3 ms·

Does anyone have a good write up of taking ones home network and going 100% ipv6 including dealing with iot devices that can't? I am thinking of doing it but I

Does anyone have a good write up of taking ones home network and going 100% ipv6 including dealing with iot devices that can't? I am thinking of doing it but I have a huge mix of devices from linux to windows and servers.

m463 3y ago
I'm 100% the opposite. Define everything ipv4, turn off ipv6 and have one set of private ip addresses, one set of firewall rules and NAT at the firewall/router.
- hot_gril 3y ago
  Yep, first thing I always do on a new router or PC is get out of the dual stack situation by disabling v6.
menthe 3y ago
There's absolutely _no_ good reason to do that if you're only facing the internet with a single IP on your router as a NAT gateway, except to make your life hell. Only thing that may be worth doing is parting ways with the one internet-facing IPv4 and relying solely on IPv6 there, but that's mostly up to your ISP and their own infrastructure. Even if you were to 100% NAT your IPv4 LAN to IPv6 WAN, and your ISP still dedicated your router a public IPv4, it'd benefit no one.
- BlueTemplar 3y ago
  Why wouldn't you be able to disable IPv4 in the router ? Also, isn't trying to run both IPv4 and IPv6 inherently a security issue coming from the complexity of dealing with two overlapping networks with very different logic ?
  - simiones 3y ago
    Then how would you reach the IPv4-only internet (i.e. a large part of the Internet)?
    - crote 3y ago
      It depends on your ISP, but providers are slowly switching to IPv6-only connections to their customers. The customer's router converts v4 to v6, and a translator at the ISP converts back to v4. If you do the 4-to-6 translation on your own machine, your local router doesn't need to know about v4 at all. This is already happening with mobile networks.
- sschueller 3y ago
  I get a static /48 IPv6 subnet from my ISP so I want to give it a try.
rnhmjoj 3y ago
There's virtually nothing on this, I guess nobody cares enough about IPv6 to spend time to actively remove IPv4 on their home. I did it, mostly for fun and because I hate managing a dual stack: I have been running a 100% IPv6-only network at home for a couple of years, now. It works by having several IPv6-only subnets and a dual stack router (running openwrt) that performs stateful NAT64 [1] using Jool. This allows to access both the IPv4 internet and local IPv4 islands[2] (basically old devices like printers). There's no DHCP or NAPT involved: the router gets a /56 prefix from the ISP and performs prefix delegation, so every device does SLAAC and assigns itself a fully routable IPv6 address. For DNS I use dnscrypt-proxy2: it's very easy to set up and it can do DNS64 and static hostnames mapping. Since prefix is stable, I just assign names to the stable EUI-64 addresses of the hosts I care about. Alternatively you can use bind for DNS64 and mDNS if you don't like manually assigning names. There's also a script to automatically assigns names based on ICMPv6 neighbours discovery [3]. I also host some services on the IPv4 internet from IPv6-only hosts: for this you need the NAT64 equivalent of port forwarding, which is setting up static BIB entries [4]. [1]: https://nicmx.github.io/Jool/en/intro-xlat.html#stateful-nat64 https://nicmx.github.io/Jool/en/intro-xlat.html#stateful-nat... [2]: https://ungleich.ch/u/blog/managing-ipv4-islands-with-jool-and-openwrt/ https://ungleich.ch/u/blog/managing-ipv4-islands-with-jool-a... [3]: https://github.com/AndreBL/ip6neigh/ https://github.com/AndreBL/ip6neigh/ [4]: https://nicmx.github.io/Jool/en/bib.html https://nicmx.github.io/Jool/en/bib.html

m463 3y ago

I'm 100% the opposite. Define everything ipv4, turn off ipv6 and have one set of private ip addresses, one set of firewall rules and NAT at the firewall/router.

hot_gril 3y ago
Yep, first thing I always do on a new router or PC is get out of the dual stack situation by disabling v6.

menthe 3y ago

There's absolutely _no_ good reason to do that if you're only facing the internet with a single IP on your router as a NAT gateway, except to make your life hell. Only thing that may be worth doing is parting ways with the one internet-facing IPv4 and relying solely on IPv6 there, but that's mostly up to your ISP and their own infrastructure. Even if you were to 100% NAT your IPv4 LAN to IPv6 WAN, and your ISP still dedicated your router a public IPv4, it'd benefit no one.

BlueTemplar 3y ago
Why wouldn't you be able to disable IPv4 in the router ? Also, isn't trying to run both IPv4 and IPv6 inherently a security issue coming from the complexity of dealing with two overlapping networks with very different logic ?
- simiones 3y ago
  Then how would you reach the IPv4-only internet (i.e. a large part of the Internet)?
  - crote 3y ago
    It depends on your ISP, but providers are slowly switching to IPv6-only connections to their customers. The customer's router converts v4 to v6, and a translator at the ISP converts back to v4. If you do the 4-to-6 translation on your own machine, your local router doesn't need to know about v4 at all. This is already happening with mobile networks.
sschueller 3y ago
I get a static /48 IPv6 subnet from my ISP so I want to give it a try.

rnhmjoj 3y ago

There's virtually nothing on this, I guess nobody cares enough about IPv6 to spend time to actively remove IPv4 on their home. I did it, mostly for fun and because I hate managing a dual stack: I have been running a 100% IPv6-only network at home for a couple of years, now. It works by having several IPv6-only subnets and a dual stack router (running openwrt) that performs stateful NAT64 [1] using Jool. This allows to access both the IPv4 internet and local IPv4 islands[2] (basically old devices like printers). There's no DHCP or NAPT involved: the router gets a /56 prefix from the ISP and performs prefix delegation, so every device does SLAAC and assigns itself a fully routable IPv6 address. For DNS I use dnscrypt-proxy2: it's very easy to set up and it can do DNS64 and static hostnames mapping. Since prefix is stable, I just assign names to the stable EUI-64 addresses of the hosts I care about. Alternatively you can use bind for DNS64 and mDNS if you don't like manually assigning names. There's also a script to automatically assigns names based on ICMPv6 neighbours discovery [3]. I also host some services on the IPv4 internet from IPv6-only hosts: for this you need the NAT64 equivalent of port forwarding, which is setting up static BIB entries [4]. [1]: https://nicmx.github.io/Jool/en/intro-xlat.html#stateful-nat64 https://nicmx.github.io/Jool/en/intro-xlat.html#stateful-nat... [2]: https://ungleich.ch/u/blog/managing-ipv4-islands-with-jool-and-openwrt/ https://ungleich.ch/u/blog/managing-ipv4-islands-with-jool-a... [3]: https://github.com/AndreBL/ip6neigh/ https://github.com/AndreBL/ip6neigh/ [4]: https://nicmx.github.io/Jool/en/bib.html https://nicmx.github.io/Jool/en/bib.html