Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Building a Mostly IPv6 Only Home Network

varunpriolkar.com

Post reply on HN
Print view View original

91–100 of 106 posts

Re: Building a Mostly IPv6 Only Home Network

#91

Post by jcalvinowens »

yjftsjthsd-h wrote: post #90
jcalvinowens wrote: post #88

Earlier quoted context omitted.

Oh I see. You're supposed to use mdns, but I haven't actually done that yet, it's sort of the last thing on my list. Mine is all static. I run a bind9 forwarder for DNS, and KEA for dhcp4. I have a little list of machines/macs/addresses as the source of truth, and a pair of python scripts that generates kea-dhcp4.conf and a bind9 zone file from that table. When I enabled IPv6, I just put all the SLACC addresses in th…

Perhaps I should give mDNS another look, then. Feels like a regression, but if it works. > When I enabled IPv6, I just put all the SLACC addresses in that table, and made the python script generate AAAA records too. Er, isn't that just manual static assignment, then? Not SLAAC? Don't get me wrong, static addresses do make DNS easy...

> Er, isn't that just manual static assignment, then? Not SLAAC?

Haha no, much dumber than that: I boot the machine, get the permanent SLAAC address it comes up with, put that in the static table, and re-run the script to generate the zone files. The downside is the address changes if you reinstall the OS, but I do that so rarely it honestly hasn't been a problem (and you can force the older MAC-based address generation if you want it to be stable). I wouldn't recommend this setup though...

I do also have some static addresses, like that DNS server address.

Re: Building a Mostly IPv6 Only Home Network

#92

Post by yjftsjthsd-h »

jcalvinowens wrote: post #91
yjftsjthsd-h wrote: post #90

Earlier quoted context omitted.

Perhaps I should give mDNS another look, then. Feels like a regression, but if it works. > When I enabled IPv6, I just put all the SLACC addresses in that table, and made the python script generate AAAA records too. Er, isn't that just manual static assignment, then? Not SLAAC? Don't get me wrong, static addresses do make DNS easy...

> Er, isn't that just manual static assignment, then? Not SLAAC? Haha no, much dumber than that: I boot the machine, get the permanent SLAAC address it comes up with, put that in the static table, and re-run the script to generate the zone files. The downside is the address changes if you reinstall the OS, but I do that so rarely it honestly hasn't been a problem (and you can force the older MAC-based address generat…

LLOL, okay yes that is. Er. An unusual setup:D As the guy who usually says "if it works"... I'm surprised that works. But only because I thought SLAAC addresses changed at least per-boot. But since that clearly isn't the case: Well, if it works...

P.S. thanks for the funniest HN comment I've read in a while

Re: Building a Mostly IPv6 Only Home Network

#93

Post by jcalvinowens »

miyuru wrote: post #58
kccqzy wrote: post #29

Earlier quoted context omitted.

My ISPs change the /64 more often. So I use the ULA a lot more often. My router runs its own DNS server and then it advertises this DNS server using a ULA address.

I have mentioned this elsewhere, but ISPs should make BYOIPv6 more common, not just to the Business customers. Their are people like OP who do this via a VPS provider that supports BYOIP and then tunnel to the VPS network, so there is a demand. https://news.ycombinator.com/item?id=47355038

I've never heard of an end user ISP that would announce and route a customer owned block of addresses. They'll all give you a static allocation, but it will be in their block. Maybe if you were a huge customer they could do it... but I can't believe they would go to that much trouble for the measly Also, I very much don't want all my outbound internet traffic to come from a permanent address range I am publicly known to own. I'd still want an ephemeral /56 for outbound traffic that changed from time to time.

Re: Building a Mostly IPv6 Only Home Network

#94

Post by Dagger2 »

wolvoleo wrote: post #34
dwedge wrote: post #8

Earlier quoted context omitted.

I never understood the rationale of giving out /64 and /48 like candy after what happened with ipv4. I know it's still a massive increase in capacity and I know it makes the networking easier but it seems like we went from something that definitely won't run out (ipv6 addresses) to something that probably won't (number of /48 ranges)

Yes. I wish they had simply used a more sane address length instead, and maybe given everyone 65535 addresses at most. More than enough for the craziest home lab ever. Really, just adding 2 bytes to IPv4 would have fixed everything and made it a lot simpler to move over. IPv6 is overkill and I think that really hurt its adoption. I remember being at uni and being told "this is the next big thing". In 1993. And it's n…

Adding two bytes would have been just as much work as adding 12 bytes, and would have left us with too few addresses rather than too many. The MAC address space is now 64 bits and L3 is necessarily less dense than L2, so 128 bits is the smallest power of 2 where we can be reasonably sure we won't end up with too few addresses.

