3 ms·
The biggest piece of annoyance I have with IPv6: it's really hard to tell the OS "here's your IPv6 address, here's your gateway, here are your routes, now don't
by JoshTriplett 2y ago
The biggest piece of annoyance I have with IPv6: it's really hard to tell the OS "here's your IPv6 address, here's your gateway, here are your routes, now don't mess with any of it!".
With IPv4 it's easy to set up a static configuration. With IPv6, the Linux kernel is eager to listen to all sorts of advertisements from the network, and it's hard to say "no, stop, don't ever ever listen to anything except my static configuration".
I can bring up IPv4 networking in a tiny fraction of a second. IPv6 networking sometimes takes seconds to settle down and be reliable.
(I'd be interested in any suggestions for how to improve this.)
- teddyh 2y agoIn your /etc/sysctl.d/local.conf: net.ipv6.conf.default.accept_dad=0 net.ipv6.conf.default.accept_ra=0 net.ipv6.conf.default.autoconf=0 Or, in your network startup script (like Debian’s /etc/network/interfaces): sysctl -w net.ipv6.conf.default.accept_dad=0 sysctl -w net.ipv6.conf.default.accept_ra=0 sysctl -w net.ipv6.conf.default.autoconf=0 Or, in your /etc/systemd/network/en0whatever.network: [Network] IPv6AcceptRA=false IPv6DuplicateAddressDetection=0
- Dagger2 2y agoOnly accept_ra=0 is actually needed for static config. autoconf is de-facto disabled if RAs aren't being processed, and DAD is a separate thing (but relevant to the grandparent since it takes a few seconds to finish). Although I'd also argue that you should prefer automatic config over static in general. RAs can set your default route correctly and you can use `ip token` if you really need SLAAC to give you a specific address. I think it's better to be able to just connect machines and have them get the right config rather than need to hand-craft it on each one.
- JoshTriplett 2y agoFor most cases I agree that automatic configuration is the right answer. In this case I'm bringing up virtual machines, as fast as possible, and static is inherently faster and more predictable. Automatic configuration isn't compatible with literally counting milliseconds.
- teddyh 2y agoIf you don’t need link-local addresses, have you tried these? LinkLocalAddressing=no and/or sysctl -w net.ipv6.conf.default.addr_gen_mode=1
- JoshTriplett 2y agoInteresting! I'll look into those, those look helpful.
- teddyh 2y agoI don’t want to trust the network. The network is never secure. Therefore, I don’t want the server to trust any self-proclaimed router with what IP address the server should use. As far as I know, there is no IPsec for RA packets.
- JoshTriplett 2y agoI've previously found and used all three of those, and those help but don't seem to suffice. There's still some degree to which the configuration seems unreliable, and doesn't settle down for a few seconds. (I appreciate the confirmation of those settings, though, and those are all an important part of the setup.)
- nottorp 2y agoNow how do you do it on your phone or windows laptop? :) What if you have multiple internet connections and you want to choose which one you go through? With ipv4 and nat you can just change the default route. And you don't even need to write down the router's address since it's <your prefix for the whole network> dot one number.
- rendaw 2y agoWhat's the use case for static IPv6 configuration?
- alexvitkov 2y agobecause you don't want your server's ip to change.
- tatersolid 2y agoDon’t all modern server OS choose a deterministic interface ID based on the network in the router advertisement? (As I recall this is usually via hashing the MAC with the RA prefix plus some system-wide but stable seed, to avoid using the MAC directly as the interface ID)
- remram 2y agoFor servers, if you have anything pointing to it (DNS, clients pointing to the IP, firewall rules...)