Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Building a Mostly IPv6 Only Home Network

varunpriolkar.com

Post reply on HN
Print view View original

81–90 of 106 posts

Re: Building a Mostly IPv6 Only Home Network

#81

Post by jcalvinowens »

yjftsjthsd-h wrote: post #64
jcalvinowens wrote: post #53

Earlier quoted context omitted.

Don't use DCHPv6 at home. I tried: you will hate your life, lots of stuff doesn't support it. Android specifically has zero support for it, google says it never will. Use SLAAC. It just works.

How do you handle internal DNS? I'd really like `curl http://mylaptop.internal ` (or so) to work; that's easy with DHCP.

You can specify the DNS server in the router advertisements. This is how you do it in radvd.conf:

    interface enp2s0f1 {
     AdvSendAdvert on;
     AdvManagedFlag off;
     AdvOtherConfigFlag off;
     IgnoreIfMissing on;
     prefix ::/64 {
      AdvOnLink on;
      AdvAutonomous on;
     };
     RDNSS fddd:deca:fbad:1::10 {
      AdvRDNSSLifetime infinity;
     };
     DNSSL internal.domain {
      AdvDNSSLLifetime infinity;
    };
    };
I haven't yet found a way to specify a local NTP server though, which is a drag. So everything not manually configured (like the voip phone) talks to the local NTP over ipv4.

Re: Building a Mostly IPv6 Only Home Network

#82

Post by yjftsjthsd-h »

dijit wrote: post #73
yjftsjthsd-h wrote: post #72

Earlier quoted context omitted.

It's interesting that I agree with the article that you linked? I'm not contesting that it's completely possible to hit the limits in play, but 16k connections (per IP) is high enough that I don't think that's a common problem, even in public-facing web services. Granted, I suspect the services I've run professionally all dealt with it by making it the problem of a load balancer in front of the application and intern…

it’s interesting because I think youve internalised the constraint and built mechanisms around it rather than engaging directly with it, subconsciously.

I'm not sure why that would be interesting either, but no, it's not a constraint I've ever hit so I doubt that I'd bother avoiding it, subconsciously or otherwise.

Re: Building a Mostly IPv6 Only Home Network

#83

Post by RulerOf »

spijdar wrote: post #54
icedchai wrote: post #26

Earlier quoted context omitted.

You know your external IPv4 address rarely changes and also basically linked to you too, right?

> your external IPv4 address rarely changes Bad generalization. I'm sure policy about this differs a lot, but my consumer ISP definitely reassigns my home's v4 address periodically. I don't track it closely, but it seems that when my ONT power cycles more often than not it pulls a new v4 address. Now, basing my privacy/security on this would be bad, but to GP's point, if I was using a static v6 block, not only would…

> using a static v6 block, not only would this address never change, each device in my LAN would have an extra identifier attached to it.

This is not true.

IPv6 stack allocates at least 3 addresses:

- Link-local - "Permanent" Address derived from the subnet and MAC - Temporary address that changes several times per day

The default address for new connections is always the temporary address. So IP-based tracking from outside your network will be no better than it was before from one day to the next—the /64 will be the only constant here, just as your router's WAN IPv4 is for v4 connections.

Re: Building a Mostly IPv6 Only Home Network

#84

Post by quietsegfault »

flumpcakes wrote: post #18
dwedge wrote: post #8

Earlier quoted context omitted.

I never understood the rationale of giving out /64 and /48 like candy after what happened with ipv4. I know it's still a massive increase in capacity and I know it makes the networking easier but it seems like we went from something that definitely won't run out (ipv6 addresses) to something that probably won't (number of /48 ranges)

In IPv6 the smallest 'subnet' is /64 if I recall correctly. It's weird having a subnet size equal to a complete IPv4 Internet worth of IPv6 Internets but I believe the rationale was that you would never in practise run of out IPs in your subnet. A lot of Enterprise IPv4 headaches are managing subnets that are not correctly sized (organic growth, etc.). IPv6 is always routable for the same reason (companies reusing RF…

The big issue I see is every enterprise has a solid numbering plan for RFC1918 networks. Unfortunately, many of them have the SAME plan, and when peering networking between SaaS vendors and customers was more popular (now, of course, privatelink seems to be the move) we constantly ran into conflicts. There's still the risk of conflict with IPv6, but I think if numbering decisions are made thoughtfully, they can be avoided.

