Is IPv6 important at home? - Page 1
Forum section: electronics / general

author: Zucca
author_rank: Unknown
timestamp: November 21, 2019, 03:03:31 pm
content: With my new ISP Modem, I finally got an IPv6/64 address.Unfortunately that modem with IPv6 do not play well with my pfSense and my Home VPN Server do not work anymore.I can easily go back to IPv4 but once it is done my ISP do not let me revert to IPv6 ().I am pondering what to do:1) Following the rabbit IPv6 hole and try to understand what is going on: learning experience for sure.2) Bugger off the IPv6 jazz and 5 minute later have a working PfSense system as before.I need a strategic decision: do you think an IPv6 is so important in 2019? Should I spend my time to get an IPv6 System up and running?I mean, I was using an IPv4 until yesterday with no problem.

author: borjam
author_rank: Unknown
timestamp: November 21, 2019, 03:17:57 pm
content: Not yet, but it mostly depends on your ISP.That said, if you have IPv6 at home (I do) you will notice that many big services (Google, Netflix to name a few) prefer to serve over IPv6. There is no shortage of IPv6 addresses, which makes their life much easier.Even EEVBlog is accessed over IPv6 if you have it, because its anti DDoS provider (Cloudflare) uses it.IPv6 is most important for the deployment of large new services. And in case a new Google appeared your access may be impaired if you were using IPv4 due to increased complexity (address translation, etc).On the other hand, IPv6 comes with its own security issues. Old NAT allows you to be very sloppy when setting up your network. Not that it's a good thing but it's a fact.pfSense should work with IPv6. What's the problem?

author: NivagSwerdna
author_rank: Super Contributor
timestamp: November 21, 2019, 03:20:54 pm
content: Quote from: zucca on November 21, 2019, 03:03:31 pmNo

author: madires
author_rank: Super Contributor
timestamp: November 21, 2019, 04:24:15 pm
content: Quote from: zucca on November 21, 2019, 03:03:31 pmYes, IPv6 is important. There will more and more servers/services only reachable by IPv6 because of the lack of IPv4 addresses.Back to your problem. For dual stack access most ISPs provide an IPv4 address (via PPP), an IPv6 /64 transfer network (via DHCPv6) and an IPv6 prefix for your LAN (Prefix Delegation via DHCPv6). Some ISPs use the change to dual stack for rolling out DS-lite or CGNAT for IPv4. So the first step is to figure out what your ISP actually supports.

author: Zucca
author_rank: Unknown
timestamp: November 21, 2019, 04:41:33 pm
content: I have Vodaphone Kabel-Deutschland.They support DS-lite (which is a poor solution in my eyes) and that stupid modem won't let me use my VPN in Pfsense anymore.If I go with a Bridge modem, the IPv6 will not be supported and I go back to IPv4 forever.Here the Details since you are German:https://forum.vodafone.de/t5/Internet-Ger%C3%A4te/Ich-m%C3%B6chte-IPV6-im-mein-Netz-aktivieren-haben/td-p/1870091Real Dual Stack is offered only for business customer as I unterstood.What about a ipv4 system with a pfsense tunnel to IPV6?

author: mk_
author_rank: Regular Contributor
timestamp: November 21, 2019, 04:45:52 pm
content: Quote from: zucca on November 21, 2019, 03:03:31 pmregardless of IP4 or IP6 - I would change provider as soon as possible...

author: Zucca
author_rank: Unknown
timestamp: November 21, 2019, 04:46:09 pm
content: Quote from: borjam on November 21, 2019, 03:17:57 pmGive me some time I need to draw a picture so you will understand.

author: Zucca
author_rank: Unknown
timestamp: November 21, 2019, 04:47:36 pm
content: Quote from: mk_ on November 21, 2019, 04:45:52 pmIt is unfortunately the only one which go to 400MB all the others are VDSL max 100MB.

author: madires
author_rank: Super Contributor
timestamp: November 21, 2019, 05:13:01 pm
content: Quote from: zucca on November 21, 2019, 04:41:33 pmThe VPN would work via IPv6.Quote from: zucca on November 21, 2019, 04:41:33 pmThat shouldn't be any problem. IIRC, HEnet still offers a free 6in4 service.

author: james_s
author_rank: Super Contributor
timestamp: November 21, 2019, 05:19:06 pm
content: The proliferation of NAT has made IPV6 unnecessary in most cases. The days of giving every device on the entire internet a unique IP address are long over, you'd be crazy to put all your stuff directly out there accessible to anybody, you need some kind of firewall anyway, might as well just use NAT and only forward the ports needed.

author: Mr. Scram
author_rank: Super Contributor
timestamp: November 21, 2019, 05:20:06 pm
content: Quote from: borjam on November 21, 2019, 03:17:57 pmThe impact of IPv6 on NAT and the security of your network is important to understand.

