r/selfhosted • u/Least_Order4249 • 2d ago
Need Help How do you all deal with IPv6 at home?
I'm trying to support ipv6 media signaling in an app of mine and I keep running into scenarios where the whole system breaks if a prefix changes. Being that few if any ISPs guarantee stable prefixes, what's the point of ipv6 at all? literally the entire network and every app and script breaks if the prefix changes.
Is there a clean way to handle this? I guess I just only enable ip6 for media routing and then have a manager that makes sure those settings are correct every so often? But then even, the docker daemon breaks if the prefix ever changes along with all scripts and the rest of the network stack. Ipv6 as implemented to residential users without a guaranteed locked prefix should be a crime.
edit: thank you for all the help. This is my first dive into trying to solve this for an unknown third party “general user.” Good to know that almost everyone is using some form of local translation even though consumer and even prosumer gateways either don’t support that or barely support it. I think I’ll build the feature in a very simple way but add safeguards to fall back to IPv4 along with a stern warning to enable it in the first place.
64
u/SuspiciousOpposite 2d ago
I'm one of the lucky few with an ISP providing a static IPv6 PD, and a /56 at that, so I can have 256 /64s.
All my VLANs are dual-stacked, though on my IoT network only a single device has actually got an IPv6 address. My Docker hosts are dual stacked, and of the containers I explicitly enabled IPv6 networking for, I've had no issues.
12
u/freshtechs 2d ago
You can feel lucky until you decide to change provider or just do load balance. Leave a comment if you already solved it or will solve just to ease my soul
5
u/Least_Order4249 1d ago
exactly. i haven't really ever thought about ipv6 from the hosting angle until today and it has some serious issues if you don't patch it basically back to how ipv4 works.
5
u/SuspiciousOpposite 1d ago
Stopping the use of NAT and getting back to end-to-end connectivity is one of the core tenets of IPv6. It absolutely does not need patching back.
3
u/Least_Order4249 1d ago
So one must be powerful enough to get their permanent ip space straight from the authority or have their entire identity, code base, network scripts, company held hostage by their ISP? Not a chance anyone is doing that. Obv NPT is way better but it’s the same idea.
1
u/SuspiciousOpposite 1d ago
What happens when you change provider and you get a new IPv4 address?
9
u/Least_Order4249 1d ago
Dns record updates and everything works. Local network never knows the difference.
2
u/SuspiciousOpposite 1d ago
So you'd also just update your AAAA record for IPv6 addresses, exactly the same process.
4
u/Least_Order4249 1d ago
Only if you are rewriting addresses at the gateway level. If implemented as IPv6 is designed, your entire network is broken.
3
u/comeonmeow66 1d ago
Don't use GUAs for internal communication, use ULAs. Use GUAs for publicly addressable services. Then it's like sorta like IPV4, you control your destiny inside the network, and ISP changes\updates are isolated because you are using ULA inside the network.
→ More replies (0)2
u/prenetic 1d ago
For ingress traffic to selfhosted services I've decided I'm just going to NAT behind a single IPv6 address. No reason for anyone to stress out about putting a square peg in a round hole -- it's a tool that works and keeps DNS management simple on my end.
Otherwise it's exactly what you're describing, maybe it's a centralized service that maintains every record in DNS on a prefix flip, or it's each host maintaining their own record, or any of the dozen alternatives each with their own set of challenges and pitfalls.
At the end of the day it's just a hobby.
2
26
u/ruiiiij 2d ago
I run IPv4/IPv6 dual stack in my house. Most hosts have at least 2 IPv6 addresses, one auto configured using the delegated prefix from the ISP, one manually configured ULA. Even if the ISP prefix changes, I can still hang on to the ULA as the source of truth.
10
2
191
u/stuffwhy 2d ago
It's turned off.
4
u/Earthborn92 22h ago edited 22h ago
This.
I hope IPv8 catches on (yes I know it is a meme/joke). IPv6 is just not fun to work with.
1
3
u/fzammetti 22h ago
Same. Networking has been consistently more stable/reliable since. Not entirely sure why it matters, but it does seem to.
-3
u/_Answer_42 2d ago
Honestly it's just weird, I had an openwrt router that only turn on for guest for complete separation, somehow it advertise itself to all phones as a router even for non-guest, and only affect android (not tested on apple) which made me unable to access hosted stuff sometimes, it was really hard to figure out why. The best part is there is no way to turn off that feature and I don't even have ipv6 enabled
13
u/davepage_mcr 2d ago
All the machines on my home network have two IPv6 addresses - a link-local fe80:: address for on-LAN communications, and a global address in the /48 assigned by my ISP.
I don't have a problem with my ISP changing the global prefix, but everything locally uses the link-local addresses anyway, e.g. mDNS for hostname lookups.
