No, I like living in my nat cocoon so I don’t have to worry as much about all the devices on my network. Jk it’s turned on, but I don’t usually enable it on devices
Haha, no not really. IPv6 has the ability to provide public IP address for each device, but that doesn’t mean it will have to. Other than number of possible addresses, nothing is different. Routing, firewalls, NATs, etc. All remains the same.
In IPv6 every device should in theory have a public address - just like how every computer had a public IPv4 address back in the 1980s ~ 1990s.
However, most sensible routers will have a firewall setup by default that blocks all incoming connections for security reasons. You still need to add firewall rules.
There’s no “should in theory”. It’s only a possibility due to sheer number of possible combinations. No one was ever going to make every device public. It makes absolutely no sense. Why would your company’s printer be online or isolated networks or VPNs? There’s no point.
IP addressing is just a way to give a globally unique number to each device. It’s just a number.
And there wasn’t a real public/private distinction when the Internet was still in its infancy. Printers were indeed given “public” addresses because people needed a number for it.
If you don’t want your printer to be reachable by the public Internet, use a firewall to block outside connections. If you can use NAT, you certainly can use a firewall. Heck, they are almost the same thing if you have been using the Linux kernel (iptables/nftables handle firewalling and masquerading with the same tool!)
Routability is not the same as reachability. With NAT transversal you can reach my “private” hosts all the same, although you can’t route to me because I don’t have a public address.
It’s not necessary to firewall every device. Just like how your router can handle NAT, it should be able to handle stateful firewall too.
Mine blocks all incoming connections by default. I can add (IP, port range) entries to the whitelist if I need to host a service, it’s not really different to NAT port forwarding rules.
Yes, the firewall is still your transition point from your internal network to your ISP network. Just like with ipv4, you should be configuring your ipv6 firewall to only allow designated traffic into your network from the internet.
Right. Packets still have to go through your router, assuming that your router has firewall turned on, it goes like this:
Your router receives a packet.
It checks whether the packet is “expected” (a “related” packet) - by using connection tracking.
For example, if ComputerA had sent something to ServerX before, and now the packet received by router says “from ServerX to ComputerA”, then the packet is let through - surely, this packet is just a reply to ComputerA’s previous requests.
If step 2 fails - we know this is a new incoming packet. Possibly it comes from an attacker, which we don’t want. And so the router checks whether there is a rule that allows such a packet to go through (the assumption is that since you are explicitly allowing it, you know how to secure yourself.)
If I have setup a firewall rule that says “allow packets if their destination is ComputerB, TCP port 25565”, and the received packet matches this description, the router lets it through.
Finally, the packets that the router accepts from the previous steps are forwarded to the relevant LAN hosts.
I understand this part :) I use a fairly complex firewall at work though I only know bits and pieces from reading different manuals. I think the part I didn’t understand was how exactly the routing worked differently in IPv4 vs v6. I get that because NAT happens in IPv4, packets can’t be routed at all without the firewall/router but I wasn’t sure what was the mechanism by which v6 made sure that packets went through the router, especially when you have stuff like v6 DHCP relays.
Ah, I misunderstood your original comment, oops! But yes, IPv6 packets are routed just like IPv4 ones, just without the NAT’ing process i.e. the packet remains untouched the entire trip.
Okay, so manu of these answers are just plain wrong. In short, you shouldn’t care as the biggest impact will be to network admins. They are the ones who have to configure routing and handle everything else that comes with new addresses. The rest of the world simply doesn’t know or notice whether they are using IPv4 or v6. Business as usual.
If the question is whether you should play with it at home. Sure thing if you have the desire to. It’s the future and only a matter of time before it becomes a reality. Said network admins and ISPs have been delaying the transition since they are the ones who have to work it out and putting your entire user base behind single IPv4 NAT is simpler than moving everything to IPv6.
From network admin perspective, yes it’s worth moving to IPv6 since network topology becomes far simpler with it. Fewer sub-networks, and routing rules to handle those. Less hardware to handle NAT and other stuff. Problem is, they made the bed for themselves and switching to IPv6 becomes harder the more you delay it. Number of users in past 10 years or so has skyrocketed. Easily quadrupled. We use to have home computers with dial-up. Easy enough, assign IP when you connect, release it on disconnect. Then broadband came and everyone is sitting online 100% of the time. Then mobile phones which are also online 100% of the time. Then smart devices, now cars and other devices start having public internet access, etc. As number of users increases, network admins keep adding complexity to their networks to handle them. If you don’t have public IP, just do traceroute and see how many internal network hops you have.
