Comment by Pleb@feddit.de on It's easier to remember the IPs of good DNSes, too.

Today in our newest take on “older technology is better”: why NAT rules!

You can still NAT IPv6

I haven’t read anything this cursed in a while

Yes, but why would you want to? We have enough addresses for the foreseeable future.

So you don’t need to change your network if your isp changes.

You shouldn’t have to?? Maybe you might need to change the mask in your firewall settings if the ipv6 allocation block size changes but that should be it.

Everything else should just work as normal.

You should only assign static ipv6 to servers, in theory you could just define a host id and use a prefix too. But, most people at home really aren’t running enough servers to make that worthwhile. Everything else should just pick up new addresses fine using ND.

There ought to be more servers.

Will the app for the smart thermostat be updated three years from now and still be useful? If it was instead a web server app on a routable IP, it wouldn’t matter provided they didn’t fuck up the authentication and access control.

Yeah, but they’re not. That’s the modern world. But also even if it was a web server there’s usually ways to advertise the IP for the app to connect to. I’ve seen other stuff do that. So getting an IP is easy. Once the app knows the IP and if you really want to allow connections from outside to your IOT devices (I wouldn’t) it could remember the IP and allow that.

You really don’t need to give a fixed IP to everything. I think I’ve given 1 or 2 things fixed IPv6 IPs. Everything else is fine with what it assigns itself.

The other app off the top of my head is VoIP. You should be able to “dial” a number directly. Most solutions go through the company’s data center first in order to pierce through NAT. Which makes it more expensive, less reliable, slower, and more susceptible to snooping.

There’s a “if you build it, they will come” effect here. Once you can address hosts directly, a whole bunch of things become better, and new ideas that were infeasible are now feasible. They don’t exist now because they can’t.

You can use ULAs (unique local addresses) or that purpose. Your devices can have a ULA IPv6 address that’s constant, and a public IPv6 that changes. Both can be assigned using SLAAC (no manual config required).

I do this because the /56 IPv6 range provided by my ISP is dynamic, and periodically changes.

Yes but you’d still be performing NAT. It’s at least 1:1.

You’ll need to deal with firewall rules regardless, and drop IPs into policies. IPv6 doesn’t remove any of those chores but gets rid of having to maintain tables to deal with many-to-one NAT.

You wouldn’t need NAT. The ULA is used on the internal network, and the public IP is for internet access. Neither of those need NAT.

If you use a single shared public ip then you’re using some amount of address translation.

If you’re using an external ip address that’s different than an internal ip address but both are assigned to a single host the you’re doing 1:1 NAT.

At least that’s how I understand ipv4 and I don’t think ipv6 is much different.

What translates the public ip to the internal ip? Aren’t they different?

The solution to that is to buy a net block. IPV6 address space is very affordable.

1:1 stateless NAT is useful for static IPs. Since all your addresses are otherwise global, if you need to switch providers or give up your /64, then you’ll need to re-address your static addresses. Instead, you can give your machines static private IPs, and just translate the prefix when going through NAT. It’s a lot less horrible than IPv4 NAT since there’s no connection tracking needed.

This is something I probably should have done setting up my home Kubernetes cluster. My current IPv6 prefix is from Hurricane Electric, and if my ISP ever gives me a real IPv6 prefix, I will have to delete the entire cluster and recreate it with the new prefix.

It should only be needed if your ISP is brain-dead and only gives you a /64 instead of what they should be doing and also giving you a /56 or /48 with prefix delegation (I.e it should be getting both a 64 for the wan interface, and a delegation for routing)

You router should be using that prefix and sticking just a /64 on the lan interface which it advertises appropriately (and you can route the others as you please)

Internal ipv6 should be using site-local ipv6, and if they have internet access they would have both addresses.

64 for the wan interface

Nitpicking, but the address for the wan interface wouldn’t have a prefix, so the host would just set it as a /128 (point-to-point)

Ehh, I’ve seen both. Perhaps not in a home router context though, never really bothered to check

And if you want static ips either use dhcp6 or disable the randomisation of eui64 addresses

I have static IPs for my Kubernetes nodes, and I actually use DHCPv6 for dynamic dns so I can reach any device with a hostname, even though most of my devices don’t have static IPs.

The issue is those static IPs are tied to my current ISP, preventing me from changing ISPs without deleting my entire Kubernetes cluster.

It certainly looks like you can give it a prefix to assign out, possibly even multiples

Hurricane Electric gives me a /48.

Site-local ipv6 would work here as well, true. But then my containers wouldnt have internet access. Kubernetes containers use Ipam with a single subnet, they can’t use SLAAC.

Point is, you should be able to have them have both. Or stick a reverse proxy in front that can translate. Unless they’re somehow meant to be directly internet reachable the public addresses could be autogenerated

Full disclosure though I don’t know anything about kubernetes.

Yeah, I wonder if there’s any proposals to allow for multiple IPV6 addresses in Kubernetes, it would be a much better solution than NAT.

As far as I know, it’s currently not possible. Every container/Pod receives a single IPv4 and/or IPv6 address on creation from the networking driver.

My ISP does this right (provides a /56 for routing), but unfortunately both are dynamic and change periodically. Every time I disconnect and reconnect from the internet, I get a different prefix.

I ended up needing to have ULAs for devices where I need to know the IPv6 address on my network (e.g. my internal DNS servers).

Indeed, that’s correct ula usage, but shouldn’t need nat rewriting. The global prefixes just need to be advertised by RA packets

I use openwrt on my home network which uses dnsmasq for dhcp. It can give a static suffix which just works with the global prefix on the interface and the site local / ula prefix it uses

Yeah I’m not using NAT, sorry for the confusion.

My router doesn’t support RAs for a ULA range though, so I’m running radvd on my home server.

That’s what they thought for IPv4… and for 2-year digits… and for…

Only if you’re a masochist.

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

Keep content in english
No advertisements
Posts must be related to programming or programmer topics

It's easier to remember the IPs of good DNSes, too.(lemmy.sdf.org)

Programmer Humor

!programmer_humor@programming.dev

Rules

Community stats

Community moderators