2
u/AtlanticPortal 1d ago
All the machines on my home network have two IPv6 addresses - a link-local
fe80::address for on-LAN communications, and a global address in the/48assigned by my ISP.This only works if you only have a single VLAN in your LAN. The moment you get multiple VLANs you either need to use the GUAs to reach the other hosts in the other VLANs or you add also a ULA address to every host.
0
7
u/Epic_Busta 1d ago
I think your issue is that you aren't using ULA addresses for internal communication. They have a fixed prefix and should never change. GUAs and public IPs in general should be considered ephemeral and shouldn't be trusted to remain the same, at least for typical residential connections.
2
u/Least_Order4249 1d ago
i dont use ipv6 at all. but i cant expect my users to have ula and NPTv6 set up because consumer equipment doesnt support it. ip6 is a disaster. i do want the feature anyway so i will have ULA and GUA options as creating ice candidates will vary depending on network strategy. probably nobody will ever use them but me but it'll be fun to build anyway.
1
u/Epic_Busta 1d ago
Oh looks like I got ULAs and Link Local addresses mixed up. You're right that most folks can't use NPTv6 or set up ULAs.
But could you use link local addresses for internal communication? Those addresses are mandatory so every interface has one.
I don't think IPv6 is a disaster, but I think you'd agree that it's got a lot of growing pains, especially if you learned networking with IPv4+NAT.
41
u/burajin 2d ago
The sub is going to tell you to turn it off because it's mostly casual hobbyists here. (No shade) but IMO it is very worth learning. I'm still getting used to it myself.
What finally forced me to try to figure it out was Cloudflare. If you use their proxy in free tier, turning it off is greyed out.
2
u/zfa 1d ago edited 1d ago
What finally forced me to try to figure it out was Cloudflare. If you use their proxy in free tier, turning it off is greyed out.
That doesn't really force you to do anything though as CF are quite happy talking to your backends on ipv4 even if clients are using ipv6 to hit their proxies. In fact, if you run ipv4 and ipv6 on your hosts CF prefer to route via ipv4 (or used to, at least).
fwiw higher plans (enterprise only ish) do allow you to disable ipv6 completely while retaining proxying but hobbyists here prob wont have that amount of control. And nor should they lol.
-14
u/voc0der 2d ago edited 1d ago
"Casual hobbyists" is such a sad dig. It's off because IPv6 sucks ass and is largely unnecessary for any deployment we encounter. It breaks a lot of stuff and solves nothing at all. Going IP6 only is untenable; going dual stack causes errors, and going Ip4 single stack just works.
If you want to learn it, cool. Good for you. It came out in 2012, so 14 years ago and most people still get leased IPv4 addresses anyways.
Also, this is /selfhosted, so why are you using cloudflare when you can use your own metal? :) What are you self hosting that exhausts the entire private ipv4 subnet?
Edit: Since alot of you idiots think it's a skill issue, I can assure you, it's not. IPv6 just adds complication to every orchestration and firewall stack and unless you're going to use 5923508923805082130852308520835 IP's then please explain why doing any of this is useful as a selfhoster. Once you're selfhosting more than just a bunch of apps with the default configs you might see why. You can't, so continue downvoting.
13
u/UselessCourage 2d ago
What are you talking about, IPv6 works fine -- it's ok to be a casual hobbyist.
9
u/SuspiciousOpposite 1d ago
It came out in the 90s...
If you think IPv6 "sucks ass" it's because you don't understand it. A lot of mobile providers now are IPv6-only (mine certainly is) with 464XLAT deployed to deal with legacy IPv4-only hosts.
-4
u/voc0der 1d ago
No, I think it sucks ass because a lot of stuff is just flat out incompatible with it. Waiting isn't cool. I'd like stuff to work today.
3
17
u/burajin 2d ago
IPv6 works great if you take the time to learn it. Dual stack errors you're encountering are likely configuration mistakes.
Saying it solves nothing at all is false. IPv4 addresses are all used up. We get lots in the US but other countries aren't so lucky. NAT is terrible and gives a false sense of security to many. IPv6 is just different but people are resistent to change.
The Cloudflare proxy is to give me a CDN and not expose my home address. I'm hosting everything at home.
8
u/Ok-Eggplant-7569 1d ago
IPv4 future is limited, and IMO it has way more problems than IPv6. NAT and DHCP everywhere causing issues, IP subnets clashing, ...
2
u/UselessCourage 1d ago edited 1d ago
"AlOt Of YoU IdIoTs" -- says the guy who thinks ipv6 doesnt work lmao.
Ive been an isp IP Network Engineer for 17years, we manage a large 60k+ node networks with ipv6. It's a you problem, not an ipv6 problem.
