291–300 of 649 posts
Earlier quoted context omitted.
Everything should get its IPv6 configuration via SLAAC. DHCPv6 is only useful when you plan to provide prefix delegation for extra routers or network boot information.
just a funny joke: what about using IBGP/OSPF for prefix delegation?
Earlier quoted context omitted.
That's a solved problem whose solution is called ipv4 over ipv6 tunneling.
that will cause state and can hurt performance since it needs extra memory. one of the main selling point of IPv6 is try to be stateless as much as possible to ease up on routers and switches
Earlier quoted context omitted.
A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember…
Ok, i'll bite. > Auto generated addresses are usually in the form of "prefix - device_id" so even if a node has a lot of addresses, they are all mostly the same > Internet/non-local IPv6 addresses break the rules a bit and don't use a device_id in their addresses in order to protect user privacy So a device needs to have both an internal address and an "Internet/non-local" address in IPv6? Plus one for WAN and Link-L…
You only need two addresses:
- a global address
- a link-local address
Earlier quoted context omitted.
Why do you think this? What led you to assuming these things? You would only need to configure any of this if you want to allow external connections, which isn't much different than setting up port forwarding with IPv4 + NAT, except with IPv6 it's less complicated.
Literally the post I answered. Fact: SLAAC does not do DNS. So, my question then is: how do you do DNS? Answer: "The SLAAC should not change after the host has generated it during installation / first connection, as long as you don't reinstall the OS etc." Since SLAAC does not do DNS that answer implies that you'd enter it during connection/installation to complete the config.
Windows, according to Wikipedia, doesn't support it, but if you want to please Microsoft there's stateless DHCPv6 (which does not maintain leases, configure addresses, or do anything else that SLAAC doesn't do already; it can be simple piece of software in comparison).
On the other hand, Android and ChromeOS don't support DHCPv6 for DNS server provisioning because of Google's opinion about all matters related to DHCPv6. A pain, but not impossible to overcome either.
As for unchanging addresses, SLAAC is bound to the device MAC address so a reinstall should give you the same IP. However, you are/should be running privacy extensions, which means your outgoing IP will rotate to prevent tracking (as your IP is based on your MAC address and using that would make tracking way too easy). You'll still have the same primary IP, though, unless you add a second device to the network with the same MAC address.
Earlier quoted context omitted.
>NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports. This is one of those infosec tenets that is technically true but functionally unhelpful. Like correct-horse-battery-stable debates. The claim is that IPv4 + NAT + bad firewall is better than IPv6 + bad firewall. Yes, both are insufficient and inferior to a good firewall - but how confident are you that…
What makes you think that, for critical systems, "IPv4 + NAT + bad firewall" is the default IPv4 deployment paradigm, rather than "IPV4 + bad firewall"? Sure, big IaaS providers like AWS put you in a VPC by default. But most servers on the net are not hosted in an IaaS; they're hosted using a VPS or bare-metal hosting provider, or just coloed in a DC by their owner. And in all those cases, what that kind of deploymen…
From your very last statement, I think you've confused self hosting (like buying a VPS from Digital Ocean and hosting your own blag) and how the real world works (like going to Dell.com and ordering a new laptop). "The mainframe" these days is almost always behind a L4/L7 load balancer or other network device and very rarely directly addressable.
I think what OP went thru is what will make the transition happen. Market forces are ultimately going to be the thing that drives wider adoption: IPv4 addresses getting so expensive that it drives people to try IPv6, and when that fails they complain in posts like this and directly to their service providers. The fact that OP names names of services failing to offer IPv6 is a good thing. Ideally it will start creating pressure on those services/corporations to fully support IPv6. If complaining doesn't work to motivate them, users moving away from their services to providers who do offer IPv6 support will motivate them.
All ipv6 shortcomings discussion aside; What I think is the more vital problem to focus on is that the governments clearly don't want us mere mortals to expose our own servers running on our own hardware to the outside world (most often justifying that with "it's for your own security" mantra, for we're all deemed too dumb to figure that out for ourselves). ISP-imposed ipv4 double NAT (imposed on ISPs by the governme…
Governments share some responsibility here for not mandating a move to v6, leaving everybody in "wait for other people to go first" mode, and one might ask why they've done that but the answer is mostly that governments don't usually get involved in the Internet at that level.
I've not seen an ISP do CGNAT on v6, even when they're doing CGNAT on v4. This makes sense because CGNAT is expensive and doesn't have any benefits for the ISP except for dealing with address space exhaustion. If they wanted to prevent inbound connections then all they would need to do is firewall them.
All ipv6 shortcomings discussion aside; What I think is the more vital problem to focus on is that the governments clearly don't want us mere mortals to expose our own servers running on our own hardware to the outside world (most often justifying that with "it's for your own security" mantra, for we're all deemed too dumb to figure that out for ourselves). ISP-imposed ipv4 double NAT (imposed on ISPs by the governme…
I propose a real simple solution: Major providers pledge to take this seriously. They toss a rule in their routers that just drops all ipv4, for 1 minute, starting at noon UTC. At 12:01 UTC, revert the change and ipv4 works again. Do this every day. The following week, up it to 2 minutes. The incentive will happen.
While I think this would effectively move the needle, as soon as they announce that this is going to happen, I am guessing heart monitors, ankle brace companies (people in home jail) and a slew of weird other use cases will pop up as major problems and the effort will fail.
Earlier quoted context omitted.
> And regarding compatibility, with ipv4+ if you have a 0.0.0.0.x.x.x.x ip address you would be able to talk to both ipv4+ aware and legacy ipv4 devices natively without any tunneling (because you also own the legacy, non quad 0 ip address). This exists: > Addresses in this group consist of an 80-bit prefix of zeros, the next 16 bits are ones, and the remaining, least-significant 32 bits contain the IPv4 address. For…
Mayne RFC exists, but it os not used in teal world anywhere. In all servers, I configure IPv4 and IPv6 separately. Network setup is separate. DHCP daemons are separate. Firewall rules are separate. Network monitoring is separate. I would switch to that "IPv4+" system if it existed.. I am willing to use latest software/standards to future-proof my setup, but duplicating all the work is too much for me.
And exactly how would you accomplish this switch to a larger address space? Please explain the steps exactly how they would be done.
Because IPv4 has 32 bits of address. Anything after IPv4 needed >32 bits of address. How exactly do you fit in >32b in a data structure that is only 32b? You cannot.
So you have to go and replace every bit of networking code out there to change the data structures. You know, like was done to deploy IPv6.