3 ms·

How does this: > With IPv4, when your router connects to your ISP, you get one public address for the WAN, and you use a picked private address like 192.168.0.

How does this: > With IPv4, when your router connects to your ISP, you get one public address for the WAN, and you use a picked private address like 192.168.0.0/24 for your LAN. With IPv6, since you want a globally routable address for hosts on your LAN also, you need to ask the ISP for a routable prefix. jive with this: > You want to use these ULA for all your LAN communication. If you want to reach your printer or a media server, put their ULAs in the DNS and not the globally routable one. Why have globally-routable IPv6 addresses if you're not going to use them? I was put off initially by the first quoted paragraph because while the hard-outside-chewy-center security model is not a strong model, it is easy to reason about especially when you have very heterogeneous devices on your home LAN, including ones you don't control the OS of. I like using private addresses for my home LAN and even if I had an IPv4 /24, I wouldn't give addresses from it to machines on my LAN. I use wireguard to access things on my LAN, with a somewhat-janky split-horizen DNS setup where the DNS server is on my LAN, so I have to be connected to wireguard to even resolve the names.

anthropodie 2y ago
> Why have globally-routable IPv6 addresses if you're not going to use them? Because globally routable addresses are not static. Your prefix may change.
- philsnow 2y ago
  I guess I mean, the gist only motivates the use of globally-routable addresses for externally accessible services. If a particular service/device isn't going to be accessed externally, there's no need to give it one.
  - cqqxo4zV46cp 2y ago
    A big part of why I see people talking past each other on this is, IMO, because the solution that seems ‘cleaner’ depends on one’s mental model of networks / IPv6. These can and do differ. One person’s “I need justification to have non-globally-routed addresses” is another person’s “I need justification to have anything else”.
    - hot_gril 2y ago
      There's a belief among some ipv6 proponents that the Internet should primarily be p2p services, meaning everything is globally accessible. This would imply it's not ok for NAT or default-deny firewalls to be common practice.
philsnow 2y ago
Ah: > For your externally visible servers, use dyndns type service, and update it with the globally routable address. Residential internet will rotate the prefix over time (the prefix is dynamic), so this is the same as running a server on a residential dynamic IPv4. > For firewall, drop all inbound packets by default. For externally visible servers, you can match the last 64 bits only, so that changing prefixes don’t affect the firewall rules. Since I don't (currently) want anything at all to be generally externally accessible, it seems that I could just use ULAs for the LAN machines and not assign them globally-routable addresses..... but at that point I guess there's no reason to be configuring IPv6 at all (?), which is exactly the current state of my LAN. I guess if there were services that were better-accessible (or only accessible) over IPv6 that would be a reason.
- throw0101c 2y ago
  > Since I don't (currently) want anything at all to be generally externally accessible, it seems that I could just use ULAs for the LAN machines and not assign them globally-routable addresses..... but at that point I guess there's no reason to be configuring IPv6 at all (?), which is exactly the current state of my LAN. You can have ULA address and globally-routable addresses (GRA) at the same time: they are not mutually exclusive. IPv6 was designed to (possibly) have multiple addresses on the same interface, while with IPv4 this is a (bit of a) 'strange' configuration (to have multiple addresses/aliases). So go ahead and assign a ULA if you wish, but your system will also just get an address which is globally addressable (but not globally reachable address because of firewalls).

anthropodie 2y ago

> Why have globally-routable IPv6 addresses if you're not going to use them? Because globally routable addresses are not static. Your prefix may change.

philsnow 2y ago
I guess I mean, the gist only motivates the use of globally-routable addresses for externally accessible services. If a particular service/device isn't going to be accessed externally, there's no need to give it one.
- cqqxo4zV46cp 2y ago
  A big part of why I see people talking past each other on this is, IMO, because the solution that seems ‘cleaner’ depends on one’s mental model of networks / IPv6. These can and do differ. One person’s “I need justification to have non-globally-routed addresses” is another person’s “I need justification to have anything else”.
  - hot_gril 2y ago
    There's a belief among some ipv6 proponents that the Internet should primarily be p2p services, meaning everything is globally accessible. This would imply it's not ok for NAT or default-deny firewalls to be common practice.

philsnow 2y ago

Ah: > For your externally visible servers, use dyndns type service, and update it with the globally routable address. Residential internet will rotate the prefix over time (the prefix is dynamic), so this is the same as running a server on a residential dynamic IPv4. > For firewall, drop all inbound packets by default. For externally visible servers, you can match the last 64 bits only, so that changing prefixes don’t affect the firewall rules. Since I don't (currently) want anything at all to be generally externally accessible, it seems that I could just use ULAs for the LAN machines and not assign them globally-routable addresses..... but at that point I guess there's no reason to be configuring IPv6 at all (?), which is exactly the current state of my LAN. I guess if there were services that were better-accessible (or only accessible) over IPv6 that would be a reason.

throw0101c 2y ago
> Since I don't (currently) want anything at all to be generally externally accessible, it seems that I could just use ULAs for the LAN machines and not assign them globally-routable addresses..... but at that point I guess there's no reason to be configuring IPv6 at all (?), which is exactly the current state of my LAN. You can have ULA address and globally-routable addresses (GRA) at the same time: they are not mutually exclusive. IPv6 was designed to (possibly) have multiple addresses on the same interface, while with IPv4 this is a (bit of a) 'strange' configuration (to have multiple addresses/aliases). So go ahead and assign a ULA if you wish, but your system will also just get an address which is globally addressable (but not globally reachable address because of firewalls).