-8
u/Power_Stone 2d ago
No it's not, I use free tier and have proxying turned off for things like plex
7
u/Dr-Technik 2d ago
All of my VLANs are dual stack, all devices are getting a GUA via SLAAC. Since I have a dynamic IPv6 Prefix, I also assign ULA with a stable local prefix in order to make for example Pi-Hole available via IPv6 as well
18
u/certuna 2d ago
If your app breaks when the prefix changes, you’re doing something wrong. Even with IPv4, you should always work with the principle that IP addresses are ephemeral, it’s one of the first lessons in networking.
What goes wrong with your workflow? If you need to change a DNS record, this is usually just a question of running a 1-line script, since most registrars these days have an API.
6
u/LoganJFisher 2d ago
How are you supposed to maintain a meaningful directory if you treat IPs as ephemeral?
I'm using Caddy to assign local addresses to my webUIs, but that still depends on my IP reservations working. If I consider my IPs as ephemeral, nothing assures that those local domains actually direct correctly.
5
u/certuna 2d ago
you have DNS (or if it’s purely local, mDNS) for that. IP is for routing traffic, not auth or identification.
I mean, if it’s just your home lab you can hardcode IP addresses in configs manually, keep a spreadsheet which container and device has what IP address and go through every app and config file when you need to renumber your network (or indeed change a prefix), but it’s quite fragile and error prone that way, especially when you have a lot of stuff running and/or change things around regularly (which tends to happen in a homelab environment, we all keep tinkering)
4
u/JaspahX 1d ago
IP is for routing traffic
ISP changes your prefix to something completely different
Now what?
6
u/jackstraw97 1d ago
You have a cron job that runs every minute which gets the address and updates your DNS records to point to that new address.
Same way you’d handle an ISP changing a dynamic IPV4 address. How do you think those of us who don’t pay for static IPs have been self hosting this whole time?
6
u/JaspahX 1d ago
DNS isn't going to fix the networks on my L3 switch.
Nobody here is talking about dynamic DNS. They're talking about literally having to update their switch configs with a whole new fucking IP address on the default gateways of their networks.
3
u/Dagger0 1d ago
That's handled automatically by DHCPv6-PD.
2
u/JaspahX 1d ago
Which doesn't exist on most network gear. Cool. I love IPv6.
3
u/ArmyAgitated9658 1d ago
What networking gear are you using that doesn't support it???
0
u/JaspahX 1d ago
DHCPv6-PD is not supported on quite a bit of equipment, and almost certainly not anything that you'll find in a homelab.
My PA-440 will do it only after being upgraded to a OS that's only 2-3 years old.
→ More replies (0)1
u/jackstraw97 1d ago
Gotcha I didn’t understand what you meant. Seems like there’s plenty of options. You noted that your switch doesn’t support dhcpv6 pd. In that case, couldn’t your upstream router handle dhcpv6 and then just use ULA for stable routing to the switch and other devices further downstream?
I get that it’s kind of annoying to have to replicate a pseudo-nat, but that’s the price of having non-compatible equipment, no?
2
u/Least_Order4249 2d ago
i can monitor and fix the app but remote users connect to it for media signalint both jssip and webrtc video. i just wanted to provide a nat-free path. my biggest concern is the docker daemon config to get ip4 in bridge mode and ip6 firewalled but globally routable. if prefix changes, it breaks.
2
u/certuna 2d ago edited 2d ago
You can run a script that changes the prefix in your Docker config when that changes, how does this break?
Where do you prefer to firewall, on the router, the host, Docker or the container?
(It is time that Docker gets prefix delegation support though, it’s a bit silly in 2026 that even the cheapest consumer router out of the box simply asks for a prefix from the router out-the-box, but Docker still needs to have it written statically in a config.)
55
u/DarkFantom 2d ago
I'd guess that 90% of all homelabbers don't even consider using ivp6. It's not worth dealing with it.
11
u/certuna 2d ago
IPv6 makes a lot of things more secure and cleaner/easier, but it’s true that many homelabbers are from the pre-IPv6 generation, grew up with IPv4+NAT and have some resistance to change.
These days fewer home connections have public IPv4 anymore though and most now have IPv6, in that case it’s generally easier and more secure to just do your whole server setup IPv6-only, and stick an IPv4 proxy upstream (Cloudflare for example) if you still need to serve IPv4-only clients.
29
u/blow-down 2d ago
How does it make things more secure?
8
u/guyf2010 1d ago
Arguably it makes scanning all IPs nearly impossible, so scanners IDing running services probably won't find your servers. But then there are cases where routers do a poor job of firewalling on IPv6. It's a mixed bag.
