My ISP recently enabled ipv6 and I thought to myself this would be a good opportunity to roll out ipv6 on my LAN.

Unfortunately, I only get a dynamic prefix so I never know the addresses / the subnet of my devices. This makes life difficult for me, I need to configure proxy ACLs and other stuff using this information.

I am unable to use the link-local subnet because I can't make DNS entries for these. Using ULAs does not seem to be a good idea as per Jeremy Visser and from various documents on v6, seems to be frowned upon because it is "ipv4-like thinking".

How to handle this situation? Would it be feasible to assign a ULA prefix in addition to the ISP-assigned prefix? Or is there some other solution I am not aware of?

My ISP-mandated router is a "Fritz! Box 6320 v2 Cable", and I can hardly change any of the settings there, it's all overridden by ISP-provided settings (TR069 probably). Eventually I would like to stick a Linux box with iptables between my LAN and the Fritz! Box that could act as a DHCPv6 or something.

To clarify, I don't intend to offer any services to the outside world. This is about the LAN only.

migrated from networkengineering.stackexchange.com Apr 14 '14 at 15:37

This question came from our site for network engineers.

  • Could you be more specific in what exactly it is you're asking? As it is now, this question is too broad. – Teun Vink Apr 14 '14 at 6:54
  • I've added a more direct question – Aljoscha Vollmerhaus Apr 14 '14 at 10:11

Yes, you can do this with Unique Local Addresses.

Keep in mind that:

  1. The ULA addresses are only valid within your network; past the FritzBox (which will configure and provide them) they are not valid and cannot be used.
  2. To and from the public Internet, your public addresses must be used, whatever they happen to be.
  3. The FritzBox may need a firmware upgrade to support ULAs properly.

However, if you can't configure the FritzBox then there may be nothing much to do.

Also, what Sander Steffann said about asking your ISP to not provide a dynamic prefix. This is the easiest solution.

  • From what I read here jeremy.visser.name/2009/06/… ULAs might be causing Problems because current OSs tend to use them as source addresses when talking to the Internet, is that true? – Aljoscha Vollmerhaus Apr 17 '14 at 14:36
  • In order for that to happen, the computer would have to receive a default route that uses the ULA, and this won't happen with a properly functioning router. – Michael Hampton Apr 17 '14 at 17:16
  • Thanks, I think I'll try a multi-prefix setup, one dynamic from my ISP and one static ULA prefix. – Aljoscha Vollmerhaus Apr 18 '14 at 14:17
  • Concerning the settings, I'll stick a Linux or BSD VM in between my LAN and the Fritzbox. It supports prefix delegation. – Aljoscha Vollmerhaus Apr 18 '14 at 14:26

Dynamic IPv6 prefixes are indeed annoying. Germany is the only country where I have seen mass deployment of dynamic prefixes. The best thing to do is to push the ISP and try to get a stable prefix. Until then all you can do is use autoconfiguration and find a dynamic DNS provider that supports IPv6.

  • 1
    My ISP is the german provider Unitymedia. While I agree with you that they should change their minds regarding static vs. dynamic prefixes, I don't think it will happen, regardless whether I complain or not. DynDNS would only solve the DNS problem, I still couldn't write subnet-based proxy ACLs or firewall rules. – Aljoscha Vollmerhaus Apr 14 '14 at 10:11
  • 1
    True. And at least complain to them. If there are enough people complaining maybe they will start thinking... – Sander Steffann Apr 15 '14 at 15:05

Currently ISPs in all different countries are slowly starting with the IPv6 deployment.

The reason why your link-local doesn't work is because link-local is, as it already says, only used for your local network (LAN).

Can I ask what kind of router you use? And if you want to add Firewall etc; are you using a server?

  • I've added the answers to the original question – Aljoscha Vollmerhaus Apr 14 '14 at 13:52
  • Also, there seems to be a misunderstanding - this only relates to my LAN, I want to offer services like proxy, FTP and more, but only to local clients. I've edited my question accordingly. – Aljoscha Vollmerhaus Apr 14 '14 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.