Its the time oft the year, where we all geht rid of NAT for a month! So get your IPv6 addresses ready (except you own enough IPv4s) 😀

I have been using my iPhone hotspot for a couple years to play online with my ps5 at work since it’s the only connection I can use, then the other day it won’t connect. It finally gives me a message about not working with ipv6. I guess my phone switched to ipv6 or something? What can I do?

Hello, I have never really interacted with ipv6 and want the convert my homelab to dual stack. I'm starting with wireguard as I keep getting ipv6 leaks and I have a few questions about how I would go about converting everything.

1. I understand you have link local and global addresses and the same interface can have multiple addresses to cover private and global routing however how does this work with the router's address surely it makes the router redundant as it's globally routable and therefore doesn't go via the router?

2. How do I make sure devices are secure and if all devices are globally routable then do you need to do things like port forwarding does this mean anyone can reach any port if nftables doesn't block it?

3. When you setup wireguard using ipv4 you assign it a private address space for ipv6 would you assign link local addresses in its place?

4. What is neighbour discovery protocol. Wireguard blocks around packets so do I need to worry about NDP?

5. What's the suggested way of keeping track of ipv6 machines do you give them static like in ipv4 and just remember the address or do you do some kind of DNS discovery and always use DNS names?

6. What are the general best practices for dual stack/ipv6 and do you have any other resources as I'm still kinda stuck in thinking the ipv4 way?

Ps I hope what I'm saying makes sense if it doesn't please tell me and I'll try to explain what I mean

Over the past four years, Xiong’an, China has been actively exploring and innovating in the field of IPv6 as part of its ‘Millennium Plan’ as a national comprehensive pilot city for IPv6.

This blog post provides an update on the progress made:

https://blog.apnic.net/2024/10/29/the-realities-of-building-an-ipv6-only-city/

SUSE SLE has released a version of ndppd 43 commits after the latest upstream release. This ticket asks the author to cut an official release. Click the Code link to see the readme on what this does for IPv6 routers. (I use it in my home router based on a Pi 4B.)

https://github.com/DanielAdolfsson/ndppd/issues/90

Hi all !

I just open-sourced a tool i use since 2+years.

It basically updates all the configured DNS zones with the new IPv6 prefix, keeping the host part intact.

This is particularly useful when you have multiple servers on multiple domains on multiple registrars (only Cloudflare and IONOS are supported atm).

IPv4 dymamic DNS is also still supported.

In hope it will help people here

https://github.com/Mathis-6/update-ddns

IPv6 is currently 128 bits. Which represents long and complex addresses to write by hand.

With 64-bit addresses, the writing would be halved and this would still allow 4 billion * 4 billion addresses. I believe that the end of the world would arrive before we exhausted this enormous quantity of addresses.

If SLAAC is used for IPv6 address assignment, can the stateless DHCP request used to determine DNS servers also be used to initiate a DDNS update request? This assumes the DHCP request includes the SLAAC assigned IPv6 address, the router updates that request to include the host MAC address and the DHCP server has MAC to DNS entry data.

I setup a tunnel with the openwrt 19.7.5 6in4 but I only see outgoing traffic and I can ping the IPv6 address but no outside IPv6 address!

Large parts of africa are coming online. Because africa is the last to have to setup such large networks in the coming years to get the next billion people online. A large part of work is yet to be done. african countries should just legislate ipv6 default on from the get go for all new networks. You must deploy ipv6.

This would enable africa to leap frog the "deploy ipv4 first because whatever, then we need to upgrade everything to ipv6 in 7 years but we didnt plan and now we need to impossibly replace and upgrade our infrastructure" . This would also be vastly cheaper. If ur late, ur in luck as they say.

These countries cant afford go through with everything the west and the world did in lengthy and costly migrations. Mandate ipv6 from the getgo for new networks and educate of the benefits of doing so.

Spare yourself the pain as they say

I'm currently using docker for all of my selfhosted services and I'm wondering if podman would be better adapted for IPv6 than docker is.

My goal of today was setup a very cheap and secure webserver with a decent enough quality hosting provider. So when I saw that it costs more money to use an IPv4 server on Hetzner, I had the idea to go for the cheapest IPv6 only solution.

Hetzner pricing - Use toggle to save €0.60

It's already 2024 right? What could go wrong?

- Famous last words

So after spending some time to make my home network IPv6 ready, I connected to the server.

Updating via apt, went smooth. Next is installing Cloudflare Tunnel to have a secure setup later on. The installation procedure of Cloudflare Tunnel involves installing a .deb file from their Github, which failed because Github doesn't support ipv6 (WTF?).

So I downloaded the file manually, uploaded it to my server over scp and installed it from there. Then, just running the Cloudflare tunnel already brought up the ipv6 issue again, so I found this topic to bypass that. Notice it's been open since 2022 and not fixed because I get the same error. Luckily a fix was presented there so I could move on.