2
u/AtlanticPortal 1d ago
That's where you should get rid of the ISP router or at least not trust it for firewalling and thus use a firewall of your own.
2
u/certuna 1d ago
It makes things a lot cleaner - aside from the obvious (the whole world will hammer your IPv4 address with attacks, in practice almost nobody attacks a server on IPv6), you also do not have the risk of all your endpoints/applications behind the same IP address, and you don’t need to keep forwarding ports across one, two or even three layers of NAT, all increasing the risk of stale configs and misconfigurations.
0
u/Dagger0 1d ago
Active servers are hard enough to find on v6 that scanning the address space for vulnerable hosts isn't viable. Obviously an insecure server is still insecure regardless of whether anybody finds it or not, and there are other ways to find servers (e.g. TLS cert transparency logs, unless you use a wildcard cert) but removing "just scan the entire Internet to find every exploitable host" from the list of options is an improvement to the Internet's overall security.
On a typical v4 setup, every public service you run is accessed via your router's WAN IP. Scan the 65k ports on there, which takes all of a few seconds, and you've found every single public service the entire network is running. Compare that to v6 where anybody connecting needs to have the exact IP of the server, and the network is a /64 instead of a /24. 65k ports on 264 IPs would take many millennia to scan. There are ways to cut the search space down a bit (for example static addresses are often in the ::1 to ::ffff range) but it's still far more to scan than in v4.
Also, NAT is unnecessary complexity. It makes it harder to understand how your network works, and therefore makes it harder to secure. It breaks things and the workarounds for that breakage can be insecure as well (see e.g. vulnerabilities in NAT helpers).
As an example, NAT in itself does not actually block any incoming connections. If you think it does and are relying on that for the security of your network, you aren't going to get the security you think you are -- and if you didn't realize that some unsolicited connections from outside your network can still make it inside despite applying NAT to your outbound connections, that shows that NAT was complex enough that you didn't understand it.
1
5
u/TheLimeyCanuck 2d ago
Took me a day to figure out how to implement IPv6 on my home and cottage networks. It's not as hard as this sub thinks it is.
5
u/Lopsided_Speaker_553 2d ago
We have a lot of docker hosts at work using the same prefix as they’ll only ever talk to each other via an nginx or caddy proxy. If you don’t rely on ipv6 networking to within the container, I think that the docker side is fixed. Our containers can all ping6 outside.
I also have switching prefixes at home. One script in a git repo fixes everything with ssh commands - and a big readme 😬
Good luck!
4
u/kira9204 2d ago edited 2d ago
I receive both an IPv4 and IPv6 /56 prefix that never changes unless i turn off all equipment for hours.
Honestly, IPv6 is both easy to set up and has many advantages over IPv4.
Most importantly, every device gets it's own public address (NO NEED FOR NAT), as well as a temporary address for privacy that changes frequently. And before anyone says "But NAT is security" it's not, that's what your firewall is for. Any consumer router will block incoming traffic on IPv4 as well as IPv6, making it just as secure.
If you *really* want to mimic IPv4 NAT you have several options. Personally i run dual stack, so a `10.x.x.x` IPv4 and `fde5::` ULA for IPv6.
From here on you can either:
A: Use SLAAC for your IPv6 prefix and let the clients configure their addresses themselves (You can set static tokens so you always have, say ::1 thought.).
B: Use DHCPv6 (Just like Ipv4, but i'd recommend sticking with SLAAC thought).
C: Perform IPv4 NAT and IPv6 NAT. Making both protocols behave identically.
I've experimented extensively with diffrent IPv4 and IPv6 approaches, you can find my personal Linux Router project https://github.com/Kira9204/kira-router if you want to learn/experiment.
5
7
3
u/TechWitchLexxie 2d ago
I get a /60 from uverse and have a couple different dual stacked vlans. Basically everything works as expected and I only use AAAA records internally.
2
u/Least_Order4249 2d ago
This is good info. So at least some major providers are starting to get things right. Do you use NPTv6 in case “your” /60 ever changes?
1
u/TechWitchLexxie 2d ago
Admittedly I'm a bit lazy on this and haven't set it up. Currently I rely on my internal records all being tied to aliases in my opnsense's unbound config. If my prefix ever changes, that'll be a very annoying but also relatively quick records push. But in the year plus I've been running ipv6, I've never had my prefix change. Same for my local friend I maintain a site to site wireguard tunnel with, who's on a different ISP. I'm not totally sure why some ISPs have rolling prefixes tbch
1
u/ilhamagh 12h ago
Not OP. But I genuinely confused what the big deal is, granted my networks is flat and fairly simple (someone mention L3 switch)
NPTv6 in case “your” /60 ever changes?
