Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wireless-to-Ethernet island for RPi cluster: IPv6, NDP proxy, mDNS reflector

vladimir.varank.in

Post reply on HN
Print view View original

31–40 of 60 posts

Re: Wireless-to-Ethernet island for RPi cluster: IPv6, NDP proxy, mDNS reflector

#31

Post by eqvinox »

amaccuish wrote: post #27
eqvinox wrote: post #24

Earlier quoted context omitted.

Yes, one of the worst hacks in all of home networking is exactly this... rewriting the MAC address. aka "MAC NAT." Alternatively, proxy ARP + proxy ND can also work. The Apple stuff may be able to autonegotiate over some proprietary handshake if it's an Apple AP and Apple Extender. There is also a new standard that covers 4-address frames, 802.11ak; I have no idea how widely that is adopted though — it was only relea…

Thank you for your expertise! Out of interest, why is it a hack? Does it break things elsewhere? Why is it better to do it at the IP level?

NAT, in general, is a hack that requires holding a lot of state in order to squeeze multiple devices into a limited number space.

On a technical/complexity level, IP NAT is much worse because you need to hold much more state, i.e. you need the UDP/TCP flow information to rewrite correctly.

However, MAC NAT is the pinnacle of stupidity for an entirely different reason: there should be no need for it. MAC addresses only have local significance, and while there are some long-term concerns about them running out, there is absolutely enough of them right now. There should simply be no need to do MAC NAT, if only it wasn't for the shortsighted 802.11 design decision to go with 3 addresses in the header.

FWIW, MAC NAT is almost the same thing as a router with ARP/ND proxying turned on, though possibly implemented on a different level. This is the technical reason it's an extremely stupid hack: proxy ND/ARP provides pretty much the same thing, but in a much cleaner way. (The difference is that with proxy ND/ARP, the "router-ish-bridge" assumes ownership of the lower-layer exchanges, i.e. ARP & ND, and just does normal routing with that. MAC NAT, meanwhile, tries to be clever and just forward ARP and ND. Reasons for doing that are ... extremely thin IMHO.)

Re: Wireless-to-Ethernet island for RPi cluster: IPv6, NDP proxy, mDNS reflector

#33

Post by eqvinox »

daniellarusso wrote: post #32

How do you relay mDNS over IPv4? The article mentioned an ARP relay. Any recommendations?

avahi (the standard Linux mDNS implementation) has settings to set up proxying between multiple segments.

It's not ARP relay, it's proxy ARP. That's a builtin feature on the Linux kernel, with 2 distinct modes to configure and enable it. (a) /proc/sys/net/.../proxy_arp, or (b) ip neigh add proxy ...; the latter way is more fine grained while the former is just an interface-wide switch that you flick on.

Re: Wireless-to-Ethernet island for RPi cluster: IPv6, NDP proxy, mDNS reflector

#34

Post by aurelian15 »

londons_explore wrote: post #15

And this is all because WiFi doesn't act like a proper layer 2... It isn't possible to have a network which is ethernet -> wifi -> ethernet and have the whole thing one broadcast domain.

Well, as at least one other commenter in this thread already pointed out, this is possible with WDS (Wireless Distribution System). However, this needs to be supported by the access points. If it is supported (for example on APs running OpenWRT), it is literally just a matter of enabling WDS on the station and client APs, and bridging the wireless interfaces to the ethernet interfaces.

I've been using this setup in my home network for years now (with a dedicated OpenWRT device for each wired "island") and it works great.

Edit: To clarify, yes, this establishes a single broadcast domain. For example, DHCP and ARP requests are propagated through the entire network.

Re: Wireless-to-Ethernet island for RPi cluster: IPv6, NDP proxy, mDNS reflector

#35

Post by eqvinox »

Arnavion wrote: post #30
amaccuish wrote: post #21

Earlier quoted context omitted.

Upvoting as good idea, but most routers I know, evening running custom firmware, don't support delegating a wan prefix on request from lan side.

I don't know about *WRT and Tomato, but OPNsense / pfSense and OpenBSD definitely support PD.

*WRT supported it last I checked, but that's no help in this case, as the ISP-provided locked-down router would need to support this.