Next I installed Portainer, which worked. Then I continued to use the interface of Portainer and noticed that it could not connect to the repo of templates:

Github plis

Again, a Github issue.

So with this recurring issue, I can predict that hosting a Wordpress instance would cause (a ton of) similar issues along the line because many plugins use external calls towards Github and other websites (which might not support IPv6). So even if I continue the struggle, it would probably end in even more struggle.

I wanted this to work, not to save money but as a hobby project, but can only conclude IPv6 is still not useable.

If someone knows a way to fix those kind of issues, please do let me know. But for the rest, thanks for reading this spontaneous rant!

Some years ago I opened my router settings, clicked "IPv6 = yes" and it just worked on the residential fiber internet connection at my house. Since then I started learning more about how it all actually works, and determined that I was getting a /64 from the ISP using DHCPv6 with prefix delegation.

On a whim, I started messing with the settings and realized that if I requested a different prefix, they would happily give it to me. All the way up to /48, which I turned on today.

I verified that I'm actually getting the /48 since the third hextet on all my device IPs is now ":0:" and I know that, if I so choose, I could break my network into 65,536 segments and have a blast. I'm not going to do that, though. I have no intention of ever doing that. I was perfectly okay with a /64, which is why I feel... guilty?... about having the /48 now.

So, in the interest of being a good citizen and using this stuff the way it was intended to be used, if both /64 and /48 both work (and presumably everything in between the two also works) what should my house network be using?

I asked my ISP (Open Infra Sweden) if they will provide IPv6 in the future, and after a week or so, they told me that it is activated and should work after CPE equipment restart. My IPv4 is assigned via DHCP, and when I set my router to enable IPv6, I get one /128 Iv6 address. But no connection possible. Same when I remove the router and connect a client directly. IPv4 yes, but IPv6 is not working, no default gateway.

Can this work? Or do I need more information from them? Like prefix size etc.?

I am curious what back-end service is used to run v4-frontend.netiter.com instead of sending traffic half way across the world. Since I already have a VPS with Apache web server for my domains I thought I could make it work but it never worked and I was getting SSL cert mismatch and other errors. If anyone knows what the background service is let me know.

Why isn't there a mode where you could just have multiple recipients listed in a single header and the routers would strip/zero out destinations as they do or do not apply to the link? Rather than having multicast addresses, just have a multiple to-list?

I would think this would be useful for MMORPGs for sending common data for people in a common area. Or it would be useful for TV/streaming where the same live video could just have all of the viewers listed.

I don't know what keywords would get me this answer.

Alternatively, why is multicast a subscription thing that routers would need to know what the multiple choice answer should be?

Hi everyone,

I’m experiencing a challenging issue with my FortiGate firewall’s IPv6 configuration, and I’m hoping someone here can help me out.

Background:

• IPv6 Allocation: I received a statically assigned IPv6 /63 network from my ISP.

• Subnetting:

• First /64 Subnet: I assigned the first /64 to my WAN interface.

• Second /64 Subnet: I assigned the second /64 to my internal interface.

• DHCPv6 Configuration: I’m using stateful DHCPv6 on the internal interface, and it’s correctly assigning IPv6 addresses to my servers.

The Issue:

• My servers are not able to access the internet over IPv6.

• I can see the outbound traffic being allowed and exiting the firewall when monitoring the logs, but the servers are receiving 0 bytes back—no inbound traffic.

• Strangely, if I configure a NAT (specifically in the Central SNAT) using either:

• The interface IP of the WAN interface, or

• A pool that contains the same IPv6 addresses assigned by DHCPv6 to the servers,

• Then, IPv6 connectivity works—the servers can access the internet.

What I’ve Tried:

1. NDP Proxy Configuration:

• I activated nd-proxy and added both the WAN and internal interfaces as members.

• Confirmed that nd-proxy is enabled globally.

• Checked the NDP proxy entries and neighbor cache; they seem correct.

2. Interface Configuration:

• Both interfaces have the following IPv6 settings enabled:

• ip6-manage-flag enable

• ip6-other-flag enable

• ip6-send-adv enable

• Configured the complete /63 on the WAN interface, and the second /64 on the internal interface. Enabling overlap of subnets.

3. Routing and Firewall Policies:

• Verified that the IPv6 routing table includes routes for both subnets and a default route to the ISP’s gateway.

• Ensured that IPv6 firewall policies are in place to allow traffic from the internal network to the WAN interface, with NAT disabled.

4. Testing Without NAT:

• Despite the above configurations, without NAT, the servers still can’t receive inbound IPv6 traffic. If I configured the NAT and then remove it, the traffic continues to work for a while and then stops working.

• Outbound packets leave the network, but no responses are received.

5. Additional Troubleshooting:

• Confirmed with the ISP that they have the /63 directly configured on their interface with my WAN interface.