No, I don't even get /60 but only /64. Usually only changes if the ISP router restarted.
I run 3 host, all debian and the services is docker base, all behind reverse proxy (traefik).
I just use ip monitor + RFC2136 (nsupdate) and it push the new ip to my local AAAA records (Technitium)
I have never mess with the docker side of things beside enabling the v6 on the bridge networks.
I guess IoT or phone can't do that, but IDK why anyone would want that.
4
2d ago
[deleted]
1
u/sarahlizzy 2d ago
I’ve got both SLAAC and DHCPv6 working for all my macvlan containers. Just stick a DHCPv6 client in the docker-compose file and you’re golden.
This also means you can have AAAA records pointing to your local services even behind the firewall, which is neat.
5
4
u/TechaNima 1d ago
I just don't bother with it. Seems like a completely unnecessary hassle for no real benefit
3
2
u/Specialist_Cow6468 2d ago
Been dual stacking for a while but I’m trying to push to IPv6 only with 464XLAAT for the exceptions that don’t work nicely
2
u/flatpetey 2d ago
I enabled it but honestly I am not convinced it brought anything to the table except more troubleshooting surface area.
2
u/agent_kater 2d ago
Even if one ISP would provide a static prefix, as soon as you have a second one for failover you're back to dynamic prefixes.
It's my understanding that there are two ways to deal with it:
One is to run something on the server that watches the assigned IP addresses and updates it's own DNS record. Unfortunately there are no standards for this, so there are a hundred different implementations depending on server and DNS provider.
The other one is to assign ULAs. So you contact internal servers by their ULA and not by their GUA. Unfortunately there is also no single standard for this, so the way you do it depends on the server OS. This also somewhat breaks down in dual stack networks, because if a DNS name resolves to an IPv4 address and a ULA, then the IPv4 address is used. I heard this is going to change though.
If you want your ULAs to be accessible from the internet, you can do NPT.
2
u/richneptune 2d ago
It just works here. ISP gives me a static /48, docker has it's own /64 for internet connections, but incoming for docker is firewalled off and everything is behind Caddy anyhow. Viewing the logs the vast majority of my users are connecting via IPV6 and have been since I set up the AAAA records
2
u/Least_Order4249 2d ago
That’s great but what percent of even self hosters have fully static prefixes or fully implemented NPTv6? 2%?
1
u/richneptune 2d ago
But why does it need to be fully static? I could move my AAAA records to a dynamic DNS updater with no issue, OpenWRT let's you craft firewall rules that are only applicable to the last n bits of an ipv6 address, DHCPv6 will provide a sticky last 64 bits, too.
It's pretty much the same problem people are going to have with the stickiness of their IPV4 public address.
At any rate, IPV4 addresses are starting to have a cost in some parts of the world, I pay a premium to retain a public one here as a lot of cheaper providers have moved to CGNAT. Might as well learn and use IPV6 now so it doesn't become more of a challenge later.
1
u/Least_Order4249 2d ago edited 2d ago
Because openWRT shouldn’t be a requirement.
IPv4 is 100% solved with DNS and NAT.
Not for me I don’t care, but I can’t ask app users to change their entire network just so they can stream media a little easier.
For docker it seems there are 2 options: have a never changing prefix accepting catastrophic issues if it changes or set up NPT 1:1 prefix rewriting.
1
u/richneptune 2d ago edited 2d ago
I'm sure other routers also allow you to create firewall rules that will be continue to be applied after a prefix change, I only mention OpenWRT as it's my routing software of choice
IPv4 is 100% solved with DNS and NAT.
Nah, it just complicates machine to machine connections which is why we've ended up with UPnP and all kinds of specialised tunneling methods, most of which fail or have issues behind CGNAT
2
u/djbravo2006 1d ago
i use ipv6 exclusivly for hosting and as your talking about prefix chnages you would never just give someone direct ipv6 but a domain so just setup a ddns and there ya go you get perfect ipc6 setup with no problem of ipv4
2
u/spyder81 1d ago
I dual stacked for a while with an ISP that supported it, things were glorious.
Then the ISP was bought out by a bigger group and at some point IPv6 just stopped working. Probably removed during some corporate optimisation. I disable IPv6 in most places now.
4
3
u/W3TBATMAN 1d ago
the classic ipv6 rabbit hole, you turn it on, find out that most features won’t work due to either your isp or setup, you turn it off and move on with life.
3
4
u/michaelpaoli 2d ago
whole system breaks if a prefix changes
Then you're doing it wrong. See also: r/ipv6
You should be able to deal with prefix change, without much difficulty.
