Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A Short IPv6 Guide for Home IPv4 Admins

gist.github.com

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Show HN: A Short IPv6 Guide for Home IPv4 Admins

#21

Post by philsnow »

How does this:

> With IPv4, when your router connects to your ISP, you get one public address for the WAN, and you use a picked private address like 192.168.0.0/24 for your LAN. With IPv6, since you want a globally routable address for hosts on your LAN also, you need to ask the ISP for a routable prefix.

jive with this:

> You want to use these ULA for all your LAN communication. If you want to reach your printer or a media server, put their ULAs in the DNS and not the globally routable one.

Why have globally-routable IPv6 addresses if you're not going to use them?

I was put off initially by the first quoted paragraph because while the hard-outside-chewy-center security model is not a strong model, it is easy to reason about especially when you have very heterogeneous devices on your home LAN, including ones you don't control the OS of. I like using private addresses for my home LAN and even if I had an IPv4 /24, I wouldn't give addresses from it to machines on my LAN.

I use wireguard to access things on my LAN, with a somewhat-janky split-horizen DNS setup where the DNS server is on my LAN, so I have to be connected to wireguard to even resolve the names.

Re: Show HN: A Short IPv6 Guide for Home IPv4 Admins

#22

Post by hot_gril »

wmf wrote: post #19
hot_gril wrote: post #17

I'm a home ipv4 admin. What I or someone similar would need is the last part that shows how you set up a basic network with some local addresses I care about and a few I want to expose publicly. It's nice that the guide includes the concepts, but the first thing anyone will want to do is just make it work. Step 2 says to set up ULAs. Are these static or dynamic? It says "don't pick numbers." If dynamic, how does step…

These steps depend on whether you're using networkd, netplan, NetworkManager, ConnMan, etc.

Huh, whether these addresses are static or dynamic shouldn't depend on that. I just have a typical router at home with a web portal, is that insufficient?

Re: Show HN: A Short IPv6 Guide for Home IPv4 Admins

#23

Post by anthropodie »

philsnow wrote: post #21

How does this: > With IPv4, when your router connects to your ISP, you get one public address for the WAN, and you use a picked private address like 192.168.0.0/24 for your LAN. With IPv6, since you want a globally routable address for hosts on your LAN also , you need to ask the ISP for a routable prefix. jive with this: > You want to use these ULA for all your LAN communication. If you want to reach your printer or…

> Why have globally-routable IPv6 addresses if you're not going to use them?

Because globally routable addresses are not static. Your prefix may change.

Re: Show HN: A Short IPv6 Guide for Home IPv4 Admins

#24

Post by hairyplanter »

hot_gril wrote: post #17

I'm a home ipv4 admin. What I or someone similar would need is the last part that shows how you set up a basic network with some local addresses I care about and a few I want to expose publicly. It's nice that the guide includes the concepts, but the first thing anyone will want to do is just make it work. Step 2 says to set up ULAs. Are these static or dynamic? It says "don't pick numbers." If dynamic, how does step…

Step 2 answer: To set up ULA, just assign ULA you want to your LAN interface. Default radvd.conf will now advertise that ULA prefix to the lan, and your hosts will auto configure. Are they static? Yes, in the sense that they don't change. Are they dynamic? Yes in the sense that you didn't have to configure the host manually, it just did slaac.

Once a host picks a ULA (prefix + id), you can get that from the host. It's the same as getting a mac address of a machine, but instead you get the ULA, and add it to your firewall rules.

Step 3 answer: I run unbounded on the router.

Re: Show HN: A Short IPv6 Guide for Home IPv4 Admins

#25

Post by rkagerer »

Can someone elaborate on this:

For a given prefix, the interface will always pick the same identifier, (in fact, the eui-64 algorithm will pick the same identifier across multiple prefixes)

How does the algorithm typically work? Is there a loss of privacy since identifiers are reused across prefixes? If I replace my NIC or install a different OS on my machine will the address change?

Re: Show HN: A Short IPv6 Guide for Home IPv4 Admins

#26

Post by philsnow »

philsnow wrote: post #21

How does this: > With IPv4, when your router connects to your ISP, you get one public address for the WAN, and you use a picked private address like 192.168.0.0/24 for your LAN. With IPv6, since you want a globally routable address for hosts on your LAN also , you need to ask the ISP for a routable prefix. jive with this: > You want to use these ULA for all your LAN communication. If you want to reach your printer or…

Ah:

> For your externally visible servers, use dyndns type service, and update it with the globally routable address. Residential internet will rotate the prefix over time (the prefix is dynamic), so this is the same as running a server on a residential dynamic IPv4.

> For firewall, drop all inbound packets by default. For externally visible servers, you can match the last 64 bits only, so that changing prefixes don’t affect the firewall rules.

Since I don't (currently) want anything at all to be generally externally accessible, it seems that I could just use ULAs for the LAN machines and not assign them globally-routable addresses..... but at that point I guess there's no reason to be configuring IPv6 at all (?), which is exactly the current state of my LAN. I guess if there were services that were better-accessible (or only accessible) over IPv6 that would be a reason.

Re: Show HN: A Short IPv6 Guide for Home IPv4 Admins

#28

Post by hot_gril »

hairyplanter wrote: post #24
hot_gril wrote: post #17

I'm a home ipv4 admin. What I or someone similar would need is the last part that shows how you set up a basic network with some local addresses I care about and a few I want to expose publicly. It's nice that the guide includes the concepts, but the first thing anyone will want to do is just make it work. Step 2 says to set up ULAs. Are these static or dynamic? It says "don't pick numbers." If dynamic, how does step…

Step 2 answer: To set up ULA, just assign ULA you want to your LAN interface. Default radvd.conf will now advertise that ULA prefix to the lan, and your hosts will auto configure. Are they static? Yes, in the sense that they don't change. Are they dynamic? Yes in the sense that you didn't have to configure the host manually, it just did slaac. Once a host picks a ULA (prefix + id), you can get that from the host. It'…

Thanks, I get it now. Guess LAN DNS can be optional since the ULAs can be memorized.

Re: Show HN: A Short IPv6 Guide for Home IPv4 Admins

#29

Post by hairyplanter »

rkagerer wrote: post #25

Can someone elaborate on this: For a given prefix, the interface will always pick the same identifier, (in fact, the eui-64 algorithm will pick the same identifier across multiple prefixes) How does the algorithm typically work? Is there a loss of privacy since identifiers are reused across prefixes? If I replace my NIC or install a different OS on my machine will the address change?

EUI-64 uses the NIC MAC to derive an address. Linux by default uses it, and it's fine for servers.

There are other more privacy sensitive ways to generate obfuscated addresses.

But none of these matter, because RFC 4941 says a new random address is used for each request. If you surf the web on a server with a static address, it'll create hundreds of temporary, random addresses to make requests from. The server is reachable by the static address, but outgoing requests come from a random address.

I know, weird, right? Concept 2: IPv6 uses multiple addresses.

Yes, if you replace the NIC, the address will change. Different OS won't, if it uses EUI-64.

Re: Show HN: A Short IPv6 Guide for Home IPv4 Admins

#30

Post by anthropodie »

rkagerer wrote: post #25

Can someone elaborate on this: For a given prefix, the interface will always pick the same identifier, (in fact, the eui-64 algorithm will pick the same identifier across multiple prefixes) How does the algorithm typically work? Is there a loss of privacy since identifiers are reused across prefixes? If I replace my NIC or install a different OS on my machine will the address change?

An IPv6 device will use the MAC address of its interface to generate a unique 64-bit interface ID.
Post reply on HN