Hacker News Reader

Comment by LeoPanthera | Hacker News Reader

I really want to love IPv6 but my ISP (Xfinity in California) will not provide a stable prefix.

This doesn't matter with IPv4, because all my internal IPv4 addresses are NATed. But with IPv6, although each device on the network can receive a globally routable IPv6 address, the prefix keeps changing, and so the address keeps changing. This makes internal networking a nightmare, since the address of my devices is not under my control.

I don't use NPT, but it would fix the problem, so people are going to continue using it until dynamic prefixes go away. Which will probably be never.

View on HN

I use a ULAs (https://en.wikipedia.org/wiki/Unique_local_address) for this. I have a private, non-routeable subnet, and another non-stable prefix for globally routable addresses.

In effect, it's not much different than how IPv4 works with unstable WAN DHCP addresses from your provider, and I don't have the headaches that NAT brings with it.

It's a different way to think about the problem, but I've actually found it to be pretty nice.

Thank you for this! I've been trying to make Link Local Addresses work (https://en.wikipedia.org/wiki/Link-local_address). But, for tools like ping6 I have to specify the network interface like 'ping6 fe80::1%en1' otherwise routing doesn't work, and doing that complicates everything.

Try adding mDNS to the mix. Works pretty well for link local addresses.

That approach makes a lot of sense. Does your router assign each ULA or do you configure each host with a static one?

This is the setup I've ended up on. Seems to work.

See also "Reaction of IPv6 Stateless Address Autoconfiguration (SLAAC) to Flash-Renumbering Events":

   In scenarios where network configuration information related to IPv6
   prefixes becomes invalid without any explicit and reliable signaling
   of that condition (such as when a Customer Edge router crashes and
   reboots without knowledge of the previously employed prefixes), hosts
   on the local network may continue using stale prefixes for an
   unacceptably long time (on the order of several days), thus resulting
   in connectivity problems.  This document describes this issue and
   discusses operational workarounds that may help to improve network
   robustness.  Additionally, it highlights areas where further work may
   be needed.

* https://datatracker.ietf.org/doc/html/rfc8978

"will not provide a stable prefix"

This is pretty horrific. You could investigate ULA which is a bit like RFC1918 addresses for IPv6. You could attach ULA addresses to a few devices such as a local DNS server, printers and the like.

NPT would enable you to route your ULA addressed gear to the internets if they don't have a globally routable address.

> NPT would enable you to route your ULA addressed gear to the internets if they don't have a globally routable address.

One convenient thing about ULA+NPTv6 is that, unlike IPv4 NAT, is that an external IPv6 address is basically 1:1 'equivalent' to an internal IPv6 address. The NPTv6 is stateless so that, firewall rules allowing, a connection can come right in without all sorts of contortions for port mapping.

Most (residential) gateways by default block incoming requests unless they're a reply to a previous outgoing connection. I know I can ping6 the iMac I'm typing this on, but attempts to (e.g.) SSH in are blocked by default.

To spell that out a bit more - a ULA to NPT address is IP based and not port based and is way more useful.

When you do a IPv4 "pinhole" port map you get precisely one mapping and it will timeout eventually, which can lead to all sorts of exciting debugging opportunities.

IPv4 does have 1:1 NAT but there are so few IPs so whilst I have a /24, 2 x /28 and 2 x /29 to play with and others, I doubt most do.

NPTv6 maps an entire address space from A->B and is actually not designed to deal with NATv4 anyway. It is for outbound connections.

> To spell that out a bit more - a ULA to NPT address is IP based and not port based and is way more useful.

This is implementation specific: on my Asus I can specify to allow in all ports from in via a NPTv6-ULA hole, a port range, or even a single port.

If I want to only allow tcp/25 in to a particular IP I can do that, if I want 5900-5910 I can do that too, as well as 1-65535.

Well it sounds like your ASUS needs a damn good kicking!

A router moves packets from A->B and a firewall defines what is allowed from A->B.

ULA to NPT is router stuff: NPT literally means "Network Prefix Translation" it turns all your IPv6 addresses into a normalised one and shifts them.

We are not talking about ports or protocols yet, just (IP) addresses.

> Well it sounds like your ASUS needs a damn good kicking!

Why? This is exactly how I want it to work: pass through only the ports (or all the ports) I want/need for the service in question.

It might be that your ASUS is combining two things into one UI for convenience. Mapping one IPv6 prefix on the WAN to another on the LAN is one thing. Allowing traffic to a particular IP:port to cross from WAN to LAN is another. They're independent, though of course both are needed for the overall high-level task of "allow my LAN server to be reachable to the internet", so it makes sense to have a UI that does both things under the hood.

