8 ms·

This article hints at what I consider to be the biggest technical drawback to IPv6 for residential use, which is that dynamic prefixes mean your internal LAN IP

This article hints at what I consider to be the biggest technical drawback to IPv6 for residential use, which is that dynamic prefixes mean your internal LAN IPs are never stable. The answer to this is usually something like “duh, use DNS”, but how are you going to configure that DNS server if your whole network’s IP address range could change at any time? Yes, multicast DNS is a thing, but it’s not supported in all software (I’m looking at you, OpenBSD, which has no out of the box support for it and I’ve not figured out how to configure it.) So the real answer is to create a ULA prefix on the side that you generate randomly (or make an easy to remember one because this is residential use, who cares about collisions, it’s a private space) and use that for any use case that involves hardcoded IPs, like DNS server configuration. But it still feels like a compromise to me. I wish more software was “prefixless”, including DNS server indication and even DNS zone files, such that a lack of prefix means “prepend the prefix you are already communicating on”… Firewall configuration would be simpler, DNS zone files could survive re-prefixing, all sorts of configuration could be made to work this way, but instead you’re left with either a ton of automation to reconfigure things when the prefix changes, a bunch of manual work, or just bite the bullet and use ULA. Oh, and did I mention that in my particular setup, all my devices would keep trying to communicate on their old addresses even after a new prefix gets assigned and the new RA’s are sent? Meaning they essentially lose all connectivity if you’re using an IPv6-mostly setup like I have? Oh sure, they grab addresses on the new prefix, but they don’t drop the old one until the lifetime expires, which defaults to 4 hours in the environment I’m in (I think the rad daemon in OpenBSD inherits the lifetimes from its upstream router’s lifetimes, which makes the duration Comcast’s fault, but the proper thing to do is rescind the old RA’s when the interface changes addresses, and rad does not do this out of the box for me, or if it does it doesn’t work right.) Ok rant over. I want to like IPv6 but dynamic prefixes are really the Achilles heel for me.

