5 ms·

You should be using dynamic DNS and firewall rules should be on the subnet boundary in this scenario, any decent firewall (including referee PFsense/OpnSense) s

You should be using dynamic DNS and firewall rules should be on the subnet boundary in this scenario, any decent firewall (including referee PFsense/OpnSense) support ACLs that follow IPv6 address changes.

hdgvhicv 10mo ago
I want to send my ssh via my low latency reliable connection, I want to route my streaming via another connection. That’s just a routing rule and srcnat in ipv4 That’s before you go on to using PBR. I want to route traffic with different dscp via different routes. Ultimately I want the rout g to be handled by the network, not by the client. IPv4 and nat makes that a breeze.
- sekh60 10mo ago
  How is it not a routing rule with ipv6? Firewalls and routers typically support dynamic prefixes (even Vyos, pfSense, openSense do).
  - hdgvhicv 10mo ago
    How do I tell my phone that I want to send traffic to server A via isp1 and server B via isp2
    - sekh60 10mo ago
      On your router? edit Less flippantly, what are you wanting to base the routing rule on? What's your ipv4 routing rule? DSCP is allowed in ipv6. https://www.juniper.net/documentation/us/en/software/junos/cos/topics/concept/default-dscp-table-cos-config-guide.html https://www.juniper.net/documentation/us/en/software/junos/c...
      - hdgvhicv 10mo ago
        Without nat, my understanding is the right way in v6 is to issue addresses of every network and then send a message to each end device asking it to use a specific ip address to route traffic and hope every client implements RFC 4191 in the right way.
        nine_k 10mo ago
        NAT66 is a thing.
        hdgvhicv 10mo ago
        So is NAT44. Why is one bad and one good?
        sekh60 10mo ago
        There's a few options I'm aware of. The "proper" way would be to get your own ASN and use BGP to route the traffic. If you're wanting to use a secondary WAN link as a backup for when the other goes down you could have the backup link's LAN have a lower priority. (So I guess hope everything implements RFC 4191 like you said). You can use NAT66/NPTv6 if you want (though it's icky I guess). How are you doing it currently?
        hdgvhicv 10mo ago
        Nat 4, it’s trivial. But IPv6 tell me how terrible nat is despite it being the only solution in both the v6 and v4 world. Sadly my 4g provider will not peer via bgp with me, even if I could provide an AS and Sufficiently large IP range. I think my home ISP will actually peer with me, but I’d have to tunnel to them over my non-fibre connection, and there’s reduced resilience in that case. At work that wouldn’t help at all, there are very few providers for many of our branch offices. So once again ipv6 only works with “icky” nat, or on simple 1990s style connections, and not in the real world of multiple providers. Now sure I can do npt which means I don’t need to keep track of state, but then if I didn’t keep track of state I lose the benefits of a stateful firewall. As such the only benefits of nat on v6 is that source ports will never need to change even if client 1 and client 2 both send to server 1 port 1234 from source port 5555. This helps with a handful of crappy protocols which embed the layer 4 data (port number) in a layer 6 or 7 protocol.
sekh60 10mo ago
The amount of ignorance in these ipv6 posts is astounding (seems to be one every two months). It isn't hard at all, I'm just a homelabber and I have a dual-stack setup for WAN access (HE Tunnel is set up on the router since Bell [my isp] still doesn't give ipv6 address/prefixes to non-mobile users), but my OpenStack and ceph clusters are all ipv6 only, it's easy peasy. Plus subnetting is a heck of a lot less annoying that with ipv4, not that that was difficult either.
- transcriptase 10mo ago
  “it’s easy peasy” says guy who demonstrably already knows and has time to learn a bunch of shit 99.9% of people don’t have the background or inclination to. People like you talking about IPv6 have the same vibe as someone bewildered by the fact that 99.9% of people can’t explain even the most basic equation of differential or integral calculus. That bewilderment is ignorance.
  - Dylan16807 10mo ago
    These people apparently had the time and inclination to learn a bunch of shit about IPv4, though. "Easy" is meant in that context. The people acting like the IPv4 version is easy. So your second paragraph doesn't fit the situation at all.
    - izacus 10mo ago
      "The shit about IPv4" was easy to learn and well documented and supported. "The shit about IPv6" is a mess of approaches that even the biggest fanboys can't agree on and are even less available on equipment used by people in prod. IPv6 has failed wide adoption in 30 decades, calling it "easy" is outright denying the reality and shows the utter dumb obliviousness of people trying to push it and failing to realize where the issues are.
      - nine_k 10mo ago
        Could you share a list of IPv6 issues that IPv4 does not exhibit? Something that becomes materially harder with IPv6? E.g., "IPv6 addresses are long and unwieldy, hard to write down or remember". What else?
bigfatkitten 10mo ago
> You should be using dynamic DNS That doesn't solve the problem. DNS remains broken until each and every device, assuming VERY generously that it is capable of dynamic DNS at all, realises that one of its prefixes has disappeared and it updates its DNS records. With DNS TTL and common default timeouts for prefix lifetime and router lifetime, that can take anywhere from 30 minutes to 30 days. > and firewall rules should be on the subnet boundary in this scenario, any decent firewall (including referee PFsense/OpnSense) support ACLs that follow IPv6 address changes. This requires you to assign one VLAN per device, unless perhaps you've got lots of money, space, and power to buy high end switches that can do EVPN-VXLAN so that you can map MAC addresses to SGTs and filter on those instead.
- nine_k 10mo ago
  > each and every device ... updates its DNS records. What device on your office LAN should maintain its own DNS records? Advertise your own caching DNS server over DHCP(6), give its responses a short TTL (10 sec), make it expire the relevant entries, or the whole cache, when one of your links goes down. I suppose dnsmasq should handle this easily. It seems that the discussion turned away from a multi-homed setup (pooling the bandwidths of two normally reliable links) to an HA/failover setup (with two unreliable links, each regularly down).
  - bigfatkitten 10mo ago
    Every device. It either needs to be able to update DNS by itself (a la Active Directory), or it needs to be able to give the DHCP server a sensible hostname in order for DHCP to make this update on its behalf, which most IoT devices cannot.
magicalhippo 10mo ago
> any decent firewall (including referee PFsense/OpnSense) support ACLs that follow IPv6 address changes In the case of pfSense this is a recent change. It was not supported when I migrated away from it less than five years ago.