Considering how hard deploying a new L3 protocol is, we're only going to get one shot at it so it's a lot better to end up with too many addresses rather than too few.

Re: Building a Mostly IPv6 Only Home Network

#95

Post by wolvoleo »

Dagger2 wrote: post #94
wolvoleo wrote: post #34

Earlier quoted context omitted.

Yes. I wish they had simply used a more sane address length instead, and maybe given everyone 65535 addresses at most. More than enough for the craziest home lab ever. Really, just adding 2 bytes to IPv4 would have fixed everything and made it a lot simpler to move over. IPv6 is overkill and I think that really hurt its adoption. I remember being at uni and being told "this is the next big thing". In 1993. And it's n…

Adding two bytes would have been just as much work as adding 12 bytes, and would have left us with too few addresses rather than too many. The MAC address space is now 64 bits and L3 is necessarily less dense than L2, so 128 bits is the smallest power of 2 where we can be reasonably sure we won't end up with too few addresses. Considering how hard deploying a new L3 protocol is, we're only going to get one shot at it…

Ehm but IPv6 packets still have the L2 layer as well right? Which already includes the MAC address. So that 64 address MAC space is doubled, it's not like you're saving any. It was a pretty arbitrary decision to accommodate the MAC address inside the IPv6 address and these days it's usually randomised anyway for privacy purposes, so the MAC part of an IPv6 packet doesn't have to be the size of the MAC address.

L3 has nothing to do with MAC addresses anyway so I've always found that a pretty weird decision anyway. Sure, it avoids having to implement ARP but we need that again now anyway with the randomisation. And ARP is like a one-time in a few minutes kinda thing anyway.

I'm pretty sure that if we'd just gone for "a couple bytes extra" we'd have long been completely over. It's the whole L3 transition itself that suffers from the complexity. I remember it well in the 2000s, nobody in telecoms wanted to touch it. And when IPv6 was invented in '93 or so, the installed base was extremely small. It'd have been a piece of cake to get it over with then.

Re: Building a Mostly IPv6 Only Home Network

#96

Post by Dagger2 »

quietsegfault wrote: post #84
flumpcakes wrote: post #18

Earlier quoted context omitted.

In IPv6 the smallest 'subnet' is /64 if I recall correctly. It's weird having a subnet size equal to a complete IPv4 Internet worth of IPv6 Internets but I believe the rationale was that you would never in practise run of out IPs in your subnet. A lot of Enterprise IPv4 headaches are managing subnets that are not correctly sized (organic growth, etc.). IPv6 is always routable for the same reason (companies reusing RF…

The big issue I see is every enterprise has a solid numbering plan for RFC1918 networks. Unfortunately, many of them have the SAME plan, and when peering networking between SaaS vendors and customers was more popular (now, of course, privatelink seems to be the move) we constantly ran into conflicts. There's still the risk of conflict with IPv6, but I think if numbering decisions are made thoughtfully, they can be av…

There's no risk at all if you're using your own allocated prefix, because those are managed by IANA/RIRs/LIRs to not overlap.

Incidentally, if you find yourself experiencing an RFC1918 clash, one simple way of fixing it is to use NAT64 to map the remote side's RFC1918 into a /96 from your v6 allocation. You can write the last 32 bits of a v6 address in v4 format, so this leads to addresses like 2001:db8:abc:6401::192.168.0.10 and 2001:db8:abc:6402::192.168.0.10, which don't overlap from your perspective.

(If you wanted something simpler to type you could put them at e.g. fd01::192.168.0.10... but then you do start running the risk of collisions with other people who also thought they could just use a simple ULA prefix.)

Re: Building a Mostly IPv6 Only Home Network

#97

Post by spijdar »

RulerOf wrote: post #83
spijdar wrote: post #54

Earlier quoted context omitted.

> your external IPv4 address rarely changes Bad generalization. I'm sure policy about this differs a lot, but my consumer ISP definitely reassigns my home's v4 address periodically. I don't track it closely, but it seems that when my ONT power cycles more often than not it pulls a new v4 address. Now, basing my privacy/security on this would be bad, but to GP's point, if I was using a static v6 block, not only would…

> using a static v6 block, not only would this address never change, each device in my LAN would have an extra identifier attached to it. This is not true. IPv6 stack allocates at least 3 addresses: - Link-local - "Permanent" Address derived from the subnet and MAC - Temporary address that changes several times per day The default address for new connections is always the temporary address. So IP-based tracking from…

Ah, handy! Though it can't always be true, at least for manual configuration ;-) I have two VPSes with v6 addresses (the others don't have it configured...), and both only have LL and their permanent Internet addresses.