justahuman74 2y ago
I wish getting and using an IPv6 subnet was like buying a domain name, and that residential ISPs would be required to use your subnet for your service, a bit like portable phone numbers. The current IP allocation/usage procedures are a bit beyond most people
- stephen_g 2y ago
  That would make the routing table exponentially larger though, which would become unworkable… That’s why they mostly only do it for networks big enough to need it.
- zamadatix 2y ago
  A good compromise between this (lots of routing work on the internet) and random prefixes all the time (lots of work on the end user networks) is setting DHCP-PD to do consistent PD assignments. Sure, you're space isn't portable between carriers if you move/have redundant internet but you can also rely on a static address in your assigned range working 3 years from now even if your router is offline for a month. ATT fiber does this. I haven't done a survey of who else.
  - hairyplanter 2y ago
    ULA is still the right solution here. ULA would let you maintain your internal lan with custom subnets and DNS even if you switch carriers or use multiple carriers. No need to update your internal DNS servers for ULA. If you're running a server on your dynamic residential service, you must be using dyndns for ipv4. So do the same with ipv6. Residential random prefixes is the nature of residential networks, as ISPs don't want to preserve state. With a business grade service, you'd get a static prefix, much like static ipv4. Then the only time you need to update anything is when you switch your ISP and need to update global DNS addresses for your servers.
    - yjftsjthsd-h 2y ago
      I guess I'll ask here... How do I learn this? I'm comfortable with IPv4, including DHCP, DNS, VPNs, NAT, whatever. I'd like to be able to set up a v6 network[0] in whatever is the Correct and sane way. Is there a good end-to-end tutorial to set it all up by hand and explain what all these things (RA/DHCPv6/fe80::/ULA/etc.) are and how to use them or why not to use them? [0] Ideally pure v6 if possible; I think there's some way to encapsulate/NAT v4 traffic out from a pure v6 network so I don't actually need dual stack.
zamadatix 2y ago
For those with flatter home network needs but still wanting a few things internal to be reachable by IP I'll throw in you can also use static link locals on fe80:: instead of a random ULA prefix. You'll still need the ULA method if you have multiple subnets and want static services reachable via routing though. Unless the router says the old prefix now has a valid lifetime of 0 the proper thing to do is actually to wait for the prefix to expire like it seems to be doing. I never had this missing lifetime change problem with Comcast but it's very possible they do things differently in different service areas/for different service types.
- hairyplanter 2y ago
  As browsers don't like link local addresses in the address bar, ULA is still better.
  - pantalaimon 2y ago
    You always have to specify the interface that goes with them since they are only guaranteed to be unique on the link.
  - zamadatix 2y ago
    Link local addresses work the same as IPv6 addresses in the url bar, just make sure you're entering the full link local and not the first portion only. Static IPv6 is horrible to enter in browsers in general because you have to remember to [address] as well. Of course, if you're doing it for statically configured local DNS entries as in above then all of this is moot as you'd just use the name.
kccqzy 2y ago
Your rant doesn't make sense. The solution is already known and you mention it: ULA. It's not a compromise. You don't need to bite the bullet. Just use it. It's designed for this use case. Fixed IP address for every single device.
- simoncion 2y ago
  Homie likes to pretend to overcomplicate things. Check the comment history, this rant isn't new. And yeah, folks need to understand that ULA addresses are functionally equivalent to RFC 1918 addresses, and ask themselves why they'd expect an ISP who charges extra for an unchanging globally-routable IPv4 address to give you an unchanging globally-routable IPv6 prefix for free.
  - semi 2y ago
    id assume those unchanging ipv4 addresses are not shared and natted with other customs and thus charging for them makes sense as you're consuming a limited resource they are paying for. That's not the same for not changing an ipv6 address
    - simoncion 2y ago
      > id assume those unchanging ipv4 addresses are not shared and natted with other customs... Over the last several decades of me having residential Internet service from a variety of ISPs here in the US, I've never had an IPv4 address that was not globally-accessible. Relatedly, I've never had a guaranteed-static IPv4 address, but I COULD get one if I paid the ISP additional money. I understand that in other regions of the world NOT being behind CGN is not guaranteed. > That's not the same for not changing an ipv6 address Hopefully you now understand the context in which I made my remarks. In the world that I (and many other folks) live in, I get one globally-accessible, but definitely-not-static IPv4 address.
- ninkendo 2y ago
  How could it not be a compromise? If I use a global unicast prefix, the IPs I see on my devices are their real honest to goodness routable IP. That is great! But I can’t use that IP in any configuration because it will change. That’s not so great. So I have to compromise by not using the routable IP in places where I need to put the address in a config file. Nobody wants ULA. ULA is a solution for the fact that your prefix will change, which I wish didn’t happen. You can say it’s unreasonable to expect a stable prefix (and we could argue about that all day) but don’t pretend it wouldn’t be massively beneficial if I could rely on one. It is absolutely a compromise. A necessary one? Yes. A reasonably simple solution to implement? Yes. But it’s still a compromise.
hairyplanter 2y ago
> or just bite the bullet and use ULA. This is the proper ipv6 solution. With ipv6, one ethernet interface is _supposed_ to have multiple addresses. You wouldn't want your lan routing to stop working when your ISP goes down, right? So configure your internal DNS with ULA (which should be stable for each machine for a given prefix, even with SLAAC) and be done with it, much like internal DNS using private addresses in ipv4. For externally visible servers, do the normal thing, that is, those servers dynamically update global dns, much the same way with ipv4 dyndns. Another learning curve for ipv6 is that people get frustrated by dynamic prefixes, but it's the nature of residential networks: the ISPs want a stateless solution, so customers get a dynamic prefix. Maintaining the same prefix across power outages needs a stateful solution, so only business plans offer them for an extra fee, much like static ipv4 addresses. And we've had dyndns for decades now for exactly that use case. Just keep using that.
