1

I have a IPv4-only debian server with virtualization enabled and a couple of VN's running happily.

I asked for additional IPs from my provider, because I wanted to migrate existing site from another physical server into a VM, yet I wanted to have totally separate address for it, so it doesn't get associated with the rest of the stuff hosted from the same server.

Their answer was something along the lines that IPv4 addresses are a scarce now, not to be given out lightly, and that RIPE needs a few questions answered before they let me have those IPs. One of their questions is whether or not have I considered running whatever-I-was-going-to-run-via-requested-ips using IPv6 address instead, which got me thinking...

Question(s):

  1. If I opt for hosting a IPv6-only website, will the site still be globally reachable by all customers? Something tells me that the short answer is "no"...
  2. Are there any pitfalls I'd need to watch out for when implementing real (not tunneled) IPv6 addresses inside of one of my bridged virtual machines?

Thanks.

1
  • The short answer to 1 is indeed no. The website will not be reachable be all users/customers unless they all use IPv6. (Either natively or tunneled.) As to 2) Yes: check firewall rules. A lot of places only configure safely for IPv4, and leave gaping holes when IPv6 is enabled. And IPv6 is enabled or installed by default on some of the newer systems. (E.g. win7 and toledo).
    – Hennes
    Jul 27, 2012 at 13:42

2 Answers 2

3
  1. Mostly yes. Obviously it will only work for IPv6 clients, which are very few. But there shouldn't be any routing issues or anything "weird" like that.
  2. All the same, tunneled or not, IPv4 or IPv6; you still need to firewall and all the "normal" precautions.

The reason they're prodding servers to support IPv6 is that IPv6 is experiencing a chicken-and-egg problem. Few clients support IPv6 because few servers do, and vice versa. Prodding clients, who are mostly unmanaged home users, to change would be nigh impossible. Prodding system administrator to change is tough, but not like trying to explain the benefits of IPv6 to grandma.

1
  • +1 for the answer. +1 for chicken-and-egg observation. To bad I can upvote only once :)
    – mr.b
    Jul 27, 2012 at 13:55
1

There are situations here where you can deploy IPv6 usefully.

As you're certainly aware, any public-facing service such as your web server or mail server needs to have a public IPv4 address (and IPv6, of course). But other servers you may run don't necessarily need a public IPv4 address.

I've been doing deployments of numbers of virtual machines in "the cloud" where only the public facing machine (i.e. the load balancer) gets a public IPv4 address, but all of the machines get IPv6 addresses. This actually simplifies things a bit since you no longer need a VPN or SSH tunnel to access any particular VM instance.

(You will run into problems, though, such as nrpe and cacti not having full IPv6 support...)

So give your IPv4 addresses to only those servers that really need it, and sprinkle your IPv6 addresses around liberally. You'll be glad you did.

And remember your firewalls!

1
  • Now, that's an interesting idea. Thanks for sharing it! By the way, Zabbix plays nice with IPv6 :)
    – mr.b
    Jul 31, 2012 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .