• 0 Posts
  • 20 Comments
Joined 2 years ago
cake
Cake day: June 12th, 2024

help-circle



  • The reason IPv6 was originally added to the DOCSIS specs, over 20 years ago, is because Comcast literally exhausted all RFC1918 addresses on their modem management networks.

    My favourite feature of IPv6 is networks, and hosts therein, can have multiple prefixes and addresses as a core function. I use it to expose local functions on only ULA addresses, but provide locked down public access when and where needed. Access separation is handled at the IP stack, with IPv4 it’s expected to be handled by a firewall or equivalent.
















  • Configuring multiple v4 addresses on an interface is a kludge, typically only used on hosts which apply inter-network routing logic. It’s an explicit, primary function of the standard v6 specifications.

    With v4, you would use either RFC1918 and NAT, or plumb a public address to the host.

    With v6 you should use a ULA and an address with a public prefix, and selectively open ports/services to on appropriate address.

    An example is the file sharing and administration daemons on my NAS are only bound to its ULA. I don’t need to worry whether it will accidentally be exposed publicly through fat fingering my firewall config, because it will never route beyond my gateway.


  • I use ULA prefixes to ensure the management interfaces of my devices don’t leak via public routes.

    It’s one of the unique parts of the standard IPv6 stack not back ported to IPv4, that an interface on any host can be configured with multiple addresses. It permits functional isolation with the default routing logic.

    IPv6 is far from perfect, but the majority of the arguments I’ve seen against deploying it are a mixture of laziness, wilful ignorance, and terminal incuriosity.