- lloeki 2y ago
  > the ISPs want a stateless solution, so customers get a dynamic prefix. Maintaining the same prefix across power outages needs a stateful solution, so only business plans offer them for an extra fee, much like static ipv4 addresses. I'm surprised based on my experience: in 15 years of residential IPv6 usage I've always had the same IPv6 prefix (for a given ISP contract of course), even for those ISPs that insisted on handing out dynamic IPv4 with no option for a static one plus had no qualms renewing the IP at any moment, not just power down. > stateful solution I'm seeing this the other way around: dynamic needs lease tracking while static just needs a permanent record attached to the already present auth mechanism.
  - hairyplanter 2y ago
    My experience is the opposite!
  - eythian 2y ago
    My ISP-given IPv6 (/57 for whatever reason) prefix is also stable, however beware that, at least on my OpenWRT based router, the option to release the prefix back to the ISP when the router is shut down is checked by default. I discovered this when I rebooted for a firmware update and when it came back up my network had renumbered itself.
jeroenhd 2y ago
My IPv6 address is perfectly stable. It's up to the ISP to decide if they bully you into paying extra for a static network or not, but it's an implementation problem. Same with IPv4 assignment, necessitating hacks like DynDNS. If you want stable local addressing, announce a ULA on your LAN. Not all routers support it, unfortunately, but you can announce a ULA from any device. Just don't announce your raspberry Pi as an outbound router. ULAs use SLAAC and will derive at least one IP address from your devices' MAC address. There's a chance of instability if you have devices with the same MAC addresses (there's detection for that problem but you end up with a race condition after a network reboot), but your network will probably break in other ways if you have such a setup.
f_devd 2y ago
My only gripe with IPv6 is that clients use an entire /64, I get it's useful for SLAAC, but I wish I could make clients receive a /68 or more with DHCPv6 so that the address space can be subdivided even when you are already behind a /64 prefix.
- greenicon 2y ago
  That’s exactly what prefix delegation is for. Your ISP ought to give an /56 or more, so you can then have multiple /64. I get an /56 by my ISP and have 6 or so different /64 in my residence.
  - simoncion 2y ago
    Sadly, I've only ever gotten /60s. 16 subnets is better than zero, but it's far less than 256.
  - f_devd 2y ago
    ISPs do give enough where I am the issue is usually when you are behind 2 firewalls past that or have VMs that you want to DHCP, things like that. A real world example my ISP provides /56 at the router level but if you put a firewall behind it, that gets a /64 (cannot be changed). Now the firewall cannot further delegate prefixes since it's already used. Some firewalls allow RA pass-through but in my case this wasn't an option so I had to set up NAT66 (non-standard :/) just to get outbound ipv6 connectivity.
derkades 2y ago
Unfortunately, it seems that support for automatically configuring multiple addresses is quite poor. Linux it can be done with NetworkConfiguration or Netplan: use SLAAC to get a GUA and DHCPv6 for a ULA. NetworkManager also seems to use both by default. Android does not support DHCPv6 at all. I don't know about Windows, iOS, or macOS.
- simoncion 2y ago
  > Unfortunately, it seems that support for automatically configuring multiple addresses is quite poor. What? SLAAC configures addresses on all -er- not-expired prefixes advertised on the link. So, if the border router advertises a ULA prefix and a globally-routeable prefix, SLAAC assigns two addresses to the computer. If whatever network-configuration tooling you're using causes your computer to not generate an address for every advertised prefix (and you've not told the tooling to behave in this way) then it's broken.
simoncion 2y ago
> ...they don’t drop the old one until the lifetime expires... That's a configuration problem on your end. Your border router needs to notice that it's being instructed to switch delegated prefixes and instruct radvd (or whatever route advertising daemon it's using) to advertise the now-defunct prefixes with a zero lifetime just before or just as you're advertising the new prefixes. With this information, devices on your LAN that aren't asleep will do the right thing, and devices that were asleep should reconfigure their network interfaces when they wake up... assuming that the world hasn't changed while they've been asleep is something only morons would do (coughAppleComputerscough).
- ninkendo 2y ago
  rtadvd does support advertising old prefixes with zero lifetime to rescind them. rad does not. I’ll let you guess what daemon is deprecated, and what daemon is the new one you’re supposed to use in OpenBSD. https://undeadly.org/cgi?action=article;sid=20180724072205 https://undeadly.org/cgi?action=article;sid=20180724072205
  - simoncion 2y ago
    [flagged]
    - ninkendo 2y ago
      Oh just fuck right off. You’re already following me around from thread to thread calling me names and now you’re saying I’m using “bad software” for using the built-in, recommended router advertisement daemon on the operating system that has historically always been the absolute best in class at IPv6. You’re being argumentative, you won’t admit when you’re wrong, you treat me like an idiot; in short, you’re a fucking troll. Stop posting.
      - simoncion 2y ago
        Ah. Apologies. With the benefit of hindsight, I can see how my "Oh, that's sad." comment could be misconstrued. My intention here was to say that the fact that the 'rad' software fails to advertise prefixes with a zero lifetime is sad. That's like basic, essential functionality and it's always sad when software fails to implement basic, essential functionality. My intention was NOT to assert that your configuration (or -worse- you, yourself) was sad or whatever. > ...now you’re saying I’m using “bad software” for using the built-in, recommended router advertisement daemon... Yes? It's possible for the recommended thing to be bad software. If you haven't discovered this, you DEFINITELY will as time goes on.
amaccuish 2y ago
Unfortunately I think most OSs will prefer IPv4 over using IPv6 ULA returned from dns.
- g1sm 2y ago
  Yes, as far as I know, the order of preference is GUA > IPv4 > ULA. Which I guess basically means you either have to tweak the preference on each device in your network or you have to go IPv6-only.

