Hacker News Reader

Comment by JoshTriplett | Hacker News Reader

The biggest piece of annoyance I have with IPv6: it's really hard to tell the OS "here's your IPv6 address, here's your gateway, here are your routes, now don't mess with any of it!".

With IPv4 it's easy to set up a static configuration. With IPv6, the Linux kernel is eager to listen to all sorts of advertisements from the network, and it's hard to say "no, stop, don't ever ever listen to anything except my static configuration".

I can bring up IPv4 networking in a tiny fraction of a second. IPv6 networking sometimes takes seconds to settle down and be reliable.

(I'd be interested in any suggestions for how to improve this.)

View on HN

In your /etc/sysctl.d/local.conf:

  net.ipv6.conf.default.accept_dad=0
  net.ipv6.conf.default.accept_ra=0
  net.ipv6.conf.default.autoconf=0

Or, in your network startup script (like Debian’s /etc/network/interfaces):

  sysctl -w net.ipv6.conf.default.accept_dad=0
  sysctl -w net.ipv6.conf.default.accept_ra=0
  sysctl -w net.ipv6.conf.default.autoconf=0

Or, in your /etc/systemd/network/en0whatever.network:

  [Network]
  IPv6AcceptRA=false
  IPv6DuplicateAddressDetection=0

Only accept_ra=0 is actually needed for static config. autoconf is de-facto disabled if RAs aren't being processed, and DAD is a separate thing (but relevant to the grandparent since it takes a few seconds to finish).

Although I'd also argue that you should prefer automatic config over static in general. RAs can set your default route correctly and you can use `ip token` if you really need SLAAC to give you a specific address. I think it's better to be able to just connect machines and have them get the right config rather than need to hand-craft it on each one.

For most cases I agree that automatic configuration is the right answer.

In this case I'm bringing up virtual machines, as fast as possible, and static is inherently faster and more predictable. Automatic configuration isn't compatible with literally counting milliseconds.

If you don’t need link-local addresses, have you tried these?

  LinkLocalAddressing=no

and/or

  sysctl -w net.ipv6.conf.default.addr_gen_mode=1

Interesting! I'll look into those, those look helpful.

I don’t want to trust the network. The network is never secure. Therefore, I don’t want the server to trust any self-proclaimed router with what IP address the server should use. As far as I know, there is no IPsec for RA packets.

Fine, then don't connect to it. Nobody's making you.

There's always static IPs. Do you trust DHCP on v4?

Now how do you do it on your phone or windows laptop? :)

What if you have multiple internet connections and you want to choose which one you go through? With ipv4 and nat you can just change the default route. And you don't even need to write down the router's address since it's <your prefix for the whole network> dot one number.

I've previously found and used all three of those, and those help but don't seem to suffice. There's still some degree to which the configuration seems unreliable, and doesn't settle down for a few seconds.

(I appreciate the confirmation of those settings, though, and those are all an important part of the setup.)

What's the use case for static IPv6 configuration?

because you don't want your server's ip to change.

Don’t all modern server OS choose a deterministic interface ID based on the network in the router advertisement? (As I recall this is usually via hashing the MAC with the RA prefix plus some system-wide but stable seed, to avoid using the MAC directly as the interface ID)

For servers, if you have anything pointing to it (DNS, clients pointing to the IP, firewall rules...)

Reply on news.ycombinator.com