6 ms·

Do you actually own that /48? The problem with using the globally routable addresses internally is that your public /48 might change in the future, and and that

Do you actually own that /48? The problem with using the globally routable addresses internally is that your public /48 might change in the future, and and that will force you to change a bunch of internal stuff. I have my router set up to advertise two /64 prefixes on each LAN subnet: one from fddd:deca:fbad::/56* that I use for all internal communication, and one from 2001:5a8:xxxx:xxxx::/56 that is only used for talking to the internet. Every device I've ever tested supports this configuration flawlessly, including linux/apple/windows laptops, apple/android mobile devices, an IoT vacuum, and a 10+ year old VoIP phone. My router is a Linux PC, so I can configure radvd however I want (no GUI, I just edit the configs over SSH). Maybe home routers won't let you do this. * You're really supposed to pick a random prefix in fd00::/8, but uniqueness only matters if you intend to merge networks with somebody else later, I care more about it being easy to remember.

compounding_it 7mo ago
>Do you actually own that /48? In my experience the ISP generally fixes a /64 for each customer. So if in the future you change your ISP, you might want to keep the remaining addresses same while just using a script to replace the preceding /64 address.
- jcalvinowens 7mo ago
  Typically it's similar to ipv4, they try to assign the same address/prefix for the same MAC/DUID. The most common reason to lose your addresses is replacing your router. Hopefully new routers allow you to set the dhcpv6 DUID somehow...
  - compounding_it 7mo ago
    I haven't experienced this. For me it's statically assigned but my guess is that the PON serial and/or MAC is being used or the customer ID. I think the ISPs have gotten very automated these days and everything seems to be some sort of SDN. It saves lot of labour hours in troubleshooting like customer forgetting their wifi passwords to their routers.
    - jcalvinowens 7mo ago
      Interesting. Honestly I like having control over it, that would annoy me. I deliberately change the DUID in dhcpcd to force my public addresses to change every so often.
- kccqzy 7mo ago
  My ISPs change the /64 more often. So I use the ULA a lot more often. My router runs its own DNS server and then it advertises this DNS server using a ULA address.
  - miyuru 7mo ago
    I have mentioned this elsewhere, but ISPs should make BYOIPv6 more common, not just to the Business customers. Their are people like OP who do this via a VPS provider that supports BYOIP and then tunnel to the VPS network, so there is a demand. https://news.ycombinator.com/item?id=47355038 https://news.ycombinator.com/item?id=47355038
    - jcalvinowens 7mo ago
      I've never heard of an end user ISP that would announce and route a customer owned block of addresses. They'll all give you a static allocation, but it will be in their block. Maybe if you were a huge customer they could do it... but I can't believe they would go to that much trouble for the measly <$100/month they get from me. Also, I very much don't want all my outbound internet traffic to come from a permanent address range I am publicly known to own. I'd still want an ephemeral /56 for outbound traffic that changed from time to time.
uyzstvqs 7mo ago
Ideally it'll be standard that your DHCP will assign you both an internet IP from your ISP-provided prefix (dynamic or static), and private IP from a ULA prefix, which can be made static through address reservation.
- jcalvinowens 7mo ago
  Don't use DCHPv6 at home. I tried: you will hate your life, lots of stuff doesn't support it. Android specifically has zero support for it, google says it never will. Use SLAAC. It just works.
  - yjftsjthsd-h 7mo ago
    How do you handle internal DNS? I'd really like `curl http://mylaptop.internal http://mylaptop.internal` (or so) to work; that's easy with DHCP.
    - kstrauser 7mo ago
      Every device on my LAN handles mDNS, or at least the ones I SSH to do.
    - hbogert 7mo ago
      Nothing is stopping your router which does RA to also work in tandem with an internal dns server that can do hostnames for you mapped to slaac addresses.
      - yjftsjthsd-h 7mo ago
        I'm not sure I follow? AIUI, RA lets you tell hosts about a DNS server, and an internal DNS server could have AAAA records pointing at SLAAC addresses, but how would it know what hostnames go to those addresses?
        hbogert 7mo ago
        Oof you are right. It seems openwrt does something smart that only works for dual stacked hosts.
simoncion 7mo ago
> Do you actually own that /48? Well. From TFA: So I decided to use Free Range Cloud service provider to lease a /48, which cost me around C$10/year. I also used their tunnel service to then route this over to me. The link embedded in the pull quote is [0], which isn't maximally helpful, but it's useful. Approximately 60 seconds of poking around there brings us to [1], which quotes a "ARIN - /48 IPv6 lease ... Use on our network or yours" for $8/year with a $2 setup fee. That sounds a lot like what's mentioned in TFA. So. You tell me? [0] <https://freerangecloud.com/ https://freerangecloud.com/> [1] <https://freerangecloud.com/products.php https://freerangecloud.com/products.php>
- jcalvinowens 7mo ago
  It's was a rhetorical question, he doesn't own it. And it takes much less than sixty seconds to figure that out: $ whois 2602:fed2:7e02:: ... NetRange: 2602:FED2:: - 2602:FED2:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF CIDR: 2602:FED2::/32 NetName: 10VPN-PRIMARY NetHandle: NET6-2602-FED2-1 Parent: NET6-2600 (NET6-2600-1) NetType: Direct Allocation If that VPN provider goes out of business, he probably loses those addresses.
  - simoncion 7mo ago
    You must be aware that he owns the allocation in exactly the same way you "own" an ARIN allocation? Unless you have an exemption, there are fees that you must pay annually [0]. If you do not pay them, you relinquish your assignment. [1] There's another sense in which he owns the allocation... the one you constructed in your original question: Do you actually own that /48? The problem with using the globally routable addresses internally is that your public /48 might change in the future, and and that will force you to change a bunch of internal stuff. He's paying his money to get a statically assigned /48. It's not too surprising that you can't get this information out of a whois invocation. It is -however- a bit surprising that you weren't aware that whois couldn't tell you this. [0] <https://www.arin.net/resources/fees/fee_schedule/#rsp-service-categories-and-fees https://www.arin.net/resources/fees/fee_schedule/#rsp-servic...> [1] See section 4(c) of <https://www.arin.net/about/corporate/agreements/rsa.pdf https://www.arin.net/about/corporate/agreements/rsa.pdf>
simoncion 7mo ago
> * You're really supposed to pick a random prefix in fd00::/8, but uniqueness only matters if you intend to merge networks with somebody else later, I care more about it being easy to remember. If you don't care about collision resistance, why didn't you pick fd00:: ? That's way easier to remember than that jumble of letters you selected. It's actually my go-to subnet when someone claims that local-only IPv6 addresses are "hard to remember". fd00::1 is notably shorter than 10.0.0.1.
- mr_mitm 7mo ago
  You can write it as 10.1 though
  - simoncion 7mo ago
    You could, sure. You shouldn't, because not only is it nonstandard, roughly noone writes it that way. Without consulting documentation or otherwise querying external memory, tell me what is 10.1.1?
- jcalvinowens 7mo ago
  Heh, fair enough. I picked it because it makes me laugh when I have to type it (say it in Elmer Fudd's voice). I don't actually type it very often.
- boredatoms 7mo ago
  fddd:: is easier to type than fd00::