Re: Building a Mostly IPv6 Only Home Network

#85

Post by yjftsjthsd-h »

jcalvinowens wrote: post #81
yjftsjthsd-h wrote: post #64

Earlier quoted context omitted.

How do you handle internal DNS? I'd really like `curl http://mylaptop.internal ` (or so) to work; that's easy with DHCP.

You can specify the DNS server in the router advertisements. This is how you do it in radvd.conf: interface enp2s0f1 { AdvSendAdvert on; AdvManagedFlag off; AdvOtherConfigFlag off; IgnoreIfMissing on; prefix ::/64 { AdvOnLink on; AdvAutonomous on; }; RDNSS fddd:deca:fbad:1::10 { AdvRDNSSLifetime infinity; }; DNSSL internal.domain { AdvDNSSLLifetime infinity; }; }; I haven't yet found a way to specify a local NTP serv…

Sure. And how does that internal DNS server know about your devices? I connect laptop1 and laptop2 to my network. With DHCP, they each told eg. dnsmasq their name when they connected so laptop1.mydomain.internal and laptop2.mydomain.internal both resolve to the IPs that were handed out to each device. With RDNSS+DNSSL I can tell them that they should look up records on my internal domain and against my internal DNS server, but I can't see a good way for that DNS server to know that they exist or what their hostnames are.

Re: Building a Mostly IPv6 Only Home Network

#86

Post by jcalvinowens »

simoncion wrote: post #63
jcalvinowens wrote: post #19

Do you actually own that /48? The problem with using the globally routable addresses internally is that your public /48 might change in the future, and and that will force you to change a bunch of internal stuff. I have my router set up to advertise two /64 prefixes on each LAN subnet: one from fddd:deca:fbad::/56* that I use for all internal communication, and one from 2001:5a8:xxxx:xxxx::/56 that is only used for t…

> Do you actually own that /48? Well. From TFA: So I decided to use Free Range Cloud service provider to lease a /48, which cost me around C$10/year. I also used their tunnel service to then route this over to me. The link embedded in the pull quote is [0], which isn't maximally helpful, but it's useful. Approximately 60 seconds of poking around there brings us to [1], which quotes a "ARIN - /48 IPv6 lease ... Use on…

It's was a rhetorical question, he doesn't own it. And it takes much less than sixty seconds to figure that out:

  $ whois 2602:fed2:7e02::
  ...
  NetRange:       2602:FED2:: - 2602:FED2:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
  CIDR:           2602:FED2::/32
  NetName:        10VPN-PRIMARY
  NetHandle:      NET6-2602-FED2-1
  Parent:         NET6-2600 (NET6-2600-1)
  NetType:        Direct Allocation
If that VPN provider goes out of business, he probably loses those addresses.

Re: Building a Mostly IPv6 Only Home Network

#87

Post by jcalvinowens »

simoncion wrote: post #68
jcalvinowens wrote: post #19

Do you actually own that /48? The problem with using the globally routable addresses internally is that your public /48 might change in the future, and and that will force you to change a bunch of internal stuff. I have my router set up to advertise two /64 prefixes on each LAN subnet: one from fddd:deca:fbad::/56* that I use for all internal communication, and one from 2001:5a8:xxxx:xxxx::/56 that is only used for t…

> * You're really supposed to pick a random prefix in fd00::/8, but uniqueness only matters if you intend to merge networks with somebody else later, I care more about it being easy to remember. If you don't care about collision resistance, why didn't you pick fd00:: ? That's way easier to remember than that jumble of letters you selected. It's actually my go-to subnet when someone claims that local-only IPv6 address…

Heh, fair enough. I picked it because it makes me laugh when I have to type it (say it in Elmer Fudd's voice). I don't actually type it very often.