My understanding is v6 has two different autoconf schemes, DHCPv6 and a more "native" solution. Do these both always result in interfaces having multiple (routable) addresses?

Most of my IPv6 experience has been setting it up on aforementioned VPS, and being rewarded with slow OS updates, since NetBSD's default CDN, Fastly, blackholes PMTUD, so I had to drop the MTU on the interface just to get v6 TCP connections to work at all[0]. And for point-to-point networking in an overlay VPN, where I just discovered that Chromium has an 11-year outstanding "bug" where it refuses to perform AAAA lookups if you don't have public IPv6 routing.

[0] I could switch mirrors, but the bandwidth drop isn't quite bad enough for me to bother...

Re: Building a Mostly IPv6 Only Home Network

#98

Post by throw0101c »

wolvoleo wrote: post #31

Why though? What's the problem with ipv4? I find it much simpler for troubleshooting etc to have simple IPv4 addresses. But cool that it can be done :) I've switched off IPv6 on my router anyway, I haven't yet needed it. My provider didn't offer it last time I checked but when they do enable it I don't want it suddenly popping up against an untested router configuration.

> Why though? What's the problem with ipv4?

NAT in general where if you need/want peer-to-peer (P2P) you're suddenly in the realm of STUN/TURN/ICE infrastructure. Depending on your ISP, there's also CG-NAT, in which case (double) hole punching is basically impossible.

If you're 'just' a user, then that may have been dealt with the for you by whatever app/service you're using (e.g., video game companies), but if you're the one having to push out the good/service, it's an entire layer of complexity that has to be dealt with.

Re: Building a Mostly IPv6 Only Home Network

#99

Post by icedchai »

spijdar wrote: post #54
icedchai wrote: post #26

Earlier quoted context omitted.

You know your external IPv4 address rarely changes and also basically linked to you too, right?

> your external IPv4 address rarely changes Bad generalization. I'm sure policy about this differs a lot, but my consumer ISP definitely reassigns my home's v4 address periodically. I don't track it closely, but it seems that when my ONT power cycles more often than not it pulls a new v4 address. Now, basing my privacy/security on this would be bad, but to GP's point, if I was using a static v6 block, not only would…

If you had v6, they'd probably also reassign your IPv6 prefix delegation, too.

Also, v6 supports "privacy extensions", essentially randomizing the host portion of the address and periodically rotating it, so it is not accurate to say your address would never change.

Re: Building a Mostly IPv6 Only Home Network

#100

Post by chungy »

cesarb wrote: post #65
chungy wrote: post #13

Earlier quoted context omitted.

IPv4 is pretty simple and good for LANs. Nothing wrong with sticking to it.

> IPv4 is pretty simple and good for LANs. Until the place you're VPNing to happens to use the same RFC1918 network address as your LAN (that is, your LAN is 192.168.10.x and the network on the other side of your work's VPN is also 192.168.10.x). Or either of them use the same RFC1918 network address libvirt is using for its virtual network. Or you want to route between several LANs (for instance, after a company mer…

Don't confuse "simple and good" with "flawless" :-)

There are indeed only a few private-reserved IPv4 ranges, and almost everyone prefers to keep things memorable and easy to type; you get a lot of 10.0.0.0/24, 192.168.0.0/24, 192.168.1.0/24 as a result. That, and common household routers tend to default to one of these three /24 subnets. (Hardly anyone seems to remember that 172.16.0.0/12 exists, feel free to use that if it happens to work for you.)

IPv6 does solve this issue in a few major ways, one of which is the greater expectation to rely on globally routable addresses, of which every one of your devices will have at least one such address. There's also fc00::/7 which is fairly equivalent to the IPv4 private ranges, though to avoid conflicts in random VPNs you should generate a random /64 prefix inside of this, otherwise you run the risk of everyone picking fc00::/64 because it's easy to remember/type (I'm guilty of this myself, but the VPNs I've configured just go into a random 172.16.0.0/12 subnet and no v6 assigned. I have the liberty that I currently don't need/use any VPNs that I haven't personally configured, and that may not hold true in the future.)

Post reply on HN