4 ms·

I have three connections at home both as a way to increase available bandwidth and also to provide some redundancy since I work from home and my ability to earn

I have three connections at home both as a way to increase available bandwidth and also to provide some redundancy since I work from home and my ability to earn income is tied to my internet being up. I have two primary connections that I load balance between, each providing a /56. If either fails, all traffic goes to the other. I have a third connection that is used only as a backup in the event that both the other connections go down, providing a /64. So simple case, I assign an address from each connection out to each device. Except, whoops--the backup ISP only provides a /64 and despite that containing something like 18.5 quintillion addresses (a number so large my spell check is telling me it's not a real word), I can't actually split those up in any meaningful way so I can only allow _one_ subnet to access the internet via that connection. And then I'm pushing responsibility for load balancing between the two primary connections out to each client. You know, to the place with the _least_ useful information for making decisions in this situation. And then I need to figure out how to convince each device to make these decisions individually. (As far as I can tell, with an equal cost, Linux will simply use the most recently added address. So in the event that one of the primary connections is having issues and bouncing up and down, that's going to be the one that all the Linux devices choose to use preferentially. Absolutely what I'd want!) So I give everything a ULA (which I'd want to do anyway so my internet going down doesn't mean my TV can no longer stream media from the server across the house, since that's a reasonable thing to expect to happen) and then look at doing some sort of prefix translation. Except since nobody's using this stuff because it's so very not hard, I hit a bunch of weird edge cases in my network gear trying to do that. Not the least of which is that I need to statically configure the prefix I'm translating _to_ except that's not provided to me statically so now I need to set up some sort of script to monitor the prefix on the external interface and dynamically update my firewall rules? Oh, except apparently the RFC was only updated like a year and a half ago to prefer IPv6 ULA addresses over IPv4 so most devices would end up just using IPv4 anyway and the IPv6 deployment would be little more than a box checking exercise until everything's updated. (Though it looks like that change may never have been adopted anyway?) Last time I was digging in to this, I ended up down a path of starting to file forms with IANA to get a IPv6 block directly allocated so I could use a GUA internally (avoiding the preference issue), do prefix translation for load balancing, and announce the IP range from AWS and tunnel it to my router to work around the /64 issue on the backup connection. Or, or, or... hear me out... I can just... _not_. Nothing is broken right now. I derive no personal value or enjoyment from stacking up a house of cards I'll have to keep standing back up so my toaster can have a globally reachable internet address. People can tell me it's "not hard" all they want, but after... oh hell, 30 years of bending computers and networks to my will, I feel pretty confident in saying either: 1. It is hard; or 2. IPv6 is fundamentally unfit for purpose. I'd be happy for someone to come along and tell me I'm an idiot and _precisely why_ though. Really. Somebody. Please do. Tell me how I am supposed to make this work. I know it's a thing I _should_ be doing but I really can't figure out how.

