Hacker News Reader

Comment by Macha | Hacker News Reader

One thing I find slightly confusing/frustrating about IPv6.

You're discouraged from using ULAs (basically the equivalent of private addresses from v4) as they'd rather you use GUAs. But you get your GUAs from your ISP normally, which means if you change your ISP you need to renumber your network. They also generally frown on NPT66. So the supported solution is to get PI space. But to get PI space you need to have an ASN first, which requires you to have public peers, which are you just expected to get someone to peer you and then just firewall all the incoming traffic? These seems to be the one option for stable addresses on a IPv6 network that is not vaguely disapproved of.

Or what people actually do is avoid all that complexity and run IPv4 locally and use RFC1918 addreses NAT46, which seems like a self inflicted defeat to the IPv6 first aims of the IETF, IANA and the RIRs.

View on HN

You can use ip-token(8) on Linux to define a static interface-id, the part of the IP usually auto-generated based on MAC address when using SLAAC instead of making the whole IP static.

In ifupdown I usually just add something like the following

    pre-up ip token set ::cafe dev $IFACE

This way when you get a new GUA there's no need to "renumber" your network manually as everything will just happen automatically. When your router includes a new prefix in the router advertisement all hosts on the LAN generate new addresses for this prefix.

Couple of gotchas. 1) The ip-token call has to happen before the interface is marked up (as in ip link set dev $IFACE up, not link presence) so if you want to change it you have to take it down first. 2) If your ISP's router doesn't cleanly announce the old prefix to be deprecated (due to a reboot say) it may remain in use by hosts until it's lifetime expires. See RFC4192 for how renumbering is supposed to work.

FYI: I'm working on a small daemon that will monitor RA and deprecated the prefix to handle broken ISP routers.

--Daniel

This is only a half solution, I'd still need to update all my dns entries and firewall rules, for example

Well dnsmasq has --dynamic-host for this use-case. Example:

    dynamic-host=cafe.dxld.at,::cafe,lan0

Firewalls tend to support DNS, use it :)

I know for a fact nftables and pfSense allow this, worst case you need a cronjob to periodically reload your ruleset to refresh the DNS data as it's evaluated at ruleset load time (for nftables). Incidentally another TODO project of mine is a daemon to allow running scripts when RA information (such as the prefix) changes, this would come in handy here too.

For anyone interested in making IPv6 bettter come talk to me in #ipv6:ungleich.ch (Matrix).

--Daniel

> Firewalls tend to support DNS, use it :)

So I did check and my firewall (the one built into my Unifi UDM), doesn't.

Sad to say I'm surprised the proprietary vendors are lagging behind here, but there should be no architectural reason you can't deploy a more reasonable firewall.

> But you get your GUAs from your ISP normally, which means if you change your ISP you need to renumber your network.

See perhaps "IPv6 Multihoming without Network Address Translation":

    Network Address and Port Translation (NAPT) works well for conserving
    global addresses and addressing multihoming requirements because an
    IPv4 NAPT router implements three functions: source address
    selection, next-hop resolution, and (optionally) DNS resolution.  For
    IPv6 hosts, one approach could be the use of IPv6-to-IPv6 Network
    Prefix Translation (NPTv6).  However, NAT and NPTv6 should be
    avoided, if at all possible, to permit transparent end-to-end
    connectivity.  In this document, we analyze the use cases of
    multihoming.  We also describe functional requirements and possible
    solutions for multihoming without the use of NAT in IPv6 for hosts
    and small IPv6 networks that would otherwise be unable to meet
    minimum IPv6-allocation criteria.  We conclude that DHCPv6-based
    solutions are suitable to solve the multihoming issues described in
    this document, but NPTv6 may be required as an intermediate solution.

* https://datatracker.ietf.org/doc/html/rfc7157

It is generally discouraged, but recognized that it may be needed. Note that NPTv6 is stateless in its address translating (though not stateless with regards to firewalling and connection tracking).

Also (the long-titled) "Enterprise Multihoming Using Provider-Assigned IPv6 Addresses without Network Prefix Translation: Requirements and Solutions":

* https://datatracker.ietf.org/doc/html/rfc8678

You don't actually need an ASN to get PI though? You can use PI just fine with BYOIP. Actually... I don't think you are even required to announce them on the Internet.

You need the coöperation of the ISP(s), but what you can do is get PI space, run BGP on your router, and use a private ASN (64512-65534) to advertise to your ISP, and then your ISP advertises to the world with their ASN.

One common scenario is two links to the same ISP, so everyone knows which link is active (you can do active-active (load balancing/sharing), or change weights or local preference for active-passive):

* https://learn.nsrc.org/bgp/two_links_one_isp_backup

* https://learn.nsrc.org/bgp/two_links_one_isp_load_balancing

The whole BGP process with a private ASN that the ISP strips out and replace with their own ASN on the Internet is how "BYOIP" (bring your own IP) usually works.

One thing is thar length of IPv6 means it is hard to assign addresses manually so need system to automate it. Which makes easier to renumber if change ISP.

I didn’t think that ULA is deprecated, what is deprecated is NAT with ULA. The other thing is that can have multiples addresses. It makes sense to have hosts on public IP and servers have public IP and ULA. This is the zero trust approach.

The other approach is everything gets ULA and ULA is router on VPNs.

It's not that ULA is deprecated, but it discouraged, and this has led to implementation hurdles, like the fact that if you have a device with ULA addresses and GUA addresses, then your device will originate its requests, even to ULAs, from its GUA. So now your firewall rules need to specify the GUA in the source address field, for example, or you need to reconfigure every client directly.

(Also if you're running your services on the GUA, then the destination address also needs to reflect that in the firewall rule).

Can NPTv6 be useful in these scenarios?

Disclaimer: I know only the basics of IPv6

Reply on news.ycombinator.com