4 ms·

One thing I find slightly confusing/frustrating about IPv6. You're discouraged from using ULAs (basically the equivalent of private addresses from v4) as they'

by Macha 3y ago

One thing I find slightly confusing/frustrating about IPv6. You're discouraged from using ULAs (basically the equivalent of private addresses from v4) as they'd rather you use GUAs. But you get your GUAs from your ISP normally, which means if you change your ISP you need to renumber your network. They also generally frown on NPT66. So the supported solution is to get PI space. But to get PI space you need to have an ASN first, which requires you to have public peers, which are you just expected to get someone to peer you and then just firewall all the incoming traffic? These seems to be the one option for stable addresses on a IPv6 network that is not vaguely disapproved of. Or what people actually do is avoid all that complexity and run IPv4 locally and use RFC1918 addreses NAT46, which seems like a self inflicted defeat to the IPv6 first aims of the IETF, IANA and the RIRs.

quantum5 3y ago
You don't actually need an ASN to get PI though? You can use PI just fine with BYOIP. Actually... I don't think you are even required to announce them on the Internet.
- throw0101c 3y ago
  You need the coöperation of the ISP(s), but what you can do is get PI space, run BGP on your router, and use a private ASN (64512-65534) to advertise to your ISP, and then your ISP advertises to the world with their ASN. One common scenario is two links to the same ISP, so everyone knows which link is active (you can do active-active (load balancing/sharing), or change weights or local preference for active-passive): * https://learn.nsrc.org/bgp/two_links_one_isp_backup https://learn.nsrc.org/bgp/two_links_one_isp_backup * https://learn.nsrc.org/bgp/two_links_one_isp_load_balancing https://learn.nsrc.org/bgp/two_links_one_isp_load_balancing
  - quantum5 3y ago
    The whole BGP process with a private ASN that the ISP strips out and replace with their own ASN on the Internet is how "BYOIP" (bring your own IP) usually works.
adevopsguy 3y ago
Can NPTv6 be useful in these scenarios? Disclaimer: I know only the basics of IPv6
dxld 3y ago
You can use ip-token(8) on Linux to define a static interface-id, the part of the IP usually auto-generated based on MAC address when using SLAAC instead of making the whole IP static. In ifupdown I usually just add something like the following pre-up ip token set ::cafe dev $IFACE This way when you get a new GUA there's no need to "renumber" your network manually as everything will just happen automatically. When your router includes a new prefix in the router advertisement all hosts on the LAN generate new addresses for this prefix. Couple of gotchas. 1) The ip-token call has to happen before the interface is marked up (as in ip link set dev $IFACE up, not link presence) so if you want to change it you have to take it down first. 2) If your ISP's router doesn't cleanly announce the old prefix to be deprecated (due to a reboot say) it may remain in use by hosts until it's lifetime expires. See RFC4192 for how renumbering is supposed to work. FYI: I'm working on a small daemon that will monitor RA and deprecated the prefix to handle broken ISP routers. --Daniel
- Macha 3y ago
  This is only a half solution, I'd still need to update all my dns entries and firewall rules, for example
  - dxld 3y ago
    Well dnsmasq has --dynamic-host for this use-case. Example: dynamic-host=cafe.dxld.at,::cafe,lan0 Firewalls tend to support DNS, use it :) I know for a fact nftables and pfSense allow this, worst case you need a cronjob to periodically reload your ruleset to refresh the DNS data as it's evaluated at ruleset load time (for nftables). Incidentally another TODO project of mine is a daemon to allow running scripts when RA information (such as the prefix) changes, this would come in handy here too. For anyone interested in making IPv6 bettter come talk to me in #ipv6:ungleich.ch (Matrix). --Daniel
    - Macha 3y ago
      > Firewalls tend to support DNS, use it :) So I did check and my firewall (the one built into my Unifi UDM), doesn't.
throw0101c 3y ago
> But you get your GUAs from your ISP normally, which means if you change your ISP you need to renumber your network. See perhaps "IPv6 Multihoming without Network Address Translation": Network Address and Port Translation (NAPT) works well for conserving global addresses and addressing multihoming requirements because an IPv4 NAPT router implements three functions: source address selection, next-hop resolution, and (optionally) DNS resolution. For IPv6 hosts, one approach could be the use of IPv6-to-IPv6 Network Prefix Translation (NPTv6). However, NAT and NPTv6 should be avoided, if at all possible, to permit transparent end-to-end connectivity. In this document, we analyze the use cases of multihoming. We also describe functional requirements and possible solutions for multihoming without the use of NAT in IPv6 for hosts and small IPv6 networks that would otherwise be unable to meet minimum IPv6-allocation criteria. We conclude that DHCPv6-based solutions are suitable to solve the multihoming issues described in this document, but NPTv6 may be required as an intermediate solution. * https://datatracker.ietf.org/doc/html/rfc7157 https://datatracker.ietf.org/doc/html/rfc7157 It is generally discouraged, but recognized that it may be needed. Note that NPTv6 is stateless in its address translating (though not stateless with regards to firewalling and connection tracking). Also (the long-titled) "Enterprise Multihoming Using Provider-Assigned IPv6 Addresses without Network Prefix Translation: Requirements and Solutions": * https://datatracker.ietf.org/doc/html/rfc8678 https://datatracker.ietf.org/doc/html/rfc8678
ianburrell 3y ago
One thing is thar length of IPv6 means it is hard to assign addresses manually so need system to automate it. Which makes easier to renumber if change ISP. I didn’t think that ULA is deprecated, what is deprecated is NAT with ULA. The other thing is that can have multiples addresses. It makes sense to have hosts on public IP and servers have public IP and ULA. This is the zero trust approach. The other approach is everything gets ULA and ULA is router on VPNs.
- Macha 3y ago
  It's not that ULA is deprecated, but it discouraged, and this has led to implementation hurdles, like the fact that if you have a device with ULA addresses and GUA addresses, then your device will originate its requests, even to ULAs, from its GUA. So now your firewall rules need to specify the GUA in the source address field, for example, or you need to reconfigure every client directly. (Also if you're running your services on the GUA, then the destination address also needs to reflect that in the firewall rule).