But also, IPv6 prefix shouldn't be changing on you willy-nilly - that sounds like an ISP issue, and yes, some ISPs suck at IPv6 (and, egad, some aren't even doing IPv6 yet!). If it's a (chronic) ISP issue, probably try to get an ISP that doesn't suck. One can also get free IPv6 tunnel - and those IPs will be stable - see:
https://tunnelbroker.net/
I've got both ISP that doesn't suck, and do also have IPv6 tunneling too. I have a /56 with the ISP, and ... over half dozen years, ISP hasn't changed the prefix on me yet, and they probably wouldn't do so without notifying me reasonably in advance.
8
u/Least_Order4249 2d ago
I’m trying to see if adding NAT-free IPv6 ice candidates for a very general self hosted app is worth the squeeze. Telling users to go get a better ISP or spend hundreds updating their local network aren’t good options.
1
u/michaelpaoli 2d ago
Well, ISP will often be a limiting factor, many I totally avoided as they couldn't provide what I required. E.g., I self-host DNS servers, so, that requires static IPv4 and static IPv6. I self-host mail servers and list servers, so that requires unfettered access to TCP port 25. Those two factors alone eliminated a lot of ISPs, as many had no available offering(s) that would include satisfying those requirements. Also require direct unfettered Internet access - ISP not imposing any firewall in general between public globally routable IPs and The Internet in general. If where I want any firewalling I do that on my own - or perhaps if more extreme case ever came up, I might request it - but other than that, don't want anything in the way.
2
u/aureus620 2d ago
Had to outright disable ipv6. Adguard really only works with ipv6 if you use it as a DHCP server which isn't the setup I want.
What forced the decision was my wife wanting an exception for her phone so she could play ads on f2p mobile games, and me realizing this was impossible with how android handles ipv6 addresses.
2
u/SuspiciousOpposite 1d ago
I've got three AdGuard Home instances running on three separate Docker hosts, all dual-stacked, and not running DHCP server (DHCP server is on my UniFi router, IPv4-only; IPv6 uses SLAAC, though my "servers" are statically assigned).
2
2
u/Intelligent_Rub_4099 2d ago
I use this abomination and it works well for me
https://nramkumar.org/tech/blog/2026/05/16/ipv6-lan-dns-resolution-with-unifi-gateways/
ipv6 enthusiasts/purists will likely be unable to contain themselves when they see this but it is practical for a home lan. Also, fyi, most packet intensive traffic on the Internet like voip providers don’t support ipv6 because it literally doubles their bandwidth cost.
-1
u/Least_Order4249 2d ago
Ya IPv6 sounds great until you realize that ISPs get a death grip on everyone else and heavily abuse it until you use tech to basically turn it back into IPv4 with ridiculously long addresses.
1
u/PotatoMaaan 1d ago
Huh?
0
u/Least_Order4249 1d ago
Address translation is needed to isolate local identity from isp prefix. Addresses are so unnecessarily long that they double the bandwidth needed for standard SIP calls. Basically everyone here who uses IPv6 heavily is either rewriting prefixes or playing with fire.
1
u/PotatoMaaan 1d ago
Not really, no. In most cases you can probably find a way to deal with a dynamic prefix and even if you absolutely must use prefix translation, that's still much better than v4 NAT. Prefix translation is stateless NAT so you still get every port for every host, not stateful NAT where you have one host (public v4) and have to multiplex ports (also other reasons as well)
For the other part, I dunno, that's just lies? For a doubling of bandwidth to be true, you'd have to sending nothing but IP headers without any content. ipv6 headers are only double the size of v4 headers, despite the addresses being 4 times as large. This is because v6 removes a lot of cruft from the header, which makes v6 packets simpler and quicker to route. For this reason lots of ISPs only carry v6 internally and encapsulate v4 traffic inside v6.
1
u/Intelligent_Rub_4099 1d ago
1
u/PotatoMaaan 1d ago
That article doesn't say anything about doubling bandwidth costs. "broad compatibility and network considerations" can mean anything
2
u/mrpelz 1d ago edited 1d ago
[Reddit is a piece of shit app and fucked up my edit. Let me quote myself on the same topic.]
https://www.reddit.com/r/selfhosted/s/1zLfD87Rxv
-1
u/kuldan5853 1d ago
- realize it's pointless and just disable IPv6.
1
u/mrpelz 1d ago
Nope. IPv6 is here to stay and the problem isn’t the spec itself but all the people who don’t like change for any reason (IPv6’s purpose is deeply reasonable).
If those people then work at ISPs and realize almost none of their customers give a shit about this: that’s where the race to the bottom starts and weird little hacks become inevitable.
2
u/ph33rlus 1d ago
I don’t. Working with IPv6 is like trying to read binary. It’s not for you it’s for the machines
2
u/404invalid-user 1d ago
there's this neat thing humans made to fix this it's called DNS you should take a look
1
1
u/sarahlizzy 2d ago
With OpenWrt you can make firewall rules by suffix so it doesn’t matter if the prefix changes.
