Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Building a Mostly IPv6 Only Home Network

varunpriolkar.com

Post reply on HN
Print view View original

21–30 of 106 posts

Re: Building a Mostly IPv6 Only Home Network

#21

Post by tonymet »

I attempted a similar effort, and found my router had critical ipv6 vulnerabilities including binding the admin and SSH to the WAN on ipv6 (not on ipv4) , and disabling IPv6 firewall altogether so the LAN services were exposed to the internet.

I had the vendor publish their GPL drop, and their upstream vendor did not even have IPv6 support in the product ( the firmware init scripts & admin UI) . So the IPv6 support in the finished product was a rushed copy-paste of IPv4 setup.

I encourage full black box testing of your IPv6 setup, as IPv6 is not in the critical path for QA or consumers, so vulns can persist for years.

Re: Building a Mostly IPv6 Only Home Network

#22

Post by tosti »

For my own networks I use the private range internally (fd00::/8). That way the addresses remain the same when we move or change the pipe to a bigger one. Also, they can be routed, just not on the Internet. It's easy to join remote networks over wireguard and there's plenty of room for experimentation.

Re: Building a Mostly IPv6 Only Home Network

#23

Post by gzread »

para_parolu wrote: post #3

I can’t understand benefits of having ipv6. The only one is public ips but rest is just headache. In my home network I specify disabled v6 everywhere.

Public IPs is a huge huge huge benefit. Your connection is also faster because your IPv6 packets don't have to be processed by a centralised CGNAT.

Re: Building a Mostly IPv6 Only Home Network

#24

Post by arhue »

para_parolu wrote: post #3

I can’t understand benefits of having ipv6. The only one is public ips but rest is just headache. In my home network I specify disabled v6 everywhere.

For home use biggest advantage is that it avoids NAT, which breaks end to end connectivity. Lot of services use hacks to try to mitigate broken connectivity.

Re: Building a Mostly IPv6 Only Home Network

#25

Post by compounding_it »

jcalvinowens wrote: post #19

Do you actually own that /48? The problem with using the globally routable addresses internally is that your public /48 might change in the future, and and that will force you to change a bunch of internal stuff. I have my router set up to advertise two /64 prefixes on each LAN subnet: one from fddd:deca:fbad::/56* that I use for all internal communication, and one from 2001:5a8:xxxx:xxxx::/56 that is only used for t…

>Do you actually own that /48?

In my experience the ISP generally fixes a /64 for each customer. So if in the future you change your ISP, you might want to keep the remaining addresses same while just using a script to replace the preceding /64 address.

Re: Building a Mostly IPv6 Only Home Network

#26

Post by icedchai »

rao-v wrote: post #10

I messed with this at one point and gave up when I realized every device would have a permanent externally addressable IP within a block that is basically linked to me (good luck trying to change your IPv6 /48 every month or whatever you get with consumer IP addresses) It’s probably not a big deal and NAT etc. is no protection but it gave me the heebie jeebies.

You know your external IPv4 address rarely changes and also basically linked to you too, right?

Re: Building a Mostly IPv6 Only Home Network

#27

Post by jcalvinowens »

compounding_it wrote: post #25
jcalvinowens wrote: post #19

Do you actually own that /48? The problem with using the globally routable addresses internally is that your public /48 might change in the future, and and that will force you to change a bunch of internal stuff. I have my router set up to advertise two /64 prefixes on each LAN subnet: one from fddd:deca:fbad::/56* that I use for all internal communication, and one from 2001:5a8:xxxx:xxxx::/56 that is only used for t…

>Do you actually own that /48? In my experience the ISP generally fixes a /64 for each customer. So if in the future you change your ISP, you might want to keep the remaining addresses same while just using a script to replace the preceding /64 address.

Typically it's similar to ipv4, they try to assign the same address/prefix for the same MAC/DUID. The most common reason to lose your addresses is replacing your router. Hopefully new routers allow you to set the dhcpv6 DUID somehow...

Re: Building a Mostly IPv6 Only Home Network

#28

Post by compounding_it »

arhue wrote: post #24
para_parolu wrote: post #3

I can’t understand benefits of having ipv6. The only one is public ips but rest is just headache. In my home network I specify disabled v6 everywhere.

For home use biggest advantage is that it avoids NAT, which breaks end to end connectivity. Lot of services use hacks to try to mitigate broken connectivity.

video games

Re: Building a Mostly IPv6 Only Home Network

#29

Post by kccqzy »

compounding_it wrote: post #25
jcalvinowens wrote: post #19

Do you actually own that /48? The problem with using the globally routable addresses internally is that your public /48 might change in the future, and and that will force you to change a bunch of internal stuff. I have my router set up to advertise two /64 prefixes on each LAN subnet: one from fddd:deca:fbad::/56* that I use for all internal communication, and one from 2001:5a8:xxxx:xxxx::/56 that is only used for t…

>Do you actually own that /48? In my experience the ISP generally fixes a /64 for each customer. So if in the future you change your ISP, you might want to keep the remaining addresses same while just using a script to replace the preceding /64 address.

My ISPs change the /64 more often. So I use the ULA a lot more often. My router runs its own DNS server and then it advertises this DNS server using a ULA address.

Re: Building a Mostly IPv6 Only Home Network

#30

Post by compounding_it »

jcalvinowens wrote: post #27
compounding_it wrote: post #25

Earlier quoted context omitted.

>Do you actually own that /48? In my experience the ISP generally fixes a /64 for each customer. So if in the future you change your ISP, you might want to keep the remaining addresses same while just using a script to replace the preceding /64 address.

Typically it's similar to ipv4, they try to assign the same address/prefix for the same MAC/DUID. The most common reason to lose your addresses is replacing your router. Hopefully new routers allow you to set the dhcpv6 DUID somehow...

I haven't experienced this. For me it's statically assigned but my guess is that the PON serial and/or MAC is being used or the customer ID. I think the ISPs have gotten very automated these days and everything seems to be some sort of SDN. It saves lot of labour hours in troubleshooting like customer forgetting their wifi passwords to their routers.
Post reply on HN