justahuman74 2y ago

I wish getting and using an IPv6 subnet was like buying a domain name, and that residential ISPs would be required to use your subnet for your service, a bit like portable phone numbers. The current IP allocation/usage procedures are a bit beyond most people

stephen_g 2y ago
That would make the routing table exponentially larger though, which would become unworkable… That’s why they mostly only do it for networks big enough to need it.
zamadatix 2y ago
A good compromise between this (lots of routing work on the internet) and random prefixes all the time (lots of work on the end user networks) is setting DHCP-PD to do consistent PD assignments. Sure, you're space isn't portable between carriers if you move/have redundant internet but you can also rely on a static address in your assigned range working 3 years from now even if your router is offline for a month. ATT fiber does this. I haven't done a survey of who else.
- hairyplanter 2y ago
  ULA is still the right solution here. ULA would let you maintain your internal lan with custom subnets and DNS even if you switch carriers or use multiple carriers. No need to update your internal DNS servers for ULA. If you're running a server on your dynamic residential service, you must be using dyndns for ipv4. So do the same with ipv6. Residential random prefixes is the nature of residential networks, as ISPs don't want to preserve state. With a business grade service, you'd get a static prefix, much like static ipv4. Then the only time you need to update anything is when you switch your ISP and need to update global DNS addresses for your servers.
  - yjftsjthsd-h 2y ago
    I guess I'll ask here... How do I learn this? I'm comfortable with IPv4, including DHCP, DNS, VPNs, NAT, whatever. I'd like to be able to set up a v6 network[0] in whatever is the Correct and sane way. Is there a good end-to-end tutorial to set it all up by hand and explain what all these things (RA/DHCPv6/fe80::/ULA/etc.) are and how to use them or why not to use them? [0] Ideally pure v6 if possible; I think there's some way to encapsulate/NAT v4 traffic out from a pure v6 network so I don't actually need dual stack.

zamadatix 2y ago

For those with flatter home network needs but still wanting a few things internal to be reachable by IP I'll throw in you can also use static link locals on fe80:: instead of a random ULA prefix. You'll still need the ULA method if you have multiple subnets and want static services reachable via routing though. Unless the router says the old prefix now has a valid lifetime of 0 the proper thing to do is actually to wait for the prefix to expire like it seems to be doing. I never had this missing lifetime change problem with Comcast but it's very possible they do things differently in different service areas/for different service types.

hairyplanter 2y ago
As browsers don't like link local addresses in the address bar, ULA is still better.
- pantalaimon 2y ago
  You always have to specify the interface that goes with them since they are only guaranteed to be unique on the link.
- zamadatix 2y ago
  Link local addresses work the same as IPv6 addresses in the url bar, just make sure you're entering the full link local and not the first portion only. Static IPv6 is horrible to enter in browsers in general because you have to remember to [address] as well. Of course, if you're doing it for statically configured local DNS entries as in above then all of this is moot as you'd just use the name.

kccqzy 2y ago

Your rant doesn't make sense. The solution is already known and you mention it: ULA. It's not a compromise. You don't need to bite the bullet. Just use it. It's designed for this use case. Fixed IP address for every single device.

