Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We operate in a two-address model for our production ipv6 network -- we have an internal site-to-site vpn-connected ULA range in fd00::/8, we also have IPv6 external addressing in 2001::/16. We route-advertise both address prefixes to our clients.

My problem is thus. We don't want to necessarily add the external addresses into DNS, which would imply that internal traffic would skirt out the internet instead of routing over our encrypted VPN's. To that end, I'm trying to find a way to configure the machines (hopefully via group policy) in such a way to avoid the 2001::/16 address being published in DNS for the machines.

I tried setting the two route advertisements such that the 2001::/16 address has no preferred lifetime, but does have a valid lifetime. This achieved what I want with DNS (it didn't register that address), but Windows won't use that address now as it considers it deprecated.

So I'm looking for either:

  • A way to configure DNS auto-registration, via GPO, where I can tell the auto-register to not register certain addresses, or
  • A way to cause windows to utilize a deprecated address that still has a valid lifetime, also pushable via GPO.

Any suggestions?

share|improve this question
I'm not clear why you have two different address prefixes - if you had a single address range it could be used for both site to site VPN traffic as well as external traffic, with suitable routing setup. Maybe there's an IPv6 subtlety I'm not getting here. – RichVel Aug 26 '11 at 7:53
up vote 1 down vote accepted

Could you separate the addressing onto different NICs on each computer? AFAIK Windows only allows you to disable DNS registration per NIC - not per IP.

Failing that, you could do periodic cleansing on the DNS server, running a script every few minutes (or as necessary), deleting any records that match the public addressing scheme.

Again failing that, as @RichVel said... why the separate addressing scheme in the first place? Surely if subnetted correctly you could easily have only the public addressing scheme in place and any edge routers forcing internal machines to go via the VPN for connectivity matching the other site? The edge (before the internet) is surely under your control, so make the routing work for you.

share|improve this answer
You and Rich are both quite right; it's rather confusing why we took this approach and we opted to go a different path after this question was posed. All the same, the question still seemed relevant and needing an answer. I think you've come closest to hitting the nail on the head here. – Peter Grace Oct 3 '11 at 19:14
Thanks for the update and answer selection. May I ask what approach you went for in the end? – Ashley Steel Oct 3 '11 at 19:50
We opted to use external address space, but what we've done is setup high-metric null routes on the routers which prevents intra-site traffic from operating if the dedicated vpn links are down. This way, we avoid the traffic touching the internet in an unencrypted form. – Peter Grace Oct 4 '11 at 18:39
Sounds magical. (: – Ashley Steel Oct 4 '11 at 18:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.