author: madires
author_rank: Super Contributor
timestamp: November 21, 2019, 05:49:08 pm
content: Quote from: james_s on November 21, 2019, 05:19:06 pmSorry, but NAT isn't a security feature:-https://blog.webernetz.net/why-nat-has-nothing-to-do-with-security/-https://www.f5.com/services/resources/white-papers/the-myth-of-network-address-translation-as-securityYour CPE or SOHO router includes a firewall anyway. The basic setup of the firewall is to allow everything out and nothing in, besides traffic for established connections. When your CPE supports IPv6 it does the same for IPv6.You need IPv6. If I would add 10k servers to my data center I wouldn't get 10k IPv4 addresses, because there are almost none available from the RIRs. And NAT wouldn't be able to solve that.

author: james_s
author_rank: Super Contributor
timestamp: November 21, 2019, 07:14:53 pm
content: Keep in mind this thread is about *home* networks, not a company that has an IT department and people whose job it is to set this stuff up. The average home user is just going to buy a device, plug it into their network and call it done. NAT on its own is not going to provide a lot of security but it does isolate all the stuff they plug in internally from the outside world and all of the home routers that provide NAT also have a firewall.Either way I don't see IPv4 and NAT going away any time soon. All the hacks and workarounds to make it work are already in place, there is little incentive for most people to change it.

author: Zucca
author_rank: Unknown
timestamp: November 21, 2019, 09:20:29 pm
content: Quote from: borjam on November 21, 2019, 03:17:57 pmHere my working (but no VPN) IPv4 Network with the new modem:and here what I am trying to deal with (sorry for the German):my questions are:1) What is the right IPv6 cinfiguration for the WAN PfSense and the LAN Pfsense, those are my choices:2) Do I have to set up a Gateway  IPv6 in PfSense?I should have post this in the pfSense forum, if you can help you are a Legend.

author: borjam
author_rank: Unknown
timestamp: November 21, 2019, 10:43:15 pm
content: Quote from: madires on November 21, 2019, 05:49:08 pmOf course not. It’s a horrible kludge. But as a side effect it has prevented lots of incidents and it offers some privacy advantages compared to IPv6.Sorry in Spanish (and I had very little time to write it, so not exactly a good read)https://www.esnog.net/gore19/gore19-files/DireccionesEfimerasIPv6.pdf

author: madires
author_rank: Super Contributor
timestamp: November 22, 2019, 12:29:49 pm
content: Regarding DS lite and IPv4 some source says that Vodafone / Kabel Deutschland will roll out PCP (https://en.wikipedia.org/wiki/Port_Control_Protocol) next year 'til summer. PCP allows you to request a port forwarding by the CGN box.

author: gmb42
author_rank: Frequent Contributor
timestamp: November 22, 2019, 01:34:19 pm
content: I don't know pfSense, but in general useSLAAC.The modem should be sending out IPv6 Router advertisements that will contain your ISP assigned IPv6 prefix and the gateway IP which will allow pfSense to configure the WAN interface.

author: Berni
author_rank: Super Contributor
timestamp: November 22, 2019, 02:14:13 pm
content: I don't have IPv6 yet but i am interested in seeing what this is all about so that i will be ready.So if i understand correctly the ISP will only assign you the first part of your IP, allowing you to use all IPs within that IP range. The router will then DHCP assign these IPs to all the devices inside your LAN. No complex TCP/IP routeing will be needed by the router because packets will come from the internet destined at the devices IP.Then firewall has to specifically be set up so that it doesn't just let any packet from the internet into the LAN onto those internal IPs, but allow all traffic between these IPs inside the LAN. Otherwise you could end up in a situation similar to plugging your PC directly into a modem without routeing and exposing all of your ports to the entire internet.Did i get it right?

