6

I'm finally embarking on the voyage that is IPv6. I am not sure however, on the best way of assigning a unique local address (ULA) to each host in my LAN.

For IPv4 I prefer to have a DHCP server with all the mappings between MAC addresses and fixed IPs, as most OSes default to DHCP so it means there is less configuration this way. I also have a small dynamic pool for guests.

So I am wondering whether I should be running a DHCPv6 server to mimic this behaviour, or whether I can somehow make use of stateless IPv6 configuration instead.

Since my router advertises my global prefix and clients pick it up automatically, is it possible to have a second router (my network switch) also advertise a ULA prefix, so that clients can set themselves up with two IPs automatically? This would let them have a global and a ULA address and I wouldn't need to run a dedicated DHCPv6 server somewhere, or bother with NAT.

I'd also like to run the ULA prefix advertisement on a different device if possible (rather than the existing DSL modem) so that if the modem ever gets taken offline it won't disrupt local network traffic. Or ideally, I'd get both the modem and the switch to advertise the same ULA prefix so either one can go away or be replaced without disrupting the network.

Is this the way ULA addresses are supposed to be allocated? Or are you supposed to choose between DHCPv6 and static allocation, or some other method I haven't learned about yet?

Some background, if you need it:

I have received a global prefix from my ISP (via 6rd) and I've set that up on my router so each PC on the LAN now has a global IPv6 address. This works fine, but if I want to SSH to another machine I have to look up its IPv6 address somehow as the prefix I receive from my ISP changes regularly.

To avoid this, I want to assign each host a ULA address, so that I can put these in local DNS and just use hostnames from that point on. I am not planning to use any form of NAT as each machine already has a global IP, this is just for direct access between machines in the LAN.

(As an aside, link-local addresses are impractical for this as the network interface must be specified every time you use the address. Even if I were to put a link-local address in DNS, I'd still have to figure out what the name of the network interface is called on each machine and specify it every time I tried to make an outgoing connection, even via hostname, which ULA should avoid.)

I am also aware that with stateless IPv6 config it would mean the final IP includes the machine's MAC address, so I'd have to update DNS if the NIC ever changes, but if I was using DHCP instead I'd still have to update the DHCP config with the new MAC anyway, so I don't think this is any more or less effort.

  • What is your router model, and why isn't your ISP giving your business a static IPv6 delegation? ISPs usually do that for businesses, but not for residential customers, who could get a static delegation via 6rd from one of the tunnel brokers for free. – Ron Maupin Mar 18 '17 at 3:41
  • Static IPv6 delegations still change when you move service providers so I don't want to rely on that for my internal infrastructure. Seems IPv6 is all about multi-homed hosts so there's no problem having extra IPs. Various router models (still experimenting) but not after instructions, more interested in it from a network design perspective. – Malvineous Mar 18 '17 at 5:02
  • You can get provider-independent IPv6 addressing from your RIR, basically, just for asking. Every company qualifies for a /48 network, and it is not hard to justify a smaller prefix (more networks). You would not be dependent on your ISP for your network prefix, and you can take it with you to other ISPs. – Ron Maupin Mar 18 '17 at 5:05
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 17 '17 at 5:06
  • @RonMaupin: There were no other answers so the only option is to accept my own answer, however when I originally tried to I was told I could not do this and I had to wait for another day. There was no reminder a day later, by which time I had forgotten. Might I suggest that when you reply to your own question, you should be allowed to accept your own answer immediately, if the question has been open for more than a day or two? – Malvineous Aug 17 '17 at 7:09
5

After experimenting with this, I have made a few discoveries that end up dictating which path to choose.

Multiple subnet advertisements means multiple IPs in the same subnet

If you have multiple routers advertising the same prefix, you don't end up with redundancy, you end up with multiple IP addresses in the same prefix/subnet. This is like assigning yourself both 192.168.0.1 and 192.168.0.2 on the same NIC. It works, but it causes problems.

For example I was running a DNS server on one of these machines, and when clients were querying it through the primary IP, it was responding on the second one. Clients were ignoring this response assuming someone was trying to spoof them, instead waiting for a reply on the same IP they sent the query to, so DNS completely broke.

Static IPs and router advertisements don't mix (for the same prefix)

You might think, as I did, that assigning a static IP in the same subnet would prevent an automatic IP assignment from the same prefix. After all, in IPv4 if you have a static IP address, DHCP doesn't give you another one.

This is wrong. You get the static IP address alright, but you also get a second one in the same subnet/prefix thanks to the advertisement from the router.

The end result is two IPs in the same subnet, leading to the same problem as above.

Advertise a different prefix

In the end the only solution that works is this one. It requires letting go of a few IPv4 ideas though.

My goal was to mimic my IPv4 setup with IPv6. That is, assign a few machines fixed addresses, and have the rest dynamic, while having everything as robust as possible. And hopefully not having to run a DHCP server anymore.

By having a router advertise a ULA prefix, all hosts will self-assign their addresses, just like with DHCP. But you can't have multiple routers advertising that prefix. Maybe in some fancier setup you could have a backup router take over if it notices that the primary one has stopped advertising, but this isn't possible at present.

However, you don't have to be tied to placing fixed and dynamic IPs in the same subnet with IPv6. ULA addresses have the facility to specify a subnet (up to 65536 of them), so I ended up using that so that the /48 ULA prefix had two /64 subnets in it. The router advertises one for stateless config (equivalent to DHCP) while the other is not advertised anywhere and used for static IPs configured on each host. You can even use a third ULA subnet for a backup router in case the primary one stops advertising its ULA, just to be sure that your hosts always have a site-wide routable address, even when no global IPs are available.

Thanks to the magic of IPv6 there is no need to set up any routing rules when this all happens within the same LAN segment. Everyone gets a dynamic address, and the machines with fixed addresses get a static IP as well, but as they are in different /64 subnets, there is little confusion.

The only issue is that those hosts with fixed IPs should always used the fixed IPs to talk to each other. If a connection is made to the dynamic IP from a host who has lost its dynamic IP, it will make the connection out from the remaining static IP instead - which means the multi-homed server will reply back using its own static IP and you'll again have the mismatch.

But as long as hosts with static IPs always use the static subnet to talk to each other then there is never a problem. Multi-homed hosts can of course talk to those in the dynamic subnet without any problem as well.

  • What pseudo-random algorithm did you use to assign the 40 bits of the ULA Global IDs? Does it meet the requirements of RFC 4193? – Ron Maupin Mar 20 '17 at 12:51
  • @RonMaupin If you're curious about how to generate random bytes: personally i used CryptGenRandom – Ian Boyd Dec 21 '18 at 20:14
  • @IanBoyd, I'm not curious about that, I was curious about what the OP used for the ULA in the answer. – Ron Maupin Dec 21 '18 at 20:17
  • I ignored the RFC and picked something short. It's only a test network so not important that it be interoperable with other networks. If it ever becomes production then I'll pick a proper ULA prefix but for the moment, even a year after posting, it's still too problematic to be relied upon for production work. – Malvineous Dec 23 '18 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.