:1 NAT with IPv6 these days, which is way better than 1:Many of IPv4. There are so many potentially useful applications that are DOA because of v4 NAT being everywhere.
- midasuni 3y ago
  Those applications are DOA because of firewall administrators that barely allow tcp/443 through.
deleted 3y ago
[deleted]
noinsight 3y ago
You could be using IPv6 ULA addresses internally on your home network to have static addressing. The real solution is moving to DNS names though with your router maintaining them based on DHCP leases or just using multicast DNS (Zeroconf). In the future you can probably go "IPv6-mostly" with a CLAT engine to ditch dual-stack: https://blog.apnic.net/2022/11/21/deploying-ipv6-mostly-access-networks/ https://blog.apnic.net/2022/11/21/deploying-ipv6-mostly-acce...
- dmatech 3y ago
  You could, but now you have three addresses per node instead of one. Plus, the mechanisms for assigning those addresses are weird compared to DHCP and static assignment. I get that it facilitates packets being routed reliably, but some of us want maintainable firewall rules that don't have to deal with IP addresses changing out of the blue.
  - zamadatix 3y ago
    You can DHCP or static assign those addresses the same. The trick to FW rules is you don't route the local prefix out so you only need rules for anything leaving or anything staying. If you don't need cross subnet communication of your self hosted services you can also get away with just a static link-local and a dynamic general.
- qhwudbebd 3y ago
  > In the future you can probably go "IPv6-mostly" with a CLAT engine ...although there still isn't any kernel support for the necessary SIIT v4<->v6 translation, so to implement CLAT you end up using unmaintained (and unmergeably bad) out-of-tree kernel modules or unmaintained (and slow) userspace daemons hanging off a tuntap interface.
  - dgl 3y ago
    pf on OpenBSD does it fine.
    - 3y ago
jandrese 3y ago
With IPv6 you would do stateless autoconfigurarion, so there would be no manually setting of your addresses. The router would advertise the new prefix and everything would just use it. There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses. One of the primary goals of IPv6 was to avoid needing manual configuration if anything on the network. It is supposed to be as automated as possible.
- 3np 3y ago
  > There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses. Assumptions and dragons be here.
  - midasuni 3y ago
    MDNS, specifically designed for use on a single vlan, so useless
    - dfox 3y ago
      The solution there is DDNS, which is one of the things behind MS AD and just works, and configuring that on pure Unix infrastructure is surprisingly easy.
      - midasuni 3y ago
        Layers and layers of fragile interdependencies, and stop doesn’t remove the need for ipv4
- midasuni 3y ago
  And now I can’t find anything because mdns doesn’t work, half my kit won’t take dns entries, more fragility from systems which don’t exist, or and of course all my open sessions on local networks break as ip addresses change, not to mention all my WireGuard sessions.
- 3y ago
qalmakka 3y ago
In IPv6 you'd do exactly like you'd do with IPv4, by assigning ULAs (private, local addresses) to your machines from fc00::/7. With the (IMHO) big advantage that unless some madman has configured NAT66, the traffic over ULA will *never* get out into the internet. The fact you have GUAs allocated doesn't mean you have to necessarily use them for your internal traffic. Most of the time link local addresses (on small scale, with auto discovery via LLMNR or mDNS) or ULAs are way more convenient than GUAs or IPv4 local addresses.

pixl97 3y ago

I do believe there is some kind of 1:1 NAT with IPv6 these days, which is way better than 1:Many of IPv4. There are so many potentially useful applications that are DOA because of v4 NAT being everywhere.

midasuni 3y ago
Those applications are DOA because of firewall administrators that barely allow tcp/443 through.

deleted 3y ago

[deleted]

noinsight 3y ago

You could be using IPv6 ULA addresses internally on your home network to have static addressing. The real solution is moving to DNS names though with your router maintaining them based on DHCP leases or just using multicast DNS (Zeroconf). In the future you can probably go "IPv6-mostly" with a CLAT engine to ditch dual-stack: https://blog.apnic.net/2022/11/21/deploying-ipv6-mostly-access-networks/ https://blog.apnic.net/2022/11/21/deploying-ipv6-mostly-acce...

dmatech 3y ago
You could, but now you have three addresses per node instead of one. Plus, the mechanisms for assigning those addresses are weird compared to DHCP and static assignment. I get that it facilitates packets being routed reliably, but some of us want maintainable firewall rules that don't have to deal with IP addresses changing out of the blue.
- zamadatix 3y ago
  You can DHCP or static assign those addresses the same. The trick to FW rules is you don't route the local prefix out so you only need rules for anything leaving or anything staying. If you don't need cross subnet communication of your self hosted services you can also get away with just a static link-local and a dynamic general.
qhwudbebd 3y ago
> In the future you can probably go "IPv6-mostly" with a CLAT engine ...although there still isn't any kernel support for the necessary SIIT v4<->v6 translation, so to implement CLAT you end up using unmaintained (and unmergeably bad) out-of-tree kernel modules or unmaintained (and slow) userspace daemons hanging off a tuntap interface.
- dgl 3y ago
  pf on OpenBSD does it fine.
  - 3y ago

jandrese 3y ago

With IPv6 you would do stateless autoconfigurarion, so there would be no manually setting of your addresses. The router would advertise the new prefix and everything would just use it. There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses. One of the primary goals of IPv6 was to avoid needing manual configuration if anything on the network. It is supposed to be as automated as possible.

3np 3y ago
> There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses. Assumptions and dragons be here.
- midasuni 3y ago
  MDNS, specifically designed for use on a single vlan, so useless
  - dfox 3y ago
    The solution there is DDNS, which is one of the things behind MS AD and just works, and configuring that on pure Unix infrastructure is surprisingly easy.
    - midasuni 3y ago
      Layers and layers of fragile interdependencies, and stop doesn’t remove the need for ipv4
midasuni 3y ago
And now I can’t find anything because mdns doesn’t work, half my kit won’t take dns entries, more fragility from systems which don’t exist, or and of course all my open sessions on local networks break as ip addresses change, not to mention all my WireGuard sessions.
3y ago

qalmakka 3y ago

In IPv6 you'd do exactly like you'd do with IPv4, by assigning ULAs (private, local addresses) to your machines from fc00::/7. With the (IMHO) big advantage that unless some madman has configured NAT66, the traffic over ULA will *never* get out into the internet. The fact you have GUAs allocated doesn't mean you have to necessarily use them for your internal traffic. Most of the time link local addresses (on small scale, with auto discovery via LLMNR or mDNS) or ULAs are way more convenient than GUAs or IPv4 local addresses.