Holy crap... It's a beast and it just felt like if you don't know what you're doing you might lose all control over your network. Ok. So a device didn't get a dhcp address? No problem... It creates it's open IP address and starts talking and try to get out on internet on its own....

Normally that's not a problem since your normal home router wouldn't route 169.254.x.x.... But it just seems like there's A LOT to think about before activating IPv6 at home. I've got a Creality K1 Max... Fun thing: factory reset also creates a new MAC Address... So there's no way in hell thay I just let her lose by activating IPv6.

Ps. Yes, I most likely panic because I haven't figured out IPv6... But until I understand IPv6 there's just going to be IPv4.

[–] [email protected] 10 points 5 months ago (1 children)

Ok. So a device didn't get a dhcp address? No problem... It creates it's open IP address and starts talking and try to get out on internet on its own....

Its not that different from a conceptual point of view. Your router is still the gate keeper.

Home router to ISP will usually use DHCPv6 to get a prefix. Sizes vary by ISP but its usually like a /64. This is done with Prefix Delegation.

Client to Home Router will use either SLACC, DHCPv6, or both.

SLACC uses ICMPv6 where the client asks for the prefix (Router Solicitation) and the router advertises the prefix (Router Advertisement) and the client picks an address in it. There is some duplication protection for clients picking the same IP, but its nothing you have to configure. Conceptually its not that different from DHCP Request/Offer. The clients cannot just get to the internet on their own.

SLACC doesn't support sending stuff like DNS servers. So DHCPv6 may still be used to get that information, but not an assigned IP.

Just DHCPv6 can also be used, but SLACC has the feature of being stateless. No leases or anything.

The only other nuance worth calling out is interfaces will pick a link local address so it can talk to the devices its directly connected to over layer 3 instead of just layer 2. This is no different than configuring 169.254.1.10/31 on one side and 169.254.1.11/31 on the other. These are not routed, its just for two connected devices to send packets to each other. This with Neighbor Discovery fills the role of ARP.

There is a whole bunch more to IPv6, but for a typical home network these analogies pretty much cover what you'd use.

[–] [email protected] 5 points 5 months ago (1 children)

SLACC doesn't support sending stuff like DNS servers.

It does

[–] [email protected] 1 points 5 months ago

Oh nice! I'll have to dig into that. Wonder if its an implementation issue across vendors. I was always under the impression that DHCPv6 was the common convention if not static.

[–] [email protected] 5 points 5 months ago (1 children)

Generally, a device cannot get an internet facing IP address unless something else on your network is advertising the prefix. In fact, I'd argue there's little point using DHCPv6 now. Some devices are only interested in SLAAC. But, if you have a router that gets an IPv6 prefix from your ISP (usually /48 or /64, but you can get other sizes) it will usually then advertise that onto your local network.

As for the IP addresses. I would say that you should definitely still have a firewall in place. But the setup is the same as IPv4 just without NAT. e.g. you set a blanket rule for your prefix to allow outbound and block unrelated inbound. Then poke holes through for specific devices and services.

By default, IPv6 implementations make an assumption that they're not going to be a server (if you want a device to be a server, you can just set a static IP) and their "main" IP will be a random looking one (and the configuration will depend on whether it uses an interface identifier to create the address, or if it is random) within your (usually huge) allocation. But more than that, they will usually be configured to use the IPv6 privacy extensions (RFC4941). This generates extra temporary addresses per device, which are used for outbound connections and do not accept incoming connections. That is, people cannot see your IP address on their host from your connection and then port scan you, since no ports will respond. You could still have ports open on your "real" IP address. But, that one isn't ordinarily used for outgoing connections, so no-one will know it exists. To discover it they would need to scan your whole prefix (remember that the /64 allocation you will generally get is the internet * the internet in terms of address space, that is much harder to brute force scan).

I think the differences between IPv4 and IPv6 might seem scary, but most of them are actually improvements on what we had before, making use of the larger pools we have available. Once you work it out, it's really not so bad.

I would like to see routers setup to firewall ipv6 by default to give the same protection as NAT though, meaning users need to poke holes into the firewall for incoming connections. Maybe some do. I know mine did not and it was one of the first things I did.

[–] [email protected] 1 points 5 months ago

Didn't know about the outbound traffic thing, that's really cool.

[–] [email protected] 1 points 5 months ago

Those are just the same networking concepts as v4. Just 128 bits instead of 32. The hard thing can be ULA or SLAAC, which are like "yeah, just some random address to not get conflicts" and "yeah, first half your ISP gives you, second is taken from MAC address".

We even get rid of a bunch loaded crap that holepunching v4 and making it work developed through years.

Maybe it seems hard, because what was used before was not really learned how it works but just relied on hacks.