Re: Building a Mostly IPv6 Only Home Network

#88

Post by jcalvinowens »

yjftsjthsd-h wrote: post #85
jcalvinowens wrote: post #81

Earlier quoted context omitted.

You can specify the DNS server in the router advertisements. This is how you do it in radvd.conf: interface enp2s0f1 { AdvSendAdvert on; AdvManagedFlag off; AdvOtherConfigFlag off; IgnoreIfMissing on; prefix ::/64 { AdvOnLink on; AdvAutonomous on; }; RDNSS fddd:deca:fbad:1::10 { AdvRDNSSLifetime infinity; }; DNSSL internal.domain { AdvDNSSLLifetime infinity; }; }; I haven't yet found a way to specify a local NTP serv…

Sure. And how does that internal DNS server know about your devices? I connect laptop1 and laptop2 to my network. With DHCP, they each told eg. dnsmasq their name when they connected so laptop1.mydomain.internal and laptop2.mydomain.internal both resolve to the IPs that were handed out to each device. With RDNSS+DNSSL I can tell them that they should look up records on my internal domain and against my internal DNS s…

Oh I see. You're supposed to use mdns, but I haven't actually done that yet, it's sort of the last thing on my list.

Mine is all static. I run a bind9 forwarder for DNS, and KEA for dhcp4. I have a little list of machines/macs/addresses as the source of truth, and a pair of python scripts that generates kea-dhcp4.conf and a bind9 zone file from that table.

When I enabled IPv6, I just put all the SLACC addresses in that table, and made the python script generate AAAA records too. But this is honestly really stupid, I need to actually use mdns...

I thought about writing a little systemd oneshot that used rfc2136 dyndns updates for home. But it feels like reinventing the wheel a bit...

Re: Building a Mostly IPv6 Only Home Network

#89

Post by jcalvinowens »

simoncion wrote: post #67
jcalvinowens wrote: post #53

Earlier quoted context omitted.

Don't use DCHPv6 at home. I tried: you will hate your life, lots of stuff doesn't support it. Android specifically has zero support for it, google says it never will. Use SLAAC. It just works.

I'm pretty sure that you can use both. RAs even have bits to indicate if one is supposed to autoconfigure, [0] hit up a DHCPv6 server for some or all configuration, [1] or both. radvd refers to them as AdvAutonomous and AdvOtherConfigFlag/AdvManagedFlag, respectively. [0] https://datatracker.ietf.org/doc/html/rfc4861#section-4.6.2 > [1] https://datatracker.ietf.org/doc/html/rfc4861#section-4.2 >

You can use both, but I've never found a good reason to at home. The DHCPv6 option for specifying an NTP server might be a good reason to... but even Linux machines ignored it when I tried. Maybe in five years :)

Re: Building a Mostly IPv6 Only Home Network

#90

Post by yjftsjthsd-h »

jcalvinowens wrote: post #88
yjftsjthsd-h wrote: post #85

Earlier quoted context omitted.

Sure. And how does that internal DNS server know about your devices? I connect laptop1 and laptop2 to my network. With DHCP, they each told eg. dnsmasq their name when they connected so laptop1.mydomain.internal and laptop2.mydomain.internal both resolve to the IPs that were handed out to each device. With RDNSS+DNSSL I can tell them that they should look up records on my internal domain and against my internal DNS s…

Oh I see. You're supposed to use mdns, but I haven't actually done that yet, it's sort of the last thing on my list. Mine is all static. I run a bind9 forwarder for DNS, and KEA for dhcp4. I have a little list of machines/macs/addresses as the source of truth, and a pair of python scripts that generates kea-dhcp4.conf and a bind9 zone file from that table. When I enabled IPv6, I just put all the SLACC addresses in th…

Perhaps I should give mDNS another look, then. Feels like a regression, but if it works.

> When I enabled IPv6, I just put all the SLACC addresses in that table, and made the python script generate AAAA records too.

Er, isn't that just manual static assignment, then? Not SLAAC? Don't get me wrong, static addresses do make DNS easy...

Post reply on HN