cyberax 2y ago
There is an RFC proposal to allow SLAAC on networks that are smaller than /64, so you might be able to utilize the third connection and still have an ability to do subnetting. Sometime around 2035.
ninkendo 2y ago
I think “and we’re gonna kill NAT too!” is precisely where IPv6 overstepped and started making things worse for itself. It didn’t need to be this way. NAT sounds like a bad idea at first glance, but it doesn’t exist just to alleviate address shortages (although it does.) It doesn’t just exist to provide security by default either (although it does that too.) NAT is also the only sane choice in residential setups. Because your public IP address prefix isn’t static. That was never going to happen. And just saying “never put an IP address in any configuration file” isn’t a satisfactory answer. When a reprefix happens, and your clients are all only speaking on GUA addresses, your network is going to be fucked until they expire the old addresses. Not in theory, in practice. None of my devices in my household did any sort of reasonable thing when Comcast changes my prefix. I had to just go around and reboot everything. NAT means I am in 100% control over what IP addresses I configure in my own network. It means I can actually run a DNS server and it works. It means I can configure devices with static addresses and it actually works. ULA isn’t some edge case, it’s the only sane option in residential setups. (You know, that thing you need to maximally support in order for ipv6 to have a chance in hell at succeeding.) The IETF finally releasing guidance that ULA’s should be on equal footing to GUA’s feels like them finally admitting that there might be something to this whole NAT thing. It happened entirely too late IMO.
- nucleardog 2y ago
  Yeah, to agree with you in different words-- With IPv4 and NAT, I'm setting up a network. I control it from end-to-end. I can define whatever subnets I want, connect them how I want, put a static IP on my IoT device so Home Assistant can find them reliably, etc. Then I have _a_ point (well, three) where my network touches another network and all configuration and setup around how the two interface and interact is defined and controlled there. With IPv6 the expectation is I'm building out another little piece of someone else's network. Now all the communication within my network is closely intertwined with theirs. There's really no good way for me to handle that today. Using SLAAC so devices update when prefixes change leaves me unable to find/connect to anything. Short of installing a DDNS client on my air quality monitor somehow, how do I manage to connect to it? I can use DHCP6 (not on Android though!) and let the server handle DNS registrations. This would also regain the ability to push a NTP server to clients which would be a nice thing to have. Except now when the prefix changes the devices have no way to know and (like you say) I have to run around and reboot everything. And this still doesn't give me a path to load balancing across multiple connections! I guess really the bigger issue here is the dynamic nature of the prefixes. If I could go log into IANA and click a button and get assigned a /48 then log in to my ISPs' sites and attach it to my connection and be on my way... I'd deploy it today, no problem. I can't see any _technical_ reason that wouldn't be possible. But there isn't a snowball's chance in hell any ISP starts offering that ability on consumer connections when they could be gating it behind having a $5k/mo business connection.

cyberax 2y ago

There is an RFC proposal to allow SLAAC on networks that are smaller than /64, so you might be able to utilize the third connection and still have an ability to do subnetting. Sometime around 2035.

ninkendo 2y ago

I think “and we’re gonna kill NAT too!” is precisely where IPv6 overstepped and started making things worse for itself. It didn’t need to be this way. NAT sounds like a bad idea at first glance, but it doesn’t exist just to alleviate address shortages (although it does.) It doesn’t just exist to provide security by default either (although it does that too.) NAT is also the only sane choice in residential setups. Because your public IP address prefix isn’t static. That was never going to happen. And just saying “never put an IP address in any configuration file” isn’t a satisfactory answer. When a reprefix happens, and your clients are all only speaking on GUA addresses, your network is going to be fucked until they expire the old addresses. Not in theory, in practice. None of my devices in my household did any sort of reasonable thing when Comcast changes my prefix. I had to just go around and reboot everything. NAT means I am in 100% control over what IP addresses I configure in my own network. It means I can actually run a DNS server and it works. It means I can configure devices with static addresses and it actually works. ULA isn’t some edge case, it’s the only sane option in residential setups. (You know, that thing you need to maximally support in order for ipv6 to have a chance in hell at succeeding.) The IETF finally releasing guidance that ULA’s should be on equal footing to GUA’s feels like them finally admitting that there might be something to this whole NAT thing. It happened entirely too late IMO.

nucleardog 2y ago
Yeah, to agree with you in different words-- With IPv4 and NAT, I'm setting up a network. I control it from end-to-end. I can define whatever subnets I want, connect them how I want, put a static IP on my IoT device so Home Assistant can find them reliably, etc. Then I have _a_ point (well, three) where my network touches another network and all configuration and setup around how the two interface and interact is defined and controlled there. With IPv6 the expectation is I'm building out another little piece of someone else's network. Now all the communication within my network is closely intertwined with theirs. There's really no good way for me to handle that today. Using SLAAC so devices update when prefixes change leaves me unable to find/connect to anything. Short of installing a DDNS client on my air quality monitor somehow, how do I manage to connect to it? I can use DHCP6 (not on Android though!) and let the server handle DNS registrations. This would also regain the ability to push a NTP server to clients which would be a nice thing to have. Except now when the prefix changes the devices have no way to know and (like you say) I have to run around and reboot everything. And this still doesn't give me a path to load balancing across multiple connections! I guess really the bigger issue here is the dynamic nature of the prefixes. If I could go log into IANA and click a button and get assigned a /48 then log in to my ISPs' sites and attach it to my connection and be on my way... I'd deploy it today, no problem. I can't see any _technical_ reason that wouldn't be possible. But there isn't a snowball's chance in hell any ISP starts offering that ability on consumer connections when they could be gating it behind having a $5k/mo business connection.