hdgvhicv 10mo ago

I want to send my ssh via my low latency reliable connection, I want to route my streaming via another connection. That’s just a routing rule and srcnat in ipv4 That’s before you go on to using PBR. I want to route traffic with different dscp via different routes. Ultimately I want the rout g to be handled by the network, not by the client. IPv4 and nat makes that a breeze.

sekh60 10mo ago
How is it not a routing rule with ipv6? Firewalls and routers typically support dynamic prefixes (even Vyos, pfSense, openSense do).
- hdgvhicv 10mo ago
  How do I tell my phone that I want to send traffic to server A via isp1 and server B via isp2
  - sekh60 10mo ago
    On your router? edit Less flippantly, what are you wanting to base the routing rule on? What's your ipv4 routing rule? DSCP is allowed in ipv6. https://www.juniper.net/documentation/us/en/software/junos/cos/topics/concept/default-dscp-table-cos-config-guide.html https://www.juniper.net/documentation/us/en/software/junos/c...
    - hdgvhicv 10mo ago
      Without nat, my understanding is the right way in v6 is to issue addresses of every network and then send a message to each end device asking it to use a specific ip address to route traffic and hope every client implements RFC 4191 in the right way.
      - nine_k 10mo ago
        NAT66 is a thing.
        hdgvhicv 10mo ago
        So is NAT44. Why is one bad and one good?
      - sekh60 10mo ago
        There's a few options I'm aware of. The "proper" way would be to get your own ASN and use BGP to route the traffic. If you're wanting to use a secondary WAN link as a backup for when the other goes down you could have the backup link's LAN have a lower priority. (So I guess hope everything implements RFC 4191 like you said). You can use NAT66/NPTv6 if you want (though it's icky I guess). How are you doing it currently?
        hdgvhicv 10mo ago
        Nat 4, it’s trivial. But IPv6 tell me how terrible nat is despite it being the only solution in both the v6 and v4 world. Sadly my 4g provider will not peer via bgp with me, even if I could provide an AS and Sufficiently large IP range. I think my home ISP will actually peer with me, but I’d have to tunnel to them over my non-fibre connection, and there’s reduced resilience in that case. At work that wouldn’t help at all, there are very few providers for many of our branch offices. So once again ipv6 only works with “icky” nat, or on simple 1990s style connections, and not in the real world of multiple providers. Now sure I can do npt which means I don’t need to keep track of state, but then if I didn’t keep track of state I lose the benefits of a stateful firewall. As such the only benefits of nat on v6 is that source ports will never need to change even if client 1 and client 2 both send to server 1 port 1234 from source port 5555. This helps with a handful of crappy protocols which embed the layer 4 data (port number) in a layer 6 or 7 protocol.