You don't really need NPT. I'm on XFinity as well and I just have GUA from them and then my own set of ULA addresses.

If Xfinity changes the /60 they're giving me it doesn't change anything internally - because my internal names all use the ULA - and the GUA just gets used to get to the Internet.

As I understand it, the idea is to use many addresses per host. I.e. you don't need to use same addresses for internal networking as global networking.

I thought best practice for IPv6 is to essentially ‘ignore’ IP addresses as each NIC can have multiple addresses + the extended length making it unwieldy. Instead you either use a combination of zeroconf / Bonjour for DNS registration / service discovery + stateless IP address assignment (SLACC). If you want full control you can use DHCPv6 which can register hosts on a proper DNS service.

Is SLACC still used? I thought it used EUI-64 assignments which leaks MAC addresses which is supposed to be a problem for some reason.

SLAAC is a core component of IPv6 - it's how a machine determines an address on a subnet without DHCPv6. Basically:

"yoohoo - where am I?"

"You are on 2001:1001:1001:f0d::/64. My name is [ipv6] and I am a router and for some odd reason, I won't tell you where DNS comes from because ... stupid design"

"Cool, I'll fiddle in my drawers and play with my MAC address and create a really long number that starts 2001:etc. I'll also create a few other addresses randomly to hide my private parts (which is a waste of time but looks good - lol)"

No idea what you are on about wrt EUI-64 being tied to SLAAC. Why not have a go at it instead of pontificating?

Having used IPv6 in anger for several years now, it is a bit different but it is actually quite beautiful at times. It does enforce decent DNS and who here has not said "its DNS"?

I've set up SLAAC before but it's not something I do often. Frankly I'm still on the fence of whether or not v6 was a good idea. Fiddling in the drawers with the MAC address is EUI-64 though, and I was under the impression that the SLAAC "client" doesn't broadcast any kind of discovery message - it just listens to the network to determine the prefix, and then generates the EUI-64 portion as its host address since it should be globally unique as it's based on its MAC address.

Like I said, I don't touch v6 much and I'm pretty surprised at how far we've made it past v4 allocations drying up and everything still seems to work.

You'll be fine for a long time. IPv6 is not quite right but not for the reasons that you'll usually see on HN/Reddit/whatevs.

It does work pretty well already but I put it rather below the significance of say global warming as a thing to really worry about.

Give it a go if you get a prefix from your ISP. It's worth a play.

This sort of thing takes 50+ years to work. You have to think like an Engineer with a lot of time to play with. The internet is everywhere, it doesn't change overnight.

> I thought it used EUI-64 assignments which leaks MAC addresses which is supposed to be a problem for some reason.

You're about a decade (2007) behind the times:

   Nodes use IPv6 stateless address autoconfiguration to generate
   addresses using a combination of locally available information and
   information advertised by routers.  Addresses are formed by combining
   network prefixes with an interface identifier.  On an interface that
   contains an embedded IEEE Identifier, the interface identifier is
   typically derived from it.  On other interface types, the interface
   identifier is generated through other means, for example, via random
   number generation.  This document describes an extension to IPv6
   stateless address autoconfiguration for interfaces whose interface
   identifier is derived from an IEEE identifier.  Use of the extension
   causes nodes to generate global scope addresses from interface
   identifiers that change over time, even in cases where the interface
   contains an embedded IEEE identifier.  Changing the interface
   identifier (and the global scope addresses generated from it) over
   time makes it more difficult for eavesdroppers and other information
   collectors to identify when different addresses used in different
   transactions actually correspond to the same node.

* https://datatracker.ietf.org/doc/html/rfc4941

   This document describes an extension to IPv6 Stateless Address
   Autoconfiguration that causes hosts to generate temporary addresses
   with randomized interface identifiers for each prefix advertised with
   autoconfiguration enabled.  Changing addresses over time limits the
   window of time during which eavesdroppers and other information
   collectors may trivially perform address-based network-activity
   correlation when the same address is employed for multiple
   transactions by the same host.  Additionally, it reduces the window
   of exposure of a host as being accessible via an address that becomes
   revealed as a result of active communication.  This document
   obsoletes RFC 4941.

* https://datatracker.ietf.org/doc/html/rfc8981

* https://en.wikipedia.org/wiki/IPv6_address#Stateless_address...

Same but worse with Verizon's FiOS: No ipv6 at all.

