4 ms·

So why don't I get at least an /48 if I rent a server online? Hetzner gives you a /64 and a lot of providers only provide something like /80 or /112. Having a

by nisa 11y ago

So why don't I get at least an /48 if I rent a server online? Hetzner gives you a /64 and a lot of providers only provide something like /80 or /112. Having a /48 oder /44 would make deploying IPv6 VPNs a breeze because of ULA and prefix translation. https://tools.ietf.org/html/rfc6296 https://tools.ietf.org/html/rfc6296 Where is the problem?

devicenull 11y ago
Router hardware cannot keep up with any real number of IPv6 addresses. You'll quickly overflow router tables if you try to use even a tiny fraction of that /48 at once. For example, Cisco Nexus 9000 can deal with 30k IPv6 neighbors. Once you cross that, things start blowing up. This isn't really a limit for the backbone routers, because they're all dealing with routes, not individual IPs (they know that 2001:DB8::/32 goes to peer A, which only consumes one routing table entry). It's only a provide when you get to the network edge.
- tw04 11y ago
  And thus SDN was born.
- nisa 11y ago
  > ...when you get to the network edge. I'm not a networking guy. Where is the difference? One table entry for the /48 should be enough? Where is the difference to a /64 that still allows enough IP addresses to blow something up? I can't image that a lot of people map their ULA network 1:1 to a /48 or is this the reason? As far as I undetstand it it shouldn't matter because the prefix translation is happening on the server itself on not on the router. So a single router should suffice? Wasn't at least the IPv6 header explicitly designed to be more router friendly?
  - devicenull 11y ago
    At the edge, the last router before your server has to have a mapping that a single particular IPv6 address maps to a specific MAC address. You can't really condense this down to a single entry, because any given switchport might have multiple MAC addresses active (think of the case where you have a dumb switch attached to your router, and 20 servers attached to that dumb switch. You're looking at 20 different mac addresses, so no way to condense that down to a few entries). Even a /64 is more then enough to blow up a router at this point. The /48 just makes it a lot more likely that that will happen. The simplest solution here is to route the entire /48 at a specific IPv6 address. This brings you back down to a couple table entries, but requires that your customer configure things properly.
    - X-Istence 11y ago
      That's when you do DHCP-PD and the router (last hop before your server) sets up a route for that entire /48 to the link-local address of your server. Or you set up a static route (as a provider this would be recommended) or let the edge do a BGP announcement of it's address space.
      - simoncion 11y ago
        Why do either of these solve the problem mentioned, and why would you allocate a /48 to a single server?
        simoncion 11y ago
        Wait, when you said "...the router (last hop before your server) sets up a route for that entire /48 to the link-local address of your server." Was "your server" the ISP's server, or the customer's server? If the former, why are you saying "server", rather than "router"?
        X-Istence 11y ago
        It's the customers server. If they need a /48 of address space, you just want to route all of it to them.
- virtuallynathan 11y ago
  The router should only care about the prefix, right? If a server has a /48, what it does with that is not really the upstream routers business.
  - devicenull 11y ago
    The upstream router doesn't care, but the closest router to your server needs a mapping between IPv6 address and MAC address.
    - X-Istence 11y ago
      Route the /48 to the edge (the customers server)
scurvy 11y ago
Well, you're renting a server. I'd recommend getting your own allocation and running your own network and AS if you want to offer VPN services.
- simoncion 11y ago
  Have you run your own AS? If you have, do you have any links to good documentation on the process, (maybe) including costs? Thanks!
- nisa 11y ago
  A lot of the cool stuff of IPv6 like ULA or prefix translation is only working if you have more than a /64 for an server. A /64 is specified as an endpoint. If you want to run a few VMs that are globally routable without DHCPv6 you need more than a /64. In my case we have a local mesh network that we'd like to switch to IPv6 using ULA - no more hassle with IP-configuration... would be cool if could do 1:1 VPN with prefix translation but it's hard to get a server with a /48. For a mostly hobbyist project running your own AS and BGB and having at least some redundancy for VPN services e.g. at least 2 providers looks like it's quite a challenge. The organisation got a /44 for each community but try finding a provider that reasonable cheap and that offers announcing your AS. I'm just curious because it's definitely not lack of addresses that seems to be limit here.

