4 ms·

The easiest way is to use a ULA on the LAN side instead of the ISP-assigned prefix, and set up NAT66 at the router to convert delegated prefix <-> ULA. It sucks

The easiest way is to use a ULA on the LAN side instead of the ISP-assigned prefix, and set up NAT66 at the router to convert delegated prefix <-> ULA. It sucks having to use NAT with IPv6, but at least it'll be stateless NAT. Then when your delegated prefix changes you will only need to update the NAT rule, meanwhile everything within your LAN that was using ULA-prefixed addresses to talk to each other will continue working. For my own homelab, I give all my machines and VMs static IPs instead of using SLAAC, which also makes it straightforward to register them in DNS, and memorize them in the worst case.

simoncion 2y ago
> The easiest way is to use a ULA on the LAN side instead of the ISP-assigned prefix, and set up NAT66 at the router to convert delegated prefix <-> ULA. You don't need to not use your ISP-assigned globally-routable prefixes. You can use both a ULA and a globally-routable prefix. In my years of experience with fully-functional IPv6 service, I've never noticed an address selection problem... machines always use the globally-routable address as the source for off-LAN communications and (because it's what's in my local DNS) the ULA address for on-LAN communications. The single pitfall I've seen is if your ISP ever "shuts down" [0] that globally-routable prefix, and your border router isn't configured to reject traffic from fc00::/7 going out through the WAN interface, your border router will happily pass traffic out the WAN interface from your not-globally-routable ULA range. > For my own homelab, I give all my machines and VMs static IPs instead of using SLAAC, which also makes it straightforward to register them in DNS... I just configure my machines to use either MAC-based or DUID-based SLAAC address generation, rather than that stupid "privacy addressing" stuff. [0] By this I mean by stopping advertising it, refusing to renew a DHCPv6-PD lease, or similar.

simoncion 2y ago

> The easiest way is to use a ULA on the LAN side instead of the ISP-assigned prefix, and set up NAT66 at the router to convert delegated prefix <-> ULA. You don't need to not use your ISP-assigned globally-routable prefixes. You can use both a ULA and a globally-routable prefix. In my years of experience with fully-functional IPv6 service, I've never noticed an address selection problem... machines always use the globally-routable address as the source for off-LAN communications and (because it's what's in my local DNS) the ULA address for on-LAN communications. The single pitfall I've seen is if your ISP ever "shuts down" [0] that globally-routable prefix, and your border router isn't configured to reject traffic from fc00::/7 going out through the WAN interface, your border router will happily pass traffic out the WAN interface from your not-globally-routable ULA range. > For my own homelab, I give all my machines and VMs static IPs instead of using SLAAC, which also makes it straightforward to register them in DNS... I just configure my machines to use either MAC-based or DUID-based SLAAC address generation, rather than that stupid "privacy addressing" stuff. [0] By this I mean by stopping advertising it, refusing to renew a DHCPv6-PD lease, or similar.