(This isn't about ISP-provided locked-down routers either, though those are an abomination too IMHO. Regardless of whether the "last" ISP-controlled device is a plastic router in your home or an aggregator somewhere else, it needs to support and offer PD for you...)

Re: Wireless-to-Ethernet island for RPi cluster: IPv6, NDP proxy, mDNS reflector

#36

Post by Arnavion »

eqvinox wrote: post #35
Arnavion wrote: post #30

Earlier quoted context omitted.

I don't know about *WRT and Tomato, but OPNsense / pfSense and OpenBSD definitely support PD.

*WRT supported it last I checked, but that's no help in this case, as the ISP-provided locked-down router would need to support this. (This isn't about ISP-provided locked-down routers either, though those are an abomination too IMHO. Regardless of whether the "last" ISP-controlled device is a plastic router in your home or an aggregator somewhere else, it needs to support and offer PD for you...)

Yes, it requires using your own router instead of the ISP's. I know the article says the ISP router is locked down, but it's not clear whether the ISP router is mandatory.

Re: Wireless-to-Ethernet island for RPi cluster: IPv6, NDP proxy, mDNS reflector

#37

Post by jlgaddis »

> The router is set with ... a global unicast IPv6 address (GUA) prefix 2001:db8:abc:123::/64, which the ISP designates to us (of course, that’s not the real prefix, but I will use this one in all examples below).

On a side note, I have more trust in documentation that is compliant with the relevant RFCs (i.e., RFC1918, RFC3849, RFC5737, et al).

In my experience, such documentation is much more likely to be "technically correct" and get the small details right.

Re: Wireless-to-Ethernet island for RPi cluster: IPv6, NDP proxy, mDNS reflector

#38

Post by varankinv »

eqvinox wrote: post #26
amaccuish wrote: post #21

Earlier quoted context omitted.

Upvoting as good idea, but most routers I know, evening running custom firmware, don't support delegating a wan prefix on request from lan side.

Really depends on the ISP; it's actually on the certification mandatory feature list for some network operators. (Comcast, AFAIK.) But yeah, no way to tell if the particular device and setup the author has supports it. (But it should be a very early thing to try, if it's available everything else becomes much easier.)

> But it should be a very early thing to try, if it's available everything else becomes much easier

I've tried to set up PD but it didn't work, so I've moved on with other options. Now, after you mentioned that, this feels like a good excuse to delve into what exactly didn't work back then.

Re: Wireless-to-Ethernet island for RPi cluster: IPv6, NDP proxy, mDNS reflector

#39

Post by pickle-wizard »

astrange wrote: post #23
zrail wrote: post #4

Earlier quoted context omitted.

> This seems like a lot of work I see this is your first introduction to the homelab hobby. Welcome!

I tried to figure out what a homelab was once, but it seemed to just be people who enjoyed having a lot of fan noise at home so they could assemble VLANs for no particular reason.

If you follow the homelab sub reddit, a lot of people like to run old obsolete datacenter gear.

You don't have to do that. Mine is a pair of Ryzen 2 white boxes. They are dead silent and don't put out much heat either. All my network gear is fanless too.

I do automation, so I use mine for dev/test against the stuff I am automating. A lot of it could run in the cloud, but that gets expensive real quick. Especially when I am working with a VMware stack.

Re: Wireless-to-Ethernet island for RPi cluster: IPv6, NDP proxy, mDNS reflector

#40

Post by gonesilent »

amaccuish wrote: post #21
eqvinox wrote: post #18

The post isn't mentioning DHCPv6-PD[*] (prefix delegation.) I feel like murphy's law is kicking into effect right now and the ISP-provided router actually supports PD to give downstream routers their own /64. (Or maybe not. Who knows. I feel like the post would've mentioned PD if they tried it.) Also: I divided it into a smaller subnet 2001:db8:abc:123:40::/76 Anything on a broadcast/multinode segment that isn't /64…

Upvoting as good idea, but most routers I know, evening running custom firmware, don't support delegating a wan prefix on request from lan side.

Happy starlink and pfsense user here doing just that.
Post reply on HN