3 ms·

Ah: > For your externally visible servers, use dyndns type service, and update it with the globally routable address. Residential internet will rotate the pref

Ah: > For your externally visible servers, use dyndns type service, and update it with the globally routable address. Residential internet will rotate the prefix over time (the prefix is dynamic), so this is the same as running a server on a residential dynamic IPv4. > For firewall, drop all inbound packets by default. For externally visible servers, you can match the last 64 bits only, so that changing prefixes don’t affect the firewall rules. Since I don't (currently) want anything at all to be generally externally accessible, it seems that I could just use ULAs for the LAN machines and not assign them globally-routable addresses..... but at that point I guess there's no reason to be configuring IPv6 at all (?), which is exactly the current state of my LAN. I guess if there were services that were better-accessible (or only accessible) over IPv6 that would be a reason.

throw0101c 2y ago
> Since I don't (currently) want anything at all to be generally externally accessible, it seems that I could just use ULAs for the LAN machines and not assign them globally-routable addresses..... but at that point I guess there's no reason to be configuring IPv6 at all (?), which is exactly the current state of my LAN. You can have ULA address and globally-routable addresses (GRA) at the same time: they are not mutually exclusive. IPv6 was designed to (possibly) have multiple addresses on the same interface, while with IPv4 this is a (bit of a) 'strange' configuration (to have multiple addresses/aliases). So go ahead and assign a ULA if you wish, but your system will also just get an address which is globally addressable (but not globally reachable address because of firewalls).