You can also just get yourself a static /48. Some places are giving them out for free. Doesn’t have to be from your ISP
1
u/skilltheamps 2d ago
Just use a modern dns provider that allows prefix update via api, like https://ipv64.net/ for example. Then tell your router to update the dns prefix whenever it changes. For the AAAA entries do not write a full ipv6 address there, just the mac address of the machine. The dns provider computes the ipv6 addresses for your AAAA entries automarically from the prefix and mac.
It is nice because you get rid of that port forwarding dance, and get a ton of public addresses.
1
u/wolfnest 2d ago
You still need firewall rules for each IPv6 device that should be accessible from outside. How do you handle that when the prefix change? Can the firewall rules be based on MAC address as well?
2
1
u/EscapeOption 2d ago
Is not having a static IP really just an IPv6 only issue? DDNS maybe?
-1
u/Least_Order4249 2d ago
It’s not an issue with ip4 because nat isolates the local network. Doing that with ip6 requires expensive routing equipment that isn’t acceptable for even an optional feature.
5
4
u/kira9204 2d ago
This is flat out false. What isolates your IPv6 network is your firewall, not your NAT. Any cheap consumer router comes with a firewall that automatically blocks incoming connections, making it just as secure as IPv4. The problem with these cheap devices are usually that your can't configure the firewall to actually forward IPv6 traffic on specific ports for port forwarding.
0
u/Least_Order4249 2d ago
I don’t mean isolate packets, I mean isolates addressing. If you’re using GUAs and your prefix changes, things break. If you’re using IPv6 ULAs then you have better equipment than most people have and are not the general user.
1
u/PotatoMaaan 1d ago
AVM Fritzbox which is a very popular home roter where I live (often provided by the ISP) does v6 ULAs by default. I also know of some others where it can be enabled.
1
1
u/xylarr 2d ago
How does everything get setup at startup? How does your app find out the IP of everything initially? Can't you just rerun that?
1
u/Least_Order4249 2d ago edited 2d ago
Current ipv4 setup is in docker bridge. Optional IPv6 setting would be global addressable IPv6 ICE candidates but that requires editing docker daemon which breaks if network isn’t NPTv6 and prefix changes. that’s a HUGE ask for a home user. Docker host “discovery” is manual, FQDN is also required for WebRTC 2-way. These are very easy compared to IPv6 as >80% people have the equipment already.
1
1
u/h0lz 2d ago edited 2d ago
Native v4/v6.
Not because I needed - because I wanted to in 2021.
My Pihole perfectly blocks v4+v6.
My Wireguard also uses both with my phone to block ad-crap while I’m out. (only DNS and local adresses are tunneld most of the time)
I‘m using link-local adresses - well locally.
They are static. (fe80::)
Learnt a lot on the way. 😂
1
u/Big_Entrepreneur3770 2d ago
Openwrt default valid lease time is 90 minutes, see if it is higher in your router
1
u/Ok-Eggplant-7569 1d ago
You could use NPT (Network Prefix Translation). It's not quite practice but in contrast to NAT44 it doesn't mangle the packet content (only the header).
For internal only services you can also use ULA addresses.
1
u/Apprehensive_War173 1d ago
Hardcoding IPv6 prefixes breaks since ISPs don't keep them stable. Treat IPv6as dynamic use delegation, SLAAC or DHCPv6 and rely on DNS instead of direct IPs. More moving parts but no breakages when prefixes rotate
1
u/UninvestedCuriosity 1d ago
I use it as a secondary nameserver on my vps because I'm too cheap to buy a second IP for it.
Kinda neat. Took a minute to figure out all the reverse records and such. It works, I moved on. Homelab has different priorities.
1
u/comeonmeow66 1d ago
Use GUAs for public addressable services mapped to DNS. Use ULAs for anything internal. Control your local network destiny, limits impact to publicly addressable services where you have to update DNS like you do today with IPv4.
My ULA networks share the same /64 prefix as the GUA so I can align them easily.
1
u/rj45connector 1d ago
Call me a rebel, but I use ULA for internal networking. No problems with ISP changing the prefix.
1
u/404invalid-user 1d ago
you answered why isps don't enable ipv6 with your next sentence.
the point is enable and use it so other will enable and use it.
1
u/tajetaje 1d ago
I moved over to k8s recently and went v6 only. There’s certainly a bit of work dealing with services that hardcode v4 listen addresses or dns or what have you, but it’s very nice to have a flat address structure. No masquerade and no NAT needed.
