5 ms·

I worry that there are problems with Ipv6. Can anyone explain to me if there actually is a way to determine whether an IPv6 is site local? If not, the proposal

I worry that there are problems with Ipv6. Can anyone explain to me if there actually is a way to determine whether an IPv6 is site local? If not, the proposal is going to have problems on IPv6-only networks. I have an struggled with this issue in the past. I have an IoT application whose websever wants to reject any requests from a non-local address. After failing to find a way to distinguish IPv6 local addresses, I ended up redirecting IPv6 requests to the local IPv4 address. And that was the end of that. I feel like I would be in a better position to raise concerns if I could confirm that my understanding is correct: that there is no practical way for an application to determine whether an IPv6 address is link- or site-local. I did experiment with IPv6 "link local" addresses, but these seem to be something else altogether different (for use by routers rather than general applications),and don't seem to work for regular application use. There is some wiggle room provided by including .local address as local servers. But implementation of .local domains seems to be inconsistent across various OSs at present. Raspberry PI OS, for example, will do mDNS resolution of "some_address" but not of "someaddress.local"; Ubuntu 24.04 will resolve "someaddress.local", but not "someaddress". And neither will resolve "someaddress.local." (which I think was recommended at one point, but is now deprecated and non-functional). Which does seems like an issue worth raising. And it frustrates the HECK out of me that nobody will allow use of privately issued certs for local network addresses. The "no https for local addresses" thing needs to be fixed.

donnachangstein 1y ago
> Can anyone explain to me if there is any way to determine whether an inbound IPv6 address is "local"? No, because it's the antithesis of IPv6 which is supposed to be globally routable. The concept isn't supposed to exist. Not to mention Google can't even agree on the meaning of "local" - the article states they completely changed the meaning of "local" to be a redefinition of "private" halfway through brainstorming this garbage. Creating a nonstandard, arbitrary security boundary based on CIDR subnets as an HTTP extension is completely bonkers. As for your application, you're going about it all wrong. Just assume your application is public-facing and design your security with that in mind. Too many applications make this mistake and design saloon-door security into their "local only" application which results in overreaction such as the insanity that is the topic of discussion here. ".local" is reserved for mDNS and is in the RFC, though this is frequently and widely ignored.
- ryanisnan 1y ago
  It's very useful to have this additional information in something like a network address. I agree, you shouldn't rely on it, but IPv6 hasn't clicked with me yet, and the whole "globally routable" concept is one of the reasons. I hear that, and think, no, I don't agree.
  - donnachangstein 1y ago
    Globally routable doesn't mean you don't have firewalls in between filtering and blocking traffic. You can be globally routable but drop all incoming traffic at what you define as a perimeter. E.g. the WAN interface of a typical home network. The concept is frequently misunderstood in that IPv4 consumer SOHO "routers" often combine a NAT and routing function with a firewall, but the functions are separate.
    - ryanisnan 1y ago
      That makes sense. I do love the idea of living in a world without NAT.
      - fiddlerwoaroof 1y ago
        I don’t: NAT may have been a hack at first, but it’s my favorite feature provided by routers and why I disable ipv6 on my local network
        TheDong 1y ago
        Why do you like NAT? Does your router being slower and taking more CPU make you feel happy? Do you enjoy not seeing the correct IP in remote logs, thus making debugging issues harder? Do you like being able to naively nmap your local network fairly easily?
        mixmastamyk 1y ago
        Perf concerns over 32bit numbers ended in the nineties. Who at home cares about remote logs?
gerdesj 1y ago
IPv6 still has the concept of "routable". You just have to decide what site-local means in terms of the routing table. In old school IPv4 you would normally assign octet two to a site and octet three to a VLAN. Oh and you start with 10. With IPv6 you have a lot more options. All IPv6 devices have link local addresses - that's the LAN or local VLAN - a bit like APIPA. Then you start on .local - that's Apple and DNS and the like and nothing to do with IP addresses. That's name to address. You can do Lets Encrypt (ACME) for "local network addresses" (I assume you mean RFC 1918 addresses: 10/8, 172.16/12, 192.168/16) - you need to look into DNS-01 and perhaps DNS CNAME. It does require quite some effort. There is a very good set of reasons why TLS certs are a bit of a bugger to get working effectively these days. There are solutions freely available but they are also quite hard to implement. At least they are free. I remember the days when even packet capture required opening your wallet. You might look into acme.sh if Certbot fails to work for you. You also might need to bolt down IP addressing in general, IPv4 vs IPv6 and DNS and mDNS (and Bonjour) as concepts - you seem a little hazy on that lot. Bon chance mate
globular-toast 1y ago
HTTPS doesn't care about IP addresses. It's all based on domain names. You can get a certificate for any domain you own. You can also set said domain to resolve to any address you like, including a "local" one. NAT has rotted people's brains unfortunately. RFC 1918 is not really the way to tell if something is "local" or not. 25 years ago I had 4 publicly routable IPv4 addresses. All 4 of these were "local" to me despite also being publicly routable. An IP address is local if you can resolve it and don't have to communicate via a router. It seems too far gone, though. People seem unable to separate RFC 1918 from the concept of "local network".