Iirc FIOS in at least my area is getting v6 this year

I use OPNsense router, ULAs for my devices that need a static local ip. I also host many services over ipv6 with dynamic prefixes by using a DDNS client that scans for ipv6 prefix changes and updates my dns. OPNsense can automatically adjust firewall rules as prefix changes, but your hosted services cannot use ipv6 "privacy addresses".

For local lan services I make a dns entry in my router pointing to the ULA. I have had no issues but it took awhile to figure everything out. I host matrix chat and many other services using ipv6 without issues. YMMV.

Your internal networking should not be affected when you use ULA - those won't change, and IPv6 devices tend to have multiple IPv6. Yes, it won't allow you to address your internal nodes from the external network, but that is something that you didn't have with IPv4+NAT either.

How does it work with peering/VPN?

> Which will probably be never.

Wouldn't this be like static bluetooth IDs, where you could be tracked wherever you go? I imagine that's a rare desire, amongst the internet population.

I could see requesting static IPs for particular devices, like you used to be able to do.

I'm not sure what the best current practices are for mobile, but for residential/business/etc., the most convenient behavior would be for the delegated prefix to be static unless it is requested to be changed. That tends to be the case already with ISPs who grant public IPv4 to customers - it's DHCP whose lease stays the same unless you forcibly change your MAC address or let the lease expire via turning off your modem, and so on.

Talking about IPv4 with NAT, a "consumer" with zero server-hosting needs could get away with a changing public IP. Someone with any kind of server needs, like hosting their own Internet-accessible IoT portal, personal VPN, website, game server, etc. would want a stable public IP address.

Yeah, that may lead to tracking, but it's the status quo, I suppose is the point.

In case it isn't known, IPv6 has so many addresses and is designed in such a way, that it is expected each "network" (think home network) would be given a network prefix of 56 or 60 bits. The "host" portion of an IPv6 address is the final 64 bits of the address. Therefore, each network an ISP issues to a client should have room for something between 16 and 256 subnetworks, each with effectively unlimited client address space.

Spectrum gives me /128. So I guess I can say they can give me a stable prefix.

The /128 is what your router gets. After that your router would request a delegated prefix to serve to the LAN, which would be a /64 or bigger. Casual internet search says Spectrum supports delegating /56's.

Even when I request a larger prefix, Spectrum gives me a /128

A delegated prefix cannot be smaller than a /64 so no, that's not possible.

If you only see one /128 as the IP of your router's WAN interface and nothing else, then that is the /128 assigned to your router by DHCP and nothing to do with prefix delegation.

Yes, a /64 comes in. But the first IPV6 address I use in a prefix, that is the only one that they ever seem to accept traffic for. So functionally, it's a /128.

For your privacy you should be thankful that they do not provide a stable prefix.

For anyone wanting to host a service at their home, you should be regretful not getting a stable prefix.

Ideally there would be a way to request a new one programmatically, akin to getting a new IPv4 address via DHCP if you change the MAC address.

Dynamic DNS is a thing.

Doesn’t beat a static IP.

Well yes and no.

It is rather sad that the internet that we have, what 50-70 odd years post invention is so stifled with nonsense about addressing schemes and that.

You seem to use the term "static IP" as a talisman. I have zillions (possibly gazillions) of them on IPv6 and roughly a few 100 or 1000 on IPv4 (I own an IT company).

Dynamic DNS is a thing, so is ULA for IPv6 which looks quite like IPv4 RFC1918.

We have the tools but you do have to use them.

Try connect to your service on a dynamic IP after it has changed and for whatever reason your dynamic dns update has failed. Or your DNS server of choice has failed (even Google and Cloudflare have had DNS outages). Or your domain has expired/been unceremoniously deregistered from you without warning. All these have happened. And they tend to happen when you need access the most.

"Try connect to your service on a dynamic IP after it has changed and for whatever reason your dynamic dns update has failed."

Compared to a PPP session with an ISP, dynamic DNS is a walk in the park and you can have multiple ones if it is that important. You could even have a mobile phone SMS an IP out.

DNS is seriously resilient to outages. Yes CF, Goog n co have all had outages but the beauty of DNS (and a pain at times if mismanaged) is TTL. Don't set all your records with a TTL of 300. I run quite a few DNS servers - Windows, BIND, PowerDNS and others, not to mention rather a lot of unbound and dnsmasq resolver/forwarder thingies.

Evaluate your requirements, evaluate the resiliency and functionality of the available technologies, evaluate your own skills and take appropriate action ... for you. That works at home just as well as at work.

You may find that you are running your own DNS server (or three) ...

Sounds like a like of work and a lot more failure points that just having a static IP.

Reply on news.ycombinator.com