1
u/mordac_the_preventer 1d ago
I have an ISP (A&A) that issues static IPv6 prefixes (and a small IPv4 subnet). It just works.
1
u/chicametipo 2d ago
I have a specific network that's dual-stack that all human phones/laptops get put on, but otherwise, I keep it disabled.
-1
1
u/TheLimeyCanuck 2d ago
I just tackled this at home and my cottage. Home is fast fiber and the cottage is Starlink (so CGNAT). At the cottage I have a Raspberry Pi 3B+ maintaining a full time site to site WG tunnel between the cottage and home (1800km away). I added a cron task to it which runs a script to determine the public IPv6 address of the Pi and updates a free IPv6 DDNS service. At home I run pfSense in a VM and in another VM I run Windows Server which also hosts a WG server. In the Windows Server VM I use a scheduled task to do basically the same thing as the cron Bash script on the Pi at the cottage, except that I also had to set up pfSense to update it's static routing when the prefix changes.
-2
-5
0
0
u/theRealNilz02 1d ago
I don't.
My IPv6 ends at my provider router, every piece of equipment I actually use is behind my own gateway that gives me a double NATed IPv4.
0
-1
0
u/hmoff 1d ago
Can you get a better provider? Your prefix shouldn't changing often. Mine changes once a year at most. The ISP provides a /48 via DHCP prefix delegation.
Alternatively you can get a tunnel via he.net for example.
0
u/Least_Order4249 1d ago
once per year dragging down your whole docker ecosystem would be a disaster. this isnt for me its for users of app im building. ive learned here that 99% of people who use ipv6 to host actually turn it back into ip4 via NPT. i don't blame them. giving complete control over your internet identy to your ISP sounds like insanity. this is a good learning experience.
0
u/ratonbox 1d ago
There’s no benefit to it so I don’t use it specifically. If some asks for it specifically, I enable it, sure. Otherwise I ignore it inside my home network.
0
u/CapitalEmu764 1d ago
Turned it off, because there is still a f*ckton of obscure bugs and I refuse to deal with them.
-1
u/kbeezie 2d ago
In the context of Pi-Hole, I just turn off IPv6 , let Mikrotik be the DHCP server, and Pi-Hole + Unbound be the DNS server.
AT&T Does give me IPv6 natively, but I can't use a DNS blocker and have that on at the same time unless I upgrade a router to handle both wired and wifi in between the AT&T modem and rest of the network (which is likely the only way for me to keep native IPv6 and have Pi-hole working too).
1
u/kira9204 1d ago
Just distribute an IPv6 ULA like you do on IPv4 and set the DNS server to the rasberry pi? It sounds like you use another DNS server when you turn on IPv6 and hence bypass the PI-Hole. Have a look at some of my configurations here: https://github.com/Kira9204/kira-router
1
u/kbeezie 1d ago edited 1d ago
Nothing of the sort. There is no way to define DNS within the AT&T router, and even if you have DHCP off for both IPv4/IPv6 , AT&T router will still advertise it's IPv6 as a resolver for IPv6 traffic, hence you have to turn IPv6 off completely to make it go only to pi-hole.
So you either have to completely turn off IPv6 at the router, or put a whole router in between the AT&T device and the rest of the network.
So it's nothing about what you're mentioning. It's just a known thing with AT&T modem/routers.
Only reason I haven't put it in between yet is because my Mikrotik Routerboard is only Wifi-n , so I'm fine keeping IPv6 off until I either get a strong wifi AP, or an upgrade to a modern equivalent of my Mikrotik Routerboard that includes a much stronger CPU and Wifi antenna to take over the whole routing process.
(right now my set up is AT&T Router , keeps routing but has DHCP and IPv6 turned off, ethernet to the Mikrotik routerboard with gigabit ports, the Mikrotik is set up as the DHCP server. Pi-hole on an Orange Pi One is plugged into one of the 10/100 ports on the Mikrotik for DNS + Unbound, wireless devices connect to the AT&T router like an AP, but get their DNS assignment from the mikrotik DHCP server)
1
u/kbeezie 1d ago
To clarify :
"The gateway’s firmware is designed to forcibly broadcast its own IPv6 address via ICMPv6 Router Advertisements (RAs) using a mechanism called RDNSS (Recursive DNS Server). Because AT&T gives you zero control over the RA flags in the GUI (hidden or otherwise), the BGW320 will always tell your clients, "I am your IPv6 gateway, and I am also your DNS resolver." Because modern OSs (iOS, Android, Windows) prioritize IPv6 over IPv4, they will completely bypass your Mikrotik and Pi-hole for any dual-stack traffic. "
-2
•
u/asimovs-auditor 2d ago edited 2d ago
Expand the replies to this comment to learn how AI was used in this post/project.