Definitely dual stack if you do. The real benefit of IPv6 is that, supposedly, each of your internal devices can have its own address and be directly accessible, but I don’t think anyone actually wants all of their internal network exposed to the internet. My ISP provides IPv6, but only a single /128 address, so everything still goes through NAT.
Setting it up was definitely a learning process - SLAAC vs DHCP; isc’s dhcpd uses all different keywords for 6 vs 4, you have to run 6 and 4 in separate processes. It’s definitely doable, but I think the main benefit is the knowledge you gain.
I’m lazy and don’t want to remember more than three digits in an IP address or secure all my devices like they’re publicly routable so I’m sticking with IPv4
Thank you! I just want to say, I’ve also been curious about ipv6 every now and again for a long time, and this thread has helped me to understand more.
There aren’t many benefits from using IPv6 on LAN, as far as I can tell, unless you need more addresses than are available in the private address ranges.
IPv6 is the future so I’d say yes. Dual stack is the way to go. If you can get public address block from your ISP thats great. If not I’d recommend HE tunnel or something similar. Just remember to firewall as ever device is reachable in most configurations.
There’s a pretty interesting series on the topic at Tall Paul Tech’s YouTube channel (here’s the most recent: https://youtu.be/WFso88w2SiM). He goes into quite a bit of detail over the course of a few videos about how he handled everything and highlights some of the trials and tribulations with the isp. It’s not a guide per se, but definitely stuff worth thinking through.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No, I like living in my nat cocoon so I don’t have to worry as much about all the devices on my network. Jk it’s turned on, but I don’t usually enable it on devices
Get a firewall. Malicious STUN, ALG DoS attacks, just these things make your NAT router less secure than you think it is.
You’re asking if you should use it, while my ISP was working on it in 2017 and then it all got canned when they got bought out :( .
Because devices in your LAN will all be accessible from the internet with IPv6, you need to firewall every device.
It becomes more of a problem for IoT devices which you can’t really control. If you can, disable ipv6 for those.
Haha, no not really. IPv6 has the ability to provide public IP address for each device, but that doesn’t mean it will have to. Other than number of possible addresses, nothing is different. Routing, firewalls, NATs, etc. All remains the same.
Wait, ipv6 doesn’t require port forwarding to expose something to the internet?
Port forwarding is exclusively a NAT phenomenon.
In IPv6 every device should in theory have a public address - just like how every computer had a public IPv4 address back in the 1980s ~ 1990s.
However, most sensible routers will have a firewall setup by default that blocks all incoming connections for security reasons. You still need to add firewall rules.
This is correct. My router however doesn’t have that level of firewall. It’s either all allowed or nothing is.
There’s no “should in theory”. It’s only a possibility due to sheer number of possible combinations. No one was ever going to make every device public. It makes absolutely no sense. Why would your company’s printer be online or isolated networks or VPNs? There’s no point.
IP addressing is just a way to give a globally unique number to each device. It’s just a number.
And there wasn’t a real public/private distinction when the Internet was still in its infancy. Printers were indeed given “public” addresses because people needed a number for it.
If you don’t want your printer to be reachable by the public Internet, use a firewall to block outside connections. If you can use NAT, you certainly can use a firewall. Heck, they are almost the same thing if you have been using the Linux kernel (iptables/nftables handle firewalling and masquerading with the same tool!)
Routability is not the same as reachability. With NAT transversal you can reach my “private” hosts all the same, although you can’t route to me because I don’t have a public address.
It’s not necessary to firewall every device. Just like how your router can handle NAT, it should be able to handle stateful firewall too.
Mine blocks all incoming connections by default. I can add (IP, port range) entries to the whitelist if I need to host a service, it’s not really different to NAT port forwarding rules.
So even though the device has a public address, the route is through the firewall, hence the ability to filter traffic?
Yes, the firewall is still your transition point from your internal network to your ISP network. Just like with ipv4, you should be configuring your ipv6 firewall to only allow designated traffic into your network from the internet.
Right. Packets still have to go through your router, assuming that your router has firewall turned on, it goes like this:
Your router receives a packet.
It checks whether the packet is “expected” (a “related” packet) - by using connection tracking.