compounding_it 7mo ago

>Do you actually own that /48? In my experience the ISP generally fixes a /64 for each customer. So if in the future you change your ISP, you might want to keep the remaining addresses same while just using a script to replace the preceding /64 address.

jcalvinowens 7mo ago
Typically it's similar to ipv4, they try to assign the same address/prefix for the same MAC/DUID. The most common reason to lose your addresses is replacing your router. Hopefully new routers allow you to set the dhcpv6 DUID somehow...
- compounding_it 7mo ago
  I haven't experienced this. For me it's statically assigned but my guess is that the PON serial and/or MAC is being used or the customer ID. I think the ISPs have gotten very automated these days and everything seems to be some sort of SDN. It saves lot of labour hours in troubleshooting like customer forgetting their wifi passwords to their routers.
  - jcalvinowens 7mo ago
    Interesting. Honestly I like having control over it, that would annoy me. I deliberately change the DUID in dhcpcd to force my public addresses to change every so often.
kccqzy 7mo ago
My ISPs change the /64 more often. So I use the ULA a lot more often. My router runs its own DNS server and then it advertises this DNS server using a ULA address.
- miyuru 7mo ago
  I have mentioned this elsewhere, but ISPs should make BYOIPv6 more common, not just to the Business customers. Their are people like OP who do this via a VPS provider that supports BYOIP and then tunnel to the VPS network, so there is a demand. https://news.ycombinator.com/item?id=47355038 https://news.ycombinator.com/item?id=47355038
  - jcalvinowens 7mo ago
    I've never heard of an end user ISP that would announce and route a customer owned block of addresses. They'll all give you a static allocation, but it will be in their block. Maybe if you were a huge customer they could do it... but I can't believe they would go to that much trouble for the measly <$100/month they get from me. Also, I very much don't want all my outbound internet traffic to come from a permanent address range I am publicly known to own. I'd still want an ephemeral /56 for outbound traffic that changed from time to time.

