New answers tagged

-2

remove %eth0 suffix when ping6 global-scope address


0

So this is fairly embarrassing, but I had forgotten I had configured a firewall on my host machine, which meant all incoming connections were blocked. Turned off the firewall and everything works as it should.


1

Is there a way to do a 1-to-1 NAT in IPv6 (I'm using Linux machine as a router)? This is known as "network prefix translation" and yes linux does support it. You use the "SNPT" and "DNPT" targets in the "mangle" table (the "nat" table is only used for stateful NAT). How do I do it? You use the SNPT target to change the source prefix on outgoing ...


0

Can it be done? Yes. You will need a stateful NAT64 implementation. Normally these are used to provide local IPv6 clients with access to resources on the public IPv4 internet but there is nothing stopping you using one the other way round. Firewalls can be used to limit what hosts can be accessed through the NAT64 gateway. Should it be done? In general I ...


0

Your ISP should really get their act together and suport prefix delegation but that is outside your control. Also as far as I can tell while nested prefix delegation is theoretically possible there are no good implementations yet. This makes life difficult if you want to place a router behind a router for some reason. IPv6 does not support NAT. Many ...


6

As stated, this is the way IP was designed to work, and it does work well. NAT introduces annoying problems at times. Some have described NAT's "hiding" of the internal IP as an advantage, but it can also be a disadvantage. I worked in a place with a /16 and we used publicly routable IPv4 addresses on every device (including printers and mobile phones and ...


3

The IPv6 proponets saw NAT as a temporary hack to alleviate IPv4 address exhaustion and hence NAT would not be needed with IPv6. However NAT has a few advantages other than stopping address exhaustion. NAT decouples your internal addressing from your internet connectivity. At least on linux, NAT tends to fail-closed. If the iptables rules fail to load ...


26

Is that how IPv6 is intended to work? In short, yes. One of the primary reasons for increasing the address space so drastically with IPv6 is to get rid of band-aid technologies like NAT and make network routing simpler. But don't confuse the concept of a public address and a publicly accessible host. There will still be "internal" servers that are not ...


14

If there is no need for outside connectivity, then private networks can be used. That is the reason for defining private address space also in IPv6. NAT is a hack that was invented to delay IPv4 address space exhaustion. NAT causes issues with applications, and to get the applications to work with NAT, more hacks are needed which conflict with the original ...


18

We use public IPv6 addresses in our company network for all devices. We use a stateful firewall on our gateway, that: allows all icmpv6 allows new connections from internal network out allows established connections from public to internal No public traffic (except ICMP and established connections) should get into our network. So far we had no problems ...


2

Your VirtualHost is only set up to process IPv4 connections. <VirtualHost *:9999> You need to set it up to process both IPv4 and IPv6 connections. <VirtualHost *:9999 [::]:9999>


3

Try using a 6in4 tunnel broker to get IPv6 connectivity. It is more reliable and will work in this case. The brokers I am aware of offer free tunnels. The upgrade is quick and relatively painless. I've been using 6in4 over with IPv6 on eth0 for years.


2

It is common for proxy services to provide IPv6 to IPv4 conversion There are a few optional headers which can contain IP addresses. If you aren't using them, then there should be no issue. If your software is IPv6 capable, and you just don't have a public IPv6 address, there is less likelihood of an issue. The header most likely to have an IPv6 address ...


1

The issue was caused by the DDoS protection software from the datacenter. It contained a bug which caused big latency for DNS lookups. I reinstalled the OS, disabled the DDoS protection (they're fixing the bug) and everything is working now.


3

So after waiting two weeks for an answer and researching another few hours after opening up a bounty i found the solution. Set up a new IPv6 enabled network and assign a subnet available to me (a /80 of my /64) docker network create --ipv6 --subnet=w:x:y:z:aaaa::/80 myfancynetwork Now start a container and connect it to the new network. Find out it's IP ...


2

You assign a full address (/128) in a quad-A record. The /64 is a range of addresses for you to allocate from. For example: 2604:4301:a:103/64 is my range, and I can use any address between 2604:4301:a:103:: (the :: is shorthand for all-zeros) and 2604:4301:a:103:FFFF:FFFF:FFFF:FFFF.


1

How do you propose that you would assign a subnet to an AAAA record? :) Per the RFC: The AAAA resource record type is a record specific to the Internet class that stores a single IPv6 address.



Top 50 recent answers are included