donnachangstein 1y ago

> Can anyone explain to me if there is any way to determine whether an inbound IPv6 address is "local"? No, because it's the antithesis of IPv6 which is supposed to be globally routable. The concept isn't supposed to exist. Not to mention Google can't even agree on the meaning of "local" - the article states they completely changed the meaning of "local" to be a redefinition of "private" halfway through brainstorming this garbage. Creating a nonstandard, arbitrary security boundary based on CIDR subnets as an HTTP extension is completely bonkers. As for your application, you're going about it all wrong. Just assume your application is public-facing and design your security with that in mind. Too many applications make this mistake and design saloon-door security into their "local only" application which results in overreaction such as the insanity that is the topic of discussion here. ".local" is reserved for mDNS and is in the RFC, though this is frequently and widely ignored.

ryanisnan 1y ago
It's very useful to have this additional information in something like a network address. I agree, you shouldn't rely on it, but IPv6 hasn't clicked with me yet, and the whole "globally routable" concept is one of the reasons. I hear that, and think, no, I don't agree.
- donnachangstein 1y ago
  Globally routable doesn't mean you don't have firewalls in between filtering and blocking traffic. You can be globally routable but drop all incoming traffic at what you define as a perimeter. E.g. the WAN interface of a typical home network. The concept is frequently misunderstood in that IPv4 consumer SOHO "routers" often combine a NAT and routing function with a firewall, but the functions are separate.
  - ryanisnan 1y ago
    That makes sense. I do love the idea of living in a world without NAT.
    - fiddlerwoaroof 1y ago
      I don’t: NAT may have been a hack at first, but it’s my favorite feature provided by routers and why I disable ipv6 on my local network
      - TheDong 1y ago
        Why do you like NAT? Does your router being slower and taking more CPU make you feel happy? Do you enjoy not seeing the correct IP in remote logs, thus making debugging issues harder? Do you like being able to naively nmap your local network fairly easily?
        mixmastamyk 1y ago
        Perf concerns over 32bit numbers ended in the nineties. Who at home cares about remote logs?

gerdesj 1y ago

IPv6 still has the concept of "routable". You just have to decide what site-local means in terms of the routing table. In old school IPv4 you would normally assign octet two to a site and octet three to a VLAN. Oh and you start with 10. With IPv6 you have a lot more options. All IPv6 devices have link local addresses - that's the LAN or local VLAN - a bit like APIPA. Then you start on .local - that's Apple and DNS and the like and nothing to do with IP addresses. That's name to address. You can do Lets Encrypt (ACME) for "local network addresses" (I assume you mean RFC 1918 addresses: 10/8, 172.16/12, 192.168/16) - you need to look into DNS-01 and perhaps DNS CNAME. It does require quite some effort. There is a very good set of reasons why TLS certs are a bit of a bugger to get working effectively these days. There are solutions freely available but they are also quite hard to implement. At least they are free. I remember the days when even packet capture required opening your wallet. You might look into acme.sh if Certbot fails to work for you. You also might need to bolt down IP addressing in general, IPv4 vs IPv6 and DNS and mDNS (and Bonjour) as concepts - you seem a little hazy on that lot. Bon chance mate

globular-toast 1y ago

HTTPS doesn't care about IP addresses. It's all based on domain names. You can get a certificate for any domain you own. You can also set said domain to resolve to any address you like, including a "local" one. NAT has rotted people's brains unfortunately. RFC 1918 is not really the way to tell if something is "local" or not. 25 years ago I had 4 publicly routable IPv4 addresses. All 4 of these were "local" to me despite also being publicly routable. An IP address is local if you can resolve it and don't have to communicate via a router. It seems too far gone, though. People seem unable to separate RFC 1918 from the concept of "local network".