For example, if ComputerA had sent something to ServerX before, and now the packet received by router says “from ServerX to ComputerA”, then the packet is let through - surely, this packet is just a reply to ComputerA’s previous requests.
If step 2 fails - we know this is a new incoming packet. Possibly it comes from an attacker, which we don’t want. And so the router checks whether there is a rule that allows such a packet to go through (the assumption is that since you are explicitly allowing it, you know how to secure yourself.)
If I have setup a firewall rule that says “allow packets if their destination is ComputerB, TCP port 25565”, and the received packet matches this description, the router lets it through.
Finally, the packets that the router accepts from the previous steps are forwarded to the relevant LAN hosts.
I understand this part :) I use a fairly complex firewall at work though I only know bits and pieces from reading different manuals. I think the part I didn’t understand was how exactly the routing worked differently in IPv4 vs v6. I get that because NAT happens in IPv4, packets can’t be routed at all without the firewall/router but I wasn’t sure what was the mechanism by which v6 made sure that packets went through the router, especially when you have stuff like v6 DHCP relays.
Ah, I misunderstood your original comment, oops! But yes, IPv6 packets are routed just like IPv4 ones, just without the NAT’ing process i.e. the packet remains untouched the entire trip.
Okay, so manu of these answers are just plain wrong. In short, you shouldn’t care as the biggest impact will be to network admins. They are the ones who have to configure routing and handle everything else that comes with new addresses. The rest of the world simply doesn’t know or notice whether they are using IPv4 or v6. Business as usual.
If the question is whether you should play with it at home. Sure thing if you have the desire to. It’s the future and only a matter of time before it becomes a reality. Said network admins and ISPs have been delaying the transition since they are the ones who have to work it out and putting your entire user base behind single IPv4 NAT is simpler than moving everything to IPv6.
From network admin perspective, yes it’s worth moving to IPv6 since network topology becomes far simpler with it. Fewer sub-networks, and routing rules to handle those. Less hardware to handle NAT and other stuff. Problem is, they made the bed for themselves and switching to IPv6 becomes harder the more you delay it. Number of users in past 10 years or so has skyrocketed. Easily quadrupled. We use to have home computers with dial-up. Easy enough, assign IP when you connect, release it on disconnect. Then broadband came and everyone is sitting online 100% of the time. Then mobile phones which are also online 100% of the time. Then smart devices, now cars and other devices start having public internet access, etc. As number of users increases, network admins keep adding complexity to their networks to handle them. If you don’t have public IP, just do
tracerouteand see how many internal network hops you have.Definitely dual stack if you do. The real benefit of IPv6 is that, supposedly, each of your internal devices can have its own address and be directly accessible, but I don’t think anyone actually wants all of their internal network exposed to the internet. My ISP provides IPv6, but only a single /128 address, so everything still goes through NAT.
Setting it up was definitely a learning process - SLAAC vs DHCP; isc’s dhcpd uses all different keywords for 6 vs 4, you have to run 6 and 4 in separate processes. It’s definitely doable, but I think the main benefit is the knowledge you gain.
I’m lazy and don’t want to remember more than three digits in an IP address or secure all my devices like they’re publicly routable so I’m sticking with IPv4
Same, so I use DNS and a firewall.
You mean like
~/.ssh/config?Setup mDNS and you don’t have to remember IP addresses anymore.
ssh orangeboats@orangeboats-router.localis thousand times better to memorise.You could assign short addresses like fd00::1
Depends on how you define “worth it”. Most selfhosting is done not for worth, but for a hobby.
Hobbies are often worthwhile. Maybe not financially, but often psychologically.
Some times not financially or psychologically, and they also make my wife mad when I fat finger some config.
Thank you! I just want to say, I’ve also been curious about ipv6 every now and again for a long time, and this thread has helped me to understand more.
There aren’t many benefits from using IPv6 on LAN, as far as I can tell, unless you need more addresses than are available in the private address ranges.
IPv6 is the future so I’d say yes. Dual stack is the way to go. If you can get public address block from your ISP thats great. If not I’d recommend HE tunnel or something similar. Just remember to firewall as ever device is reachable in most configurations.
deleted by creator
There’s a pretty interesting series on the topic at Tall Paul Tech’s YouTube channel (here’s the most recent: https://youtu.be/WFso88w2SiM). He goes into quite a bit of detail over the course of a few videos about how he handled everything and highlights some of the trials and tribulations with the isp. It’s not a guide per se, but definitely stuff worth thinking through.