by nisa 11y ago

devicenull 11y ago

Router hardware cannot keep up with any real number of IPv6 addresses. You'll quickly overflow router tables if you try to use even a tiny fraction of that /48 at once. For example, Cisco Nexus 9000 can deal with 30k IPv6 neighbors. Once you cross that, things start blowing up. This isn't really a limit for the backbone routers, because they're all dealing with routes, not individual IPs (they know that 2001:DB8::/32 goes to peer A, which only consumes one routing table entry). It's only a provide when you get to the network edge.

tw04 11y ago
And thus SDN was born.
nisa 11y ago
> ...when you get to the network edge. I'm not a networking guy. Where is the difference? One table entry for the /48 should be enough? Where is the difference to a /64 that still allows enough IP addresses to blow something up? I can't image that a lot of people map their ULA network 1:1 to a /48 or is this the reason? As far as I undetstand it it shouldn't matter because the prefix translation is happening on the server itself on not on the router. So a single router should suffice? Wasn't at least the IPv6 header explicitly designed to be more router friendly?
- devicenull 11y ago
  At the edge, the last router before your server has to have a mapping that a single particular IPv6 address maps to a specific MAC address. You can't really condense this down to a single entry, because any given switchport might have multiple MAC addresses active (think of the case where you have a dumb switch attached to your router, and 20 servers attached to that dumb switch. You're looking at 20 different mac addresses, so no way to condense that down to a few entries). Even a /64 is more then enough to blow up a router at this point. The /48 just makes it a lot more likely that that will happen. The simplest solution here is to route the entire /48 at a specific IPv6 address. This brings you back down to a couple table entries, but requires that your customer configure things properly.
  - X-Istence 11y ago
    That's when you do DHCP-PD and the router (last hop before your server) sets up a route for that entire /48 to the link-local address of your server. Or you set up a static route (as a provider this would be recommended) or let the edge do a BGP announcement of it's address space.
    - simoncion 11y ago
      Why do either of these solve the problem mentioned, and why would you allocate a /48 to a single server?
      - simoncion 11y ago
        Wait, when you said "...the router (last hop before your server) sets up a route for that entire /48 to the link-local address of your server." Was "your server" the ISP's server, or the customer's server? If the former, why are you saying "server", rather than "router"?
        X-Istence 11y ago
        It's the customers server. If they need a /48 of address space, you just want to route all of it to them.
virtuallynathan 11y ago
The router should only care about the prefix, right? If a server has a /48, what it does with that is not really the upstream routers business.
- devicenull 11y ago
  The upstream router doesn't care, but the closest router to your server needs a mapping between IPv6 address and MAC address.
  - X-Istence 11y ago
    Route the /48 to the edge (the customers server)

scurvy 11y ago

Well, you're renting a server. I'd recommend getting your own allocation and running your own network and AS if you want to offer VPN services.

simoncion 11y ago
Have you run your own AS? If you have, do you have any links to good documentation on the process, (maybe) including costs? Thanks!
nisa 11y ago
A lot of the cool stuff of IPv6 like ULA or prefix translation is only working if you have more than a /64 for an server. A /64 is specified as an endpoint. If you want to run a few VMs that are globally routable without DHCPv6 you need more than a /64. In my case we have a local mesh network that we'd like to switch to IPv6 using ULA - no more hassle with IP-configuration... would be cool if could do 1:1 VPN with prefix translation but it's hard to get a server with a /48. For a mostly hobbyist project running your own AS and BGB and having at least some redundancy for VPN services e.g. at least 2 providers looks like it's quite a challenge. The organisation got a /44 for each community but try finding a provider that reasonable cheap and that offers announcing your AS. I'm just curious because it's definitely not lack of addresses that seems to be limit here.