I have had IPv6 off for a long time now, but it feels like now is time to actually try. I’m planning on setting the WAN side to DHCPv6
and the LAN side to Static IPv6
to match the IPv4 settings. https://docs.opnsense.org/manual/ipv6.html
(I see people say “talk to your ISP about dynamic or static and what block size” but I would rather collapse into a singularity than contact my ISP unforced, so I shan’t do that)
I’ve tried to read about IPv6 but I just don’t have enough knowledge-ground to stand on to make sense of it in an actionable way.
From what I have read and (mildly) understood, I think I know that IPv6 addresses are directly identifying; no longer does everything on the internet see the IPv4 of your router only - now things see your specific device’s IPv6 that’s a… subset? of the router’s IPv6 range (not single IP) assigned. https://superuser.com/a/1735921 People describe it as a different way to network, which I guess means no matter what I read I’m still not sure what to do.
I want IPv6 to work exactly like IPv4: router has WAN IPv4 address and masquerades for every device in the network. I don’t want Google knowing exactly which computer contacted them from inside my LAN, I want them to put in the work to finger print my device with various ways that are likely illegal in the EU.
How do I prevent that IPv6 privacy issue, or did I misunderstand how IPv6 works?
My advise it to not bother. As soon as you need device specific firewall rules the whole thing falls apart. The evangelicals dont like this fact and will down vote me for saying it.
No one needs IPv6 in their home on their devices.
Well, it IS a not very reasonable take that seems to be grounded in a certain unwillingness to deal with new and unknown yet things. How do I solve address overlap in RFC1918 and various VPNs reliably without IPv6? This starts to become a problem when I think about my self hosted music server accessed through a wireguard tunnel and I’m at a friend’s house. Not too outlandish problem for the crowd around here, I’d guess.
Use ipv6 privacy addresses and temporary addresses and you can stop thinking about it (the default on most os)
I see, I saw someone else mention “IPv6 privacy extensions”. So basically it’s up to the individual devices to handle privacy instead of the router doing it for them in IPv6 land
Yes most IPv6 devices are responsible for giving themselves addresses with SLAAC. Some networks use DHCPv6 but they should only be used where SLAAC is not possible
I’ve mentioned this elsewhere, but to fair, even without you providing Google an IPv6 address, they still know exactly which computer contacted them from inside your LAN. Even in GDPR territory they can do that.
Either use ipv6 privacy extension (enabled by default, so this can just be called ipv6) or don’t enable ipv6.
That way you have working ipv6 or wait until you come to your senses. Using nat6 ipv6 isn’t worth it.
I see people say “not worth it” but never expound on what exactly makes it not worth it?
Most I get is a vibe (using a metaphor) “python-like judging where people prefer to do it in a ‘pythonic’ way” but of course that’s silly. There must be more to it, but I never seen interoperability issues called out
NAT is not a firewall and it’s not that great for privacy either, it’s not hard to fingerprint individual devices behind NAT. There are zero cases where NAT is better than the alternatives, except when you’re out of public IP’s, which isn’t an issue with IPv6.
So you’re much better off by not trying to reinvent the wheel and using IPv6 the way it was intended. Use privacy extensions for privacy. Use proper firewall rules for security. Revel in the fact that NAT isn’t fucking up your inbound connections. Do not under any circumstances force the horrible kludge that is NAT into your IPv6 network.
I gather people talk like NAT is a rung of hell, but I guess it works because I never think of it. Maybe it becomes shittastic at multiple NATs? With one router it seems straight forward to have port forwarding.
I do not understand why I want better inbound connections - but maybe if I get hit with a cgnat then I’ll understand?
Yeah multiple NAT is a lot worse, but normal NAT has a lot of corner cases too that most people just don’t run into that often. For example if two computers behind NAT want to listen on the same port, that just doesn’t work.
NAT is a “good enough” solution that tricked a whole generation of people growing up with it into thinking it’s a good thing. While in reality the best case is that you don’t run into issues and the worst case is that performance is horrible and you can’t do the things you want to do. The only people that benefit from it are lazy ISPs, not their users.
I see now that a limitation I just understood for IPv4 (expose one port from one device only on the router) isn’t a thing for IPv6 working without NAT, every device on a LAN can be given a world wide routable address and expose the same port. Interesting, in my home I don’t think I’d ever run into that, but I can see issues like that pile up quick in big deployments.
Thanks for taking the time to explain all of this in detail!
You’re welcome, great to see how you’re taking all the comments on board!
There are more subtle problems with NAT as well. Say that PC-A opens a connection from port 1234 (to something on the internet), and PC-B opens a connection from port 1234 too. Now the router has to translate the PC-B connection to coming from port 1235 to distinguish them from each other. But if PC-C then wants to open a listening port on 1235 it won’t work because the port is already in use, even though you can’t see anything using that port!
NAT is full of ridiculous corner cases like that, which normal users aren’t very likely to notice. But once you start self-hosting things or trying to get something like older multiplayer games working the problems pile up fast if you’re unlucky.