by Macha 3y ago

quantum5 3y ago

You don't actually need an ASN to get PI though? You can use PI just fine with BYOIP. Actually... I don't think you are even required to announce them on the Internet.

throw0101c 3y ago
You need the coöperation of the ISP(s), but what you can do is get PI space, run BGP on your router, and use a private ASN (64512-65534) to advertise to your ISP, and then your ISP advertises to the world with their ASN. One common scenario is two links to the same ISP, so everyone knows which link is active (you can do active-active (load balancing/sharing), or change weights or local preference for active-passive): * https://learn.nsrc.org/bgp/two_links_one_isp_backup https://learn.nsrc.org/bgp/two_links_one_isp_backup * https://learn.nsrc.org/bgp/two_links_one_isp_load_balancing https://learn.nsrc.org/bgp/two_links_one_isp_load_balancing
- quantum5 3y ago
  The whole BGP process with a private ASN that the ISP strips out and replace with their own ASN on the Internet is how "BYOIP" (bring your own IP) usually works.

adevopsguy 3y ago

Can NPTv6 be useful in these scenarios? Disclaimer: I know only the basics of IPv6

dxld 3y ago

You can use ip-token(8) on Linux to define a static interface-id, the part of the IP usually auto-generated based on MAC address when using SLAAC instead of making the whole IP static. In ifupdown I usually just add something like the following pre-up ip token set ::cafe dev $IFACE This way when you get a new GUA there's no need to "renumber" your network manually as everything will just happen automatically. When your router includes a new prefix in the router advertisement all hosts on the LAN generate new addresses for this prefix. Couple of gotchas. 1) The ip-token call has to happen before the interface is marked up (as in ip link set dev $IFACE up, not link presence) so if you want to change it you have to take it down first. 2) If your ISP's router doesn't cleanly announce the old prefix to be deprecated (due to a reboot say) it may remain in use by hosts until it's lifetime expires. See RFC4192 for how renumbering is supposed to work. FYI: I'm working on a small daemon that will monitor RA and deprecated the prefix to handle broken ISP routers. --Daniel

Macha 3y ago
This is only a half solution, I'd still need to update all my dns entries and firewall rules, for example
- dxld 3y ago
  Well dnsmasq has --dynamic-host for this use-case. Example: dynamic-host=cafe.dxld.at,::cafe,lan0 Firewalls tend to support DNS, use it :) I know for a fact nftables and pfSense allow this, worst case you need a cronjob to periodically reload your ruleset to refresh the DNS data as it's evaluated at ruleset load time (for nftables). Incidentally another TODO project of mine is a daemon to allow running scripts when RA information (such as the prefix) changes, this would come in handy here too. For anyone interested in making IPv6 bettter come talk to me in #ipv6:ungleich.ch (Matrix). --Daniel
  - Macha 3y ago
    > Firewalls tend to support DNS, use it :) So I did check and my firewall (the one built into my Unifi UDM), doesn't.

throw0101c 3y ago

> But you get your GUAs from your ISP normally, which means if you change your ISP you need to renumber your network. See perhaps "IPv6 Multihoming without Network Address Translation": Network Address and Port Translation (NAPT) works well for conserving global addresses and addressing multihoming requirements because an IPv4 NAPT router implements three functions: source address selection, next-hop resolution, and (optionally) DNS resolution. For IPv6 hosts, one approach could be the use of IPv6-to-IPv6 Network Prefix Translation (NPTv6). However, NAT and NPTv6 should be avoided, if at all possible, to permit transparent end-to-end connectivity. In this document, we analyze the use cases of multihoming. We also describe functional requirements and possible solutions for multihoming without the use of NAT in IPv6 for hosts and small IPv6 networks that would otherwise be unable to meet minimum IPv6-allocation criteria. We conclude that DHCPv6-based solutions are suitable to solve the multihoming issues described in this document, but NPTv6 may be required as an intermediate solution. * https://datatracker.ietf.org/doc/html/rfc7157 https://datatracker.ietf.org/doc/html/rfc7157 It is generally discouraged, but recognized that it may be needed. Note that NPTv6 is stateless in its address translating (though not stateless with regards to firewalling and connection tracking). Also (the long-titled) "Enterprise Multihoming Using Provider-Assigned IPv6 Addresses without Network Prefix Translation: Requirements and Solutions": * https://datatracker.ietf.org/doc/html/rfc8678 https://datatracker.ietf.org/doc/html/rfc8678

ianburrell 3y ago

One thing is thar length of IPv6 means it is hard to assign addresses manually so need system to automate it. Which makes easier to renumber if change ISP. I didn’t think that ULA is deprecated, what is deprecated is NAT with ULA. The other thing is that can have multiples addresses. It makes sense to have hosts on public IP and servers have public IP and ULA. This is the zero trust approach. The other approach is everything gets ULA and ULA is router on VPNs.

Macha 3y ago
It's not that ULA is deprecated, but it discouraged, and this has led to implementation hurdles, like the fact that if you have a device with ULA addresses and GUA addresses, then your device will originate its requests, even to ULAs, from its GUA. So now your firewall rules need to specify the GUA in the source address field, for example, or you need to reconfigure every client directly. (Also if you're running your services on the GUA, then the destination address also needs to reflect that in the firewall rule).