simoncion 2y ago
Homie likes to pretend to overcomplicate things. Check the comment history, this rant isn't new. And yeah, folks need to understand that ULA addresses are functionally equivalent to RFC 1918 addresses, and ask themselves why they'd expect an ISP who charges extra for an unchanging globally-routable IPv4 address to give you an unchanging globally-routable IPv6 prefix for free.
- semi 2y ago
  id assume those unchanging ipv4 addresses are not shared and natted with other customs and thus charging for them makes sense as you're consuming a limited resource they are paying for. That's not the same for not changing an ipv6 address
  - simoncion 2y ago
    > id assume those unchanging ipv4 addresses are not shared and natted with other customs... Over the last several decades of me having residential Internet service from a variety of ISPs here in the US, I've never had an IPv4 address that was not globally-accessible. Relatedly, I've never had a guaranteed-static IPv4 address, but I COULD get one if I paid the ISP additional money. I understand that in other regions of the world NOT being behind CGN is not guaranteed. > That's not the same for not changing an ipv6 address Hopefully you now understand the context in which I made my remarks. In the world that I (and many other folks) live in, I get one globally-accessible, but definitely-not-static IPv4 address.
ninkendo 2y ago
How could it not be a compromise? If I use a global unicast prefix, the IPs I see on my devices are their real honest to goodness routable IP. That is great! But I can’t use that IP in any configuration because it will change. That’s not so great. So I have to compromise by not using the routable IP in places where I need to put the address in a config file. Nobody wants ULA. ULA is a solution for the fact that your prefix will change, which I wish didn’t happen. You can say it’s unreasonable to expect a stable prefix (and we could argue about that all day) but don’t pretend it wouldn’t be massively beneficial if I could rely on one. It is absolutely a compromise. A necessary one? Yes. A reasonably simple solution to implement? Yes. But it’s still a compromise.

hairyplanter 2y ago

> or just bite the bullet and use ULA. This is the proper ipv6 solution. With ipv6, one ethernet interface is _supposed_ to have multiple addresses. You wouldn't want your lan routing to stop working when your ISP goes down, right? So configure your internal DNS with ULA (which should be stable for each machine for a given prefix, even with SLAAC) and be done with it, much like internal DNS using private addresses in ipv4. For externally visible servers, do the normal thing, that is, those servers dynamically update global dns, much the same way with ipv4 dyndns. Another learning curve for ipv6 is that people get frustrated by dynamic prefixes, but it's the nature of residential networks: the ISPs want a stateless solution, so customers get a dynamic prefix. Maintaining the same prefix across power outages needs a stateful solution, so only business plans offer them for an extra fee, much like static ipv4 addresses. And we've had dyndns for decades now for exactly that use case. Just keep using that.

lloeki 2y ago
> the ISPs want a stateless solution, so customers get a dynamic prefix. Maintaining the same prefix across power outages needs a stateful solution, so only business plans offer them for an extra fee, much like static ipv4 addresses. I'm surprised based on my experience: in 15 years of residential IPv6 usage I've always had the same IPv6 prefix (for a given ISP contract of course), even for those ISPs that insisted on handing out dynamic IPv4 with no option for a static one plus had no qualms renewing the IP at any moment, not just power down. > stateful solution I'm seeing this the other way around: dynamic needs lease tracking while static just needs a permanent record attached to the already present auth mechanism.
- hairyplanter 2y ago
  My experience is the opposite!
- eythian 2y ago
  My ISP-given IPv6 (/57 for whatever reason) prefix is also stable, however beware that, at least on my OpenWRT based router, the option to release the prefix back to the ISP when the router is shut down is checked by default. I discovered this when I rebooted for a firmware update and when it came back up my network had renumbered itself.

jeroenhd 2y ago

My IPv6 address is perfectly stable. It's up to the ISP to decide if they bully you into paying extra for a static network or not, but it's an implementation problem. Same with IPv4 assignment, necessitating hacks like DynDNS. If you want stable local addressing, announce a ULA on your LAN. Not all routers support it, unfortunately, but you can announce a ULA from any device. Just don't announce your raspberry Pi as an outbound router. ULAs use SLAAC and will derive at least one IP address from your devices' MAC address. There's a chance of instability if you have devices with the same MAC addresses (there's detection for that problem but you end up with a race condition after a network reboot), but your network will probably break in other ways if you have such a setup.