uyzstvqs 7mo ago

Ideally it'll be standard that your DHCP will assign you both an internet IP from your ISP-provided prefix (dynamic or static), and private IP from a ULA prefix, which can be made static through address reservation.

jcalvinowens 7mo ago
Don't use DCHPv6 at home. I tried: you will hate your life, lots of stuff doesn't support it. Android specifically has zero support for it, google says it never will. Use SLAAC. It just works.
- yjftsjthsd-h 7mo ago
  How do you handle internal DNS? I'd really like `curl http://mylaptop.internal http://mylaptop.internal` (or so) to work; that's easy with DHCP.
  - kstrauser 7mo ago
    Every device on my LAN handles mDNS, or at least the ones I SSH to do.
  - hbogert 7mo ago
    Nothing is stopping your router which does RA to also work in tandem with an internal dns server that can do hostnames for you mapped to slaac addresses.
    - yjftsjthsd-h 7mo ago
      I'm not sure I follow? AIUI, RA lets you tell hosts about a DNS server, and an internal DNS server could have AAAA records pointing at SLAAC addresses, but how would it know what hostnames go to those addresses?
      - hbogert 7mo ago
        Oof you are right. It seems openwrt does something smart that only works for dual stacked hosts.

simoncion 7mo ago

> Do you actually own that /48? Well. From TFA: So I decided to use Free Range Cloud service provider to lease a /48, which cost me around C$10/year. I also used their tunnel service to then route this over to me. The link embedded in the pull quote is [0], which isn't maximally helpful, but it's useful. Approximately 60 seconds of poking around there brings us to [1], which quotes a "ARIN - /48 IPv6 lease ... Use on our network or yours" for $8/year with a $2 setup fee. That sounds a lot like what's mentioned in TFA. So. You tell me? [0] <https://freerangecloud.com/ https://freerangecloud.com/> [1] <https://freerangecloud.com/products.php https://freerangecloud.com/products.php>

jcalvinowens 7mo ago
It's was a rhetorical question, he doesn't own it. And it takes much less than sixty seconds to figure that out: $ whois 2602:fed2:7e02:: ... NetRange: 2602:FED2:: - 2602:FED2:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF CIDR: 2602:FED2::/32 NetName: 10VPN-PRIMARY NetHandle: NET6-2602-FED2-1 Parent: NET6-2600 (NET6-2600-1) NetType: Direct Allocation If that VPN provider goes out of business, he probably loses those addresses.
- simoncion 7mo ago
  You must be aware that he owns the allocation in exactly the same way you "own" an ARIN allocation? Unless you have an exemption, there are fees that you must pay annually [0]. If you do not pay them, you relinquish your assignment. [1] There's another sense in which he owns the allocation... the one you constructed in your original question: Do you actually own that /48? The problem with using the globally routable addresses internally is that your public /48 might change in the future, and and that will force you to change a bunch of internal stuff. He's paying his money to get a statically assigned /48. It's not too surprising that you can't get this information out of a whois invocation. It is -however- a bit surprising that you weren't aware that whois couldn't tell you this. [0] <https://www.arin.net/resources/fees/fee_schedule/#rsp-service-categories-and-fees https://www.arin.net/resources/fees/fee_schedule/#rsp-servic...> [1] See section 4(c) of <https://www.arin.net/about/corporate/agreements/rsa.pdf https://www.arin.net/about/corporate/agreements/rsa.pdf>

simoncion 7mo ago

> * You're really supposed to pick a random prefix in fd00::/8, but uniqueness only matters if you intend to merge networks with somebody else later, I care more about it being easy to remember. If you don't care about collision resistance, why didn't you pick fd00:: ? That's way easier to remember than that jumble of letters you selected. It's actually my go-to subnet when someone claims that local-only IPv6 addresses are "hard to remember". fd00::1 is notably shorter than 10.0.0.1.

mr_mitm 7mo ago
You can write it as 10.1 though
- simoncion 7mo ago
  You could, sure. You shouldn't, because not only is it nonstandard, roughly noone writes it that way. Without consulting documentation or otherwise querying external memory, tell me what is 10.1.1?
jcalvinowens 7mo ago
Heh, fair enough. I picked it because it makes me laugh when I have to type it (say it in Elmer Fudd's voice). I don't actually type it very often.
boredatoms 7mo ago
fddd:: is easier to type than fd00::