sekh60 10mo ago

The amount of ignorance in these ipv6 posts is astounding (seems to be one every two months). It isn't hard at all, I'm just a homelabber and I have a dual-stack setup for WAN access (HE Tunnel is set up on the router since Bell [my isp] still doesn't give ipv6 address/prefixes to non-mobile users), but my OpenStack and ceph clusters are all ipv6 only, it's easy peasy. Plus subnetting is a heck of a lot less annoying that with ipv4, not that that was difficult either.

transcriptase 10mo ago
“it’s easy peasy” says guy who demonstrably already knows and has time to learn a bunch of shit 99.9% of people don’t have the background or inclination to. People like you talking about IPv6 have the same vibe as someone bewildered by the fact that 99.9% of people can’t explain even the most basic equation of differential or integral calculus. That bewilderment is ignorance.
- Dylan16807 10mo ago
  These people apparently had the time and inclination to learn a bunch of shit about IPv4, though. "Easy" is meant in that context. The people acting like the IPv4 version is easy. So your second paragraph doesn't fit the situation at all.
  - izacus 10mo ago
    "The shit about IPv4" was easy to learn and well documented and supported. "The shit about IPv6" is a mess of approaches that even the biggest fanboys can't agree on and are even less available on equipment used by people in prod. IPv6 has failed wide adoption in 30 decades, calling it "easy" is outright denying the reality and shows the utter dumb obliviousness of people trying to push it and failing to realize where the issues are.
    - nine_k 10mo ago
      Could you share a list of IPv6 issues that IPv4 does not exhibit? Something that becomes materially harder with IPv6? E.g., "IPv6 addresses are long and unwieldy, hard to write down or remember". What else?

bigfatkitten 10mo ago

> You should be using dynamic DNS That doesn't solve the problem. DNS remains broken until each and every device, assuming VERY generously that it is capable of dynamic DNS at all, realises that one of its prefixes has disappeared and it updates its DNS records. With DNS TTL and common default timeouts for prefix lifetime and router lifetime, that can take anywhere from 30 minutes to 30 days. > and firewall rules should be on the subnet boundary in this scenario, any decent firewall (including referee PFsense/OpnSense) support ACLs that follow IPv6 address changes. This requires you to assign one VLAN per device, unless perhaps you've got lots of money, space, and power to buy high end switches that can do EVPN-VXLAN so that you can map MAC addresses to SGTs and filter on those instead.

nine_k 10mo ago
> each and every device ... updates its DNS records. What device on your office LAN should maintain its own DNS records? Advertise your own caching DNS server over DHCP(6), give its responses a short TTL (10 sec), make it expire the relevant entries, or the whole cache, when one of your links goes down. I suppose dnsmasq should handle this easily. It seems that the discussion turned away from a multi-homed setup (pooling the bandwidths of two normally reliable links) to an HA/failover setup (with two unreliable links, each regularly down).
- bigfatkitten 10mo ago
  Every device. It either needs to be able to update DNS by itself (a la Active Directory), or it needs to be able to give the DHCP server a sensible hostname in order for DHCP to make this update on its behalf, which most IoT devices cannot.

magicalhippo 10mo ago

> any decent firewall (including referee PFsense/OpnSense) support ACLs that follow IPv6 address changes In the case of pfSense this is a recent change. It was not supported when I migrated away from it less than five years ago.