We're operating an IPv4 network (on ethernet & Wifi) in a student dorm with ~200 users and want to deploy IPv6 in the long term, with stateless autoconfiguration on a single /64 prefix.
Unfortunately, the university providing the uplink requires us to be able to identify the users behind an address. They're currently running a firewall blocking IPv4 addresses in case of misuse (viruses etc.), which is a viable solution because every user currently has only 2 fixed v4 addresses. We already have a list of all MAC addresses that belong to a user (to configure dhcpd) and want to selectively allow/block users ourselves (network fee payment, misbehavior etc.).
In my first tests with a Raspberry Pi running radvd I found out that the majority of connected devices have privacy extensions enabled, making it impossible for the uplink provider to block a misbehaving IPv6 address for longer than its validity time.
So far I only see a few options:
- Track Neighbor Discoveries on the router and create a firewall whitelist entry in real time. Somehow provide an API to the uplink provider to block the user of a given IP. (high effort)
- Disallow privacy extensions and block all IPs without ..ff:fe..
- Add a custom IPv6 extension header for the uplink provider including a unique user ID, so they can block the whole user by just matching an IPv6 header field.
Is there any rather simple solution using existing software? Should we change our plans and use DHCPv6 instead (said to work not as good as SLAAC)? I already thought about requesting a bigger subnet (/48) and giving a separate /64 to each user, but this would require having a huge radvd.conf with 200 prefixes (+ probably 200 VLANs) and unicast RAs changing a few times per hour, as far as I see.