author: borjam
author_rank: Unknown
timestamp: November 22, 2019, 04:19:46 pm
content: Quote from: Berni on November 22, 2019, 02:14:13 pmYes. It's more complicated than IPv4 because there are some rules. A local area network should have a /64 prefix assigned so that the IPv6 address assignment mechanisms (for example, SLAAC based on the MAC address) work. If you want to create more networks you should request more /64 segments. Some corporate ISPs assign, for example, /48 prefixes which you can split into /64's in order to use them for several nets.Indeed, there is no need for NAT. Every device in your network can have its own IP address. Even everyservicein your network can have its own IPv6 address.QuoteYes and no. Filtering incoming connections is going to be very important of course. Also, the failure mode is different from the IPv4 NAT router. In IPv4 with NAT a misconfigured router is more likely to prevent any incoming connection. So your crappy webcam, baby monitor, etc, will be "safe" from the Internet.With IPv6, a misconfigured router with no filtering might leave everything open.On the other hand, the IPv6 address space is so huge there are no address scans. I have been monitoring my line for two years (a whole /48) and I haven't seen any scans yet.However, remember that when you visit a website (which could be a malicious website, for example, linked from a spam email message) you are making your IPv6 address known and you might receive a port scan.I like to make a warfare analogy to compare IPv4 and IPv6. If IPv4 is like land warfare, in which your position is likely known and you rely on trenches, armor, etc, IPv6 is more like war at sea. You can hide in such a vast place and you can be really difficult to find. However, you can reveal your position by transmitting a radio signal.As it happens in naval warfare, with IPv6 you can do the equivalent of scattering your ships, though. Imagine that your computer has some file sharing application to use at home and, at the same time, you are browsing the web. You can use randomly generated throw-away IPv6 addresses for web browsing,while your file sharing service listens on a different address. If properly generated (ie, not guessable)andyour service doesn't listen on the temporary addresses, it won't be feasible to find your file sharing service doing an address scan, so for all practical purposes it will be reasonably secure without a firewall.The throw away addresses for outgoing connections are already standard behavior, but in my article linked some posts ago I propose to tweak that mechanism so that those temporary addresses are not available for sockets listening on INADDR6_ANY.

author: rrinker
author_rank: Super Contributor
timestamp: November 22, 2019, 08:09:07 pm
content: Quote from: james_s on November 21, 2019, 05:19:06 pmWhile true, back in the early days there were far too many class A blocks given out, and if you think companies that have had a class A block since the earliest days are willing to give them up....I STILL run in to people who do things like use a publicly routable subnet as their internal network (not a block they own, either), or use an internal DNS domain name they do not own and then wonder why they can't buy SSL certificates to secure it...

author: madires
author_rank: Super Contributor
timestamp: November 22, 2019, 08:46:38 pm
content: Neither can you get an SSL cert for private addresses (RFC1918 and RFC4193).

author: Zucca
author_rank: Unknown
timestamp: November 24, 2019, 06:39:15 pm
content: Ok I give up...I set the modem in bridge mode and got IPV4 only as expected.VPN works and everything is back to normal.Lesson learned: as long the ISP does not provide an IPV6 WITH a modem in bridge mode... run forrest run.A modem not in bridge mode or with no DMZ option is just a pain in the ass with Pfsense.

author: borjam
author_rank: Unknown
timestamp: November 26, 2019, 01:55:12 pm
content: Meanwhile, in Europehttps://www.ripe.net/publications/news/about-ripe-ncc-and-ripe/the-ripe-ncc-has-run-out-of-ipv4-addresses

author: SilverSolder
author_rank: Super Contributor
timestamp: November 26, 2019, 02:43:03 pm
content: Keeping things simple and reliable is always the best long term solution...

author: madires
author_rank: Super Contributor
timestamp: November 26, 2019, 03:32:06 pm
content: IPv6 comes with new concepts and some users might be afraid of the changes, but IPv6 is a necessity and will stay for quite a while. The big problem with deploying IPv6 is that a lot of ISPs, companies and users are holding on IPv4 and delaying things, despite they had more than enough time (two decades) to get used to it. Now we are running out of IPv4 address space and soon all those mentioned will be forced to deploy IPv6 in a hurry. What could possibly go wrong?Same story for CPE manufacturers. Only a few sell CPEs with proper IPv6 support. A lot of CPEs come with half-baked IPv6. BTW, OpenWrt does IPv6 quite well (some minor quirks with PD).

author: SilverSolder
author_rank: Super Contributor
timestamp: November 26, 2019, 04:08:05 pm
content: Why not just run IPv6 on the Internet facing side of the router, and keep the NATed IPv4 on the "inside"?You think surveillance capitalism is bad now, imagine what it will be like when every device/user is easily uniquely identifiable...

author: madires
author_rank: Super Contributor
timestamp: November 26, 2019, 06:17:04 pm
content: If you worry about the MAC based interface part of an IPv6 address assigned via SLAAC simply enable PE (Privacy Extensions) and tweak the livetimes. But with cookies, super-cookies, browser fingerprinting and so on hiding IP addresses is only a drop in the bucket. If you really wish to hide internal IPv6 addresses there's NAT66.

author: Zucca
author_rank: Unknown
timestamp: November 26, 2019, 08:54:14 pm
content: I agree.ISP should support full IPv6+IPv4 dual stack in 2019, unfortunately it is not the case.

author: TomS_
author_rank: Frequent Contributor
timestamp: April 16, 2020, 09:43:22 am
content: Quote from: Zucca on November 21, 2019, 04:41:33 pmThis might be more of an ISP policy than anything else.Plenty of ISPs offer native dual stack to residential customers, you may just need to search around a little to find them. Probably they will be smaller or less "mainstream" ISPs.