• Monitored NDP traffic using packet sniffer; I wasn't able to notice if the Neighbor Solicitations from the ISP’s router for my internal clients’ addresses aren’t being responded to.

Observations:

• It seems like the ISP’s router is not receiving NDP updates for the internal hosts, similar to missing proxy ARP in IPv4.

• When NAT is enabled, the servers use the WAN interface’s IPv6 address, which the ISP’s router knows how to reach, so return traffic works.

• Without NAT, the servers use their own IPv6 addresses from the internal /64, and the ISP’s router doesn’t know how to route return traffic to these addresses. If I configured the NAT and then remove it, the traffic continues to work for a while and then stops working.

My Question:

• Why won’t the IPv6 connectivity work without NAT?

• Is there something I’m missing in the configuration that would allow the servers to access the internet over IPv6 without relying on NAT?

Additional Details:

• FortiGate Model and Firmware: FGT-70F 7.0.15

• ISP Information:

• The ISP has confirmed that the /63 is routed to my FortiGate’s WAN interface.

• Unsure if they require any specific NDP configurations.

Any insights, suggestions, or guidance would be greatly appreciated!

Thank you in advance for your help!

[Note to Mods: If any additional information is needed, please let me know.]

Over the past year I've been working to add IPv6 to all of the existing subnets and making sure dual stack is supported throughout the network, exploring NAT64 and DNS64 options, and other basic components of enabling IPv6. I say that upfront to acknowledge that I'm very much a novice, so hopefully I don't get laughed (too hard) out of the digital room.

As I've been working with IPv6 more, one of the things that has seemed like a sticking point is that it seems like the things we typically regard as client endpoints - laptops, desktops, maybe phones - are the "easiest" candidates to be moved to be IPv6-only. Since they're almost always the device initiating a conversation, that allows NAT64 and DNS64 to facilitate communication between them as an IPv6-only participant and an IPv4-only server, whether that's within your data center or out on the internet. (Of course these endpoints can also act as IPv6-native servers for any other IPv6-only endpoints or dual-stack endpoints.)

The receiving servers in IP communication seem to be obligated to be dual-stack forever, though - you can't remove IPv4 support off of them without cutting off IPv4-only clients wanting to access those services. NAT46/DNS46 options exist, but my understanding is that you would have to bind a specific IPv4 address to a specific IPv6 address, and that severely limits scalability - we can encompass every single one of the 2^32 IPv4 addresses into a single IPv6 /96 prefix and let NAT64/DNS64 work their magic, but it doesn't seem like you can go in the reverse direction for an arbitrary IPv6 address if no explicit one-to-one stateless translation exists.

I was thinking this morning about how the latter might be accomplished - there's the rarely-used 40-byte options field in the IPv4 header that could contain an IPv6 address. My thought was that if an IPv4-only client fires off a DNS lookup and the DNS server only finds an AAAA record, it could serve back a special response containing both the AAAA record and the IPv4 address of a NAT46 router. The client would then set the NAT46 router as the destination IP on outbound traffic and include the actual AAAA address of the IPv6-only destination they actually want to reach in the options field. When the traffic shows up at the NAT46 gateway, it has some config in place to specially handle traffic to the NAT46 IP/prefix where it will pull the actual IPv6 destination out of the options field, de-encapsulate from IPv4, re-encapsulate in IPv6 with itself as source and the actual destination, and forward it, analogous to how NAT64 functions (just getting the real destination out of the options field instead of the last 32 bits of the destination on the original packet).

There are some obvious drawbacks here of additional overhead from the extra 16 bytes or more in the options field (eating precious MTU) and needing to set up network drivers/DNS for this special handling. I'm sure there are other practical issues I've not thought of. I'm mostly just curious if anything like this was ever considered as a way of allowing network operators to trudge forward migrating to IPv6 only without cutting off IPv4 clients; I've found it hard to convince sysadmins and others that enabling IPv6 (dual stack) and eventually becoming IPv6 only is important when there isn't an easily-articulated existential crisis around IPv4 and NAT seems "good enough."

Thanks!

Unfortunately the only local ISP that can provide a fast internet service via fibre is prehistoric and does not support IPv6.

I have a /48 from HE as a tunnel broker, but I cannot get my router (UniFi) to act as the endpoint - though it will pass it through to a machine that can.

How can I set up a VM on my LAN to act as the tunnel endpoint and as a gateway for all other machines on the LAN? Is there a tutorial anywhere? I tried setting up ubuntu as the endpoint and setting up radvd but didn't manage to get other machines talking via IPv6 across the internet.

Hope anyone can explain so when I use my iPhone hotspot to connect my Xbox series s to it will not use IPV6 even tho Apple says the hot spot supports IPV6 and my IP says it’s IPV6 on my data and when I run a IPv6 test it passed all tests but the Xbox will not use it can any one shine some light please. ?