4

My ISP recently enabled ipv6 and I thought to myself this would be a good opportunity to roll out ipv6 on my LAN.

Unfortunately, I only get a dynamic prefix so I never know the addresses / the subnet of my devices. This makes life difficult for me, I need to configure proxy ACLs and other stuff using this information.

I am unable to use the link-local subnet because I can't make DNS entries for these. Using ULAs does not seem to be a good idea as per Jeremy Visser and from various documents on v6, seems to be frowned upon because it is "ipv4-like thinking".

How to handle this situation? Would it be feasible to assign a ULA prefix in addition to the ISP-assigned prefix? Or is there some other solution I am not aware of?

My ISP-mandated router is a "Fritz! Box 6320 v2 Cable", and I can hardly change any of the settings there, it's all overridden by ISP-provided settings (TR069 probably). Eventually I would like to stick a Linux box with iptables between my LAN and the Fritz! Box that could act as a DHCPv6 or something.

To clarify, I don't intend to offer any services to the outside world. This is about the LAN only.

2
  • Could you be more specific in what exactly it is you're asking? As it is now, this question is too broad.
    – Teun Vink
    Apr 14, 2014 at 6:54
  • I've added a more direct question
    – Aljoscha Vollmerhaus
    Apr 14, 2014 at 10:11

3 Answers 3

0

Yes, you can do this with Unique Local Addresses.

Keep in mind that:

  1. The ULA addresses are only valid within your network; past the FritzBox (which will configure and provide them) they are not valid and cannot be used.
  2. To and from the public Internet, your public addresses must be used, whatever they happen to be.
  3. The FritzBox may need a firmware upgrade to support ULAs properly.

However, if you can't configure the FritzBox then there may be nothing much to do.

Also, what Sander Steffann said about asking your ISP to not provide a dynamic prefix. This is the easiest solution.

4
  • From what I read here jeremy.visser.name/2009/06/… ULAs might be causing Problems because current OSs tend to use them as source addresses when talking to the Internet, is that true? Apr 17, 2014 at 14:36
  • In order for that to happen, the computer would have to receive a default route that uses the ULA, and this won't happen with a properly functioning router. Apr 17, 2014 at 17:16
  • Thanks, I think I'll try a multi-prefix setup, one dynamic from my ISP and one static ULA prefix. Apr 18, 2014 at 14:17
  • Concerning the settings, I'll stick a Linux or BSD VM in between my LAN and the Fritzbox. It supports prefix delegation. Apr 18, 2014 at 14:26
3

Dynamic IPv6 prefixes are indeed annoying. Germany is the only country where I have seen mass deployment of dynamic prefixes. The best thing to do is to push the ISP and try to get a stable prefix. Until then all you can do is use autoconfiguration and find a dynamic DNS provider that supports IPv6.

2
  • 1
    My ISP is the german provider Unitymedia. While I agree with you that they should change their minds regarding static vs. dynamic prefixes, I don't think it will happen, regardless whether I complain or not. DynDNS would only solve the DNS problem, I still couldn't write subnet-based proxy ACLs or firewall rules.
    – Aljoscha Vollmerhaus
    Apr 14, 2014 at 10:11
  • 1
    True. And at least complain to them. If there are enough people complaining maybe they will start thinking... Apr 15, 2014 at 15:05
0

Currently ISPs in all different countries are slowly starting with the IPv6 deployment.

The reason why your link-local doesn't work is because link-local is, as it already says, only used for your local network (LAN).

Can I ask what kind of router you use? And if you want to add Firewall etc; are you using a server?

2
  • I've added the answers to the original question
    – Aljoscha Vollmerhaus
    Apr 14, 2014 at 13:52
  • Also, there seems to be a misunderstanding - this only relates to my LAN, I want to offer services like proxy, FTP and more, but only to local clients. I've edited my question accordingly. Apr 14, 2014 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .