3 ms·

> IPv6 has no subnet masks What? no... I _think_ I see where the author is coming from, but the assumption that your ISP will hand out a single /64 is evidenc

by yrro 2y ago

> IPv6 has no subnet masks What? no... I _think_ I see where the author is coming from, but the assumption that your ISP will hand out a single /64 is evidence of IPv6/NAT-style thinking. The minimum an ISP _should_ hand out to a customer is a /48 <https://www.ripe.net/publications/docs/ripe-690/ https://www.ripe.net/publications/docs/ripe-690/>. Out of this, a customer router should advertise a /64 on each interface, for devices on networks that only want a single address, and hand out /56s or /60s via DHCPv6 IA_PD for devices that want more (e.g, a developer who wants to give a /64 to each of the virtual networks on their laptop for VMs/containers to use). > IPv6 provides no benefit to end-users God no. Getting rid of hole punching, port forwarding and source-address-obscuring masquerading _are_ benefits.

sambull 2y ago
Damn that's terrifying.. I rather obfuscate my traffic inside my network down to a single node at home.
- yrro 2y ago
  Indeed, I believe most end-user devices should use RFC 8981 (Temporary Address Extensions for Stateless Address Autoconfiguration in IPv6) to avoid pervasive monitoring. However you must bear in mind that this does nothing to prevent web browser fingerprinting, so the effective loss of privacy if temporary addresses are not in use is arguably pretty minimal.
wink 2y ago
The should is the problem. I've not looked into this in a couple years but I've read plenty of stories of people getting some weird stuff, down to just 1 ipv6
- yrro 2y ago
  Indeed, regulators need to take so-called ISPs to task and mandate provision of at least a /48 to each customer.
- GoblinSlayer 2y ago
  Isn't router already a NAT? The profit is that it's a configurable NAT unlike draconian CGNAT.
  - unethical_ban 2y ago
    No. NAT should be non existent (or purely optional) in IPv6. In IPv6 the idea is your computer's local IP address is globally routeable.
yrro 2y ago
> Out of this, a customer router should advertise a /64 on each interface, for devices on networks that only want a single address, and hand out /56s or /60s via DHCPv6 IA_PD for devices that want more[...]. That said, support for this in the type of router you see on small networks is non-existent. My Ubiquiti EdgeMAX EdgeRouter, for instance, is perfectly capable of requesting a prefix, and assigning a /64 out of the assigned prefix to each other interface for clients to use. But there's no support for, for instance, splitting the prefix up into subprefixes and handing _them_ out via DHCP6 IA_PD; the generated dhcp6c configuration file has a hardcoded sla-len value of 8. And even if there was, and devices on my network were able to get their own /56s, east/west traffic would have to go via the router instead of being switched directly to the device hosting the virtual network; or the device would have to transmit its own RAs for the delegated prefix, which is a bad idea for security... a lot of assumptions about how we build networks need to be re-visited. (Sadly Ubiquiti's Unifi line has even worse support for IPv6... and I can't in fairness find documentation suggesting that Mikrotik is any better in this regard... any other suggestions please make them!)
- yrro 2y ago
  Correction, Mikrotik might support this after all if I understand https://wu.renjie.im/blog/network/ros-dhcpv6/#enable-dhcpv6-server https://wu.renjie.im/blog/network/ros-dhcpv6/#enable-dhcpv6-... correctly!
GoblinSlayer 2y ago
Specifically push notifications provide a nice use case for server to client connections, for which you currently need to use an additional service that also inspects and censors your notifications for your safety. Also how should I secure the vms? VirtualBox provides NAT and port forwarding settings, but not firewall settings, and I guess it bypasses the host firewall, so I should configure guest firewall?
- yrro 2y ago
  Not following the point for push notifications sorry. Securing VMs: if your hypervisor is now routing packets between your virtual networks and your physical network then you need a packet filter on the hypervisor AND a packet filter on the guest (belt and braces).
deleted 2y ago
[deleted]

by yrro 2y ago

sambull 2y ago

Damn that's terrifying.. I rather obfuscate my traffic inside my network down to a single node at home.

yrro 2y ago
Indeed, I believe most end-user devices should use RFC 8981 (Temporary Address Extensions for Stateless Address Autoconfiguration in IPv6) to avoid pervasive monitoring. However you must bear in mind that this does nothing to prevent web browser fingerprinting, so the effective loss of privacy if temporary addresses are not in use is arguably pretty minimal.

wink 2y ago

The should is the problem. I've not looked into this in a couple years but I've read plenty of stories of people getting some weird stuff, down to just 1 ipv6

yrro 2y ago
Indeed, regulators need to take so-called ISPs to task and mandate provision of at least a /48 to each customer.
GoblinSlayer 2y ago
Isn't router already a NAT? The profit is that it's a configurable NAT unlike draconian CGNAT.
- unethical_ban 2y ago
  No. NAT should be non existent (or purely optional) in IPv6. In IPv6 the idea is your computer's local IP address is globally routeable.

yrro 2y ago

> Out of this, a customer router should advertise a /64 on each interface, for devices on networks that only want a single address, and hand out /56s or /60s via DHCPv6 IA_PD for devices that want more[...]. That said, support for this in the type of router you see on small networks is non-existent. My Ubiquiti EdgeMAX EdgeRouter, for instance, is perfectly capable of requesting a prefix, and assigning a /64 out of the assigned prefix to each other interface for clients to use. But there's no support for, for instance, splitting the prefix up into subprefixes and handing _them_ out via DHCP6 IA_PD; the generated dhcp6c configuration file has a hardcoded sla-len value of 8. And even if there was, and devices on my network were able to get their own /56s, east/west traffic would have to go via the router instead of being switched directly to the device hosting the virtual network; or the device would have to transmit its own RAs for the delegated prefix, which is a bad idea for security... a lot of assumptions about how we build networks need to be re-visited. (Sadly Ubiquiti's Unifi line has even worse support for IPv6... and I can't in fairness find documentation suggesting that Mikrotik is any better in this regard... any other suggestions please make them!)

yrro 2y ago
Correction, Mikrotik might support this after all if I understand https://wu.renjie.im/blog/network/ros-dhcpv6/#enable-dhcpv6-server https://wu.renjie.im/blog/network/ros-dhcpv6/#enable-dhcpv6-... correctly!

GoblinSlayer 2y ago

Specifically push notifications provide a nice use case for server to client connections, for which you currently need to use an additional service that also inspects and censors your notifications for your safety. Also how should I secure the vms? VirtualBox provides NAT and port forwarding settings, but not firewall settings, and I guess it bypasses the host firewall, so I should configure guest firewall?

yrro 2y ago
Not following the point for push notifications sorry. Securing VMs: if your hypervisor is now routing packets between your virtual networks and your physical network then you need a packet filter on the hypervisor AND a packet filter on the guest (belt and braces).

deleted 2y ago

[deleted]