f_devd 2y ago

My only gripe with IPv6 is that clients use an entire /64, I get it's useful for SLAAC, but I wish I could make clients receive a /68 or more with DHCPv6 so that the address space can be subdivided even when you are already behind a /64 prefix.

greenicon 2y ago
That’s exactly what prefix delegation is for. Your ISP ought to give an /56 or more, so you can then have multiple /64. I get an /56 by my ISP and have 6 or so different /64 in my residence.
- simoncion 2y ago
  Sadly, I've only ever gotten /60s. 16 subnets is better than zero, but it's far less than 256.
- f_devd 2y ago
  ISPs do give enough where I am the issue is usually when you are behind 2 firewalls past that or have VMs that you want to DHCP, things like that. A real world example my ISP provides /56 at the router level but if you put a firewall behind it, that gets a /64 (cannot be changed). Now the firewall cannot further delegate prefixes since it's already used. Some firewalls allow RA pass-through but in my case this wasn't an option so I had to set up NAT66 (non-standard :/) just to get outbound ipv6 connectivity.

derkades 2y ago

Unfortunately, it seems that support for automatically configuring multiple addresses is quite poor. Linux it can be done with NetworkConfiguration or Netplan: use SLAAC to get a GUA and DHCPv6 for a ULA. NetworkManager also seems to use both by default. Android does not support DHCPv6 at all. I don't know about Windows, iOS, or macOS.

simoncion 2y ago
> Unfortunately, it seems that support for automatically configuring multiple addresses is quite poor. What? SLAAC configures addresses on all -er- not-expired prefixes advertised on the link. So, if the border router advertises a ULA prefix and a globally-routeable prefix, SLAAC assigns two addresses to the computer. If whatever network-configuration tooling you're using causes your computer to not generate an address for every advertised prefix (and you've not told the tooling to behave in this way) then it's broken.

simoncion 2y ago

> ...they don’t drop the old one until the lifetime expires... That's a configuration problem on your end. Your border router needs to notice that it's being instructed to switch delegated prefixes and instruct radvd (or whatever route advertising daemon it's using) to advertise the now-defunct prefixes with a zero lifetime just before or just as you're advertising the new prefixes. With this information, devices on your LAN that aren't asleep will do the right thing, and devices that were asleep should reconfigure their network interfaces when they wake up... assuming that the world hasn't changed while they've been asleep is something only morons would do (coughAppleComputerscough).

ninkendo 2y ago
rtadvd does support advertising old prefixes with zero lifetime to rescind them. rad does not. I’ll let you guess what daemon is deprecated, and what daemon is the new one you’re supposed to use in OpenBSD. https://undeadly.org/cgi?action=article;sid=20180724072205 https://undeadly.org/cgi?action=article;sid=20180724072205
- simoncion 2y ago
  [flagged]
  - ninkendo 2y ago
    Oh just fuck right off. You’re already following me around from thread to thread calling me names and now you’re saying I’m using “bad software” for using the built-in, recommended router advertisement daemon on the operating system that has historically always been the absolute best in class at IPv6. You’re being argumentative, you won’t admit when you’re wrong, you treat me like an idiot; in short, you’re a fucking troll. Stop posting.
    - simoncion 2y ago
      Ah. Apologies. With the benefit of hindsight, I can see how my "Oh, that's sad." comment could be misconstrued. My intention here was to say that the fact that the 'rad' software fails to advertise prefixes with a zero lifetime is sad. That's like basic, essential functionality and it's always sad when software fails to implement basic, essential functionality. My intention was NOT to assert that your configuration (or -worse- you, yourself) was sad or whatever. > ...now you’re saying I’m using “bad software” for using the built-in, recommended router advertisement daemon... Yes? It's possible for the recommended thing to be bad software. If you haven't discovered this, you DEFINITELY will as time goes on.

amaccuish 2y ago

Unfortunately I think most OSs will prefer IPv4 over using IPv6 ULA returned from dns.

g1sm 2y ago
Yes, as far as I know, the order of preference is GUA > IPv4 > ULA. Which I guess basically means you either have to tweak the preference on each device in your network or you have to go IPv6-only.