I bet the majority of the new adoption traffic is from mobile networks though. Need more wired carriers adopting.
post
I gotta suck it up and learn IPv6. My ISP now provides me with a /64. But I feel like I have a lot of knowledge gaps on their features so I'm worried about security. Especially with all the new features like SLAAC.
What's the best crash course these days? Go through Cisco materials or something?
You need to find out if your ISP supports prefix delegation. A /64 will only give you one subnet. An ISP should supply a /56 if your router requests it. There are some bad ISPs out there that won't though.
Doesn't a /64 already give me more than I'll ever use?
An IPv6 subnet must be /64. Anything else breaks stuff. If you want a separate network for guests or IoT devices, a single /64 won't be enough because it can't be divided up any smaller.
You can't subnet below a /64 at all? Or it just makes things like SLAAC/auto-addressing using the MAC address unusable?
SLAAC won't work with a smaller subnet. Static addressing is not an option since your /64 is going to be dynamically assigned. That leaves DHCPv6, which won't work with any android devices or chromebooks.
It would be best to just run IPv6 on one network if you can't at least get a /60.
I'm a bit concerned about SLAAC's metadata leakage. Sending out many of my devices' MAC addresses to the world isn't exactly the best for privacy. My key devices like laptop and phone use MAC randomization, but I have a ton of other stuff that doesn't.
That leaves DHCPv6, which won’t work with any android devices or chromebooks.
Damn, that's a straight WONTFIX, too since 2014. Lots of religious argument in there, maybe I'm reading all that tonight.
Thanks for answering my questions.
Modern operating systems don't use the MAC address for SLAAC. They generate a completely random address. You can choose a stable address or a temporary one that will change frequently for more privacy. You can also use both, IPv6 allows multiple addresses on one device.
The only legitimate v6 prefix smaller than /64 is /127, to be used for point to point links, similar to /31’s in v4, but these aren’t processed for routing outside of the boxes the link is configured on.
The concepts of addressing for v4 and v6 don’t map 1:1.
From the perspective of the internet, and any properly configured routing infrastructure, they should only ever be interested in the first 64 bits when routing, the second 64 should be exclusively the domain of the last segment. It’s like inserting an additional type of addressing between the routing portion and the protocol port.
You kind of have this with v4, but it’s variable, particularly since CIDR shot the v4 address classes in the head, so the equipment had to be able to process the entire address with every routing lookup and other functions.
I feel that but I’m also torn because IPv4 keeps plugging along for me and work isn’t moving to v6 anytime soon for the private networks.
If you happen to find a good resource, can you ping me? I'm in the same boat.
Anybody who doesn’t block Google mind giving a tldr?
My ISP gives me my own IPv6, and I have shared IPv4 with CGNAT, but unfortunately, they can't assign me a static v6, so that I can have servers and stuff. So I just do things like that over Tor. Though things like Tor need work as well, because you're not able to have a Tor relay on IPv6. You need V4 for that.
Using noip or the like to get a DDNS name would solve the changing address problem.
If you're willing to spend a coupla bucks a month you can setup wireguard and iptables on a vps, and port forward through the public IP on your VPN server to yourbhome router via the wg interface.
Also good for anonymous home hosting if you pay with xmr, turn off logging (bonus pts for luks and RO filesystems) and use the right host.
I'm interested in running ipv6 for my home but my ISP doesn't support ipv6 yet heh. Maybe I'll send them this graph.
Hurricane Electric provides free IPv6 tunnels. They will give you a /48 if you request it. I used them for several years before I got native IPv6. It does require a public IPv4 address, so it won't work with CGNAT.
All my hardware supports IPv6; my router and modem support IPv6; my ISP supports IPv6.
And yet… I can’t use IPv6 because my ISP won’t turn it on if your modem is in bridge mode; they want to control the entire stack before they’ll let me use it. They only route it from their own hardware.
My SMB router doesn’t support ipv6 for many functions including policy routing between isps
Imagine my surprise to see my ipv4 through T-Mobile and my ipv6 through Starlink.
That's an "advantage" of IPv6; your local IP addresses now belong to the ISP, so the router can't do anything like policy based routing. If your device is using a Starlink IPv6 address, the only route to it is Starlink. If both ISPs are giving you a delegation, your devices need to get IPs on both networks and then it's up to each device/OS to implement any policy you want, not the router.
This is, of course, a massive pain in the arse. It breaks VPNs, policy based routing, and high-availability/failover, unless you do address translation at the router - but in that case, you might as well just use IPv4, since address translation is the great bear you're using IPv6 to avoid. All for the highly dubious benefit of exposing all your internal infra directly to the Internet.
IPv6 is great for public traffic, but way more trouble than it's worth for internal networks.
Yet GitHub still doesn't support IPv6 because Microsoft makes money selling IPv4 addresses to Azure customers.
Ahh im scared of ipv6 for selfhosting, ill have to learn a new internet protocall.
I don't care about network routing. It's necessary, useful, and clever, but I understand IPv4 because I have to. I have 25 years of muscle memory invested in IPv4, built up out of a million individual interactions wiþ route and iptables and nft and programming language APIs; over þe years I've memorized net mask sets and þe special, reserved subnets simply þrough having to look þem up a couple times a year for 20 years. And it works everywhere, all þe time.
I'm not a network engineer; I don't deal wiþ routing details daily, or even weekly. It's necessary but not interesting. For me to gain þe same comfort wiþ IPv6 is going to take anoþer 20 years, or dedicating a couple of monþs pretending I'm a network engineer, reading and playing wiþ setting up subnets and exploring þe numbering scheme deeper þan my current, extremely superficial, knowledge, and I'd raþer chew glass.
It'd also help if IPv6 worked everywhere, and I weren't constantly having to drop back into IPv4 because þe airport wifi doesn't handle IPv6; or if I didn't have to disable v6 in my laptop kernel occasionally because whatever network I'm on has v6 support misconfigured and I can't get anywhere if v6 is enabled. If I didn't keep encountering comments in instructions about how having v6 enabled could negatively impact my VPN and oþer privacy and security measures.
IPv6 is an exercise in frustration. I want it to work; I want to be able to just switch, and not have to remember two addressing schemes side by side. Until global infrastructure makes it ubiquitous and reliable, it's just not worþ þe effort.
all 22 comments