2

I am bringing up an NFS server (actually a ZFS pool with any number of data sets exported with NFS) in a co-location rack. I don't need or want any outside systems to have NFS access.

Is there any reason not to simply use the IPv6 link-local address for the server and restrict the NFS server to using only that? It seems that this would help secure the SAN.

Improve this question
2
  • Do you want the NFS server to have Internet access, e.g. to download software updates?
    – Mike Scott
    Oct 15, 2017 at 18:14
  • @MikeScott Yes I do of course and also for remote management (via SSH) but it has a separate port for that.
    – AlanObject
    Oct 16, 2017 at 0:41

1 Answer 1

Reset to default
5

Technically it should be possible. Configuration might be a bit more difficult because on every device you'll need to configure not only the IPv6 address of the server but also which network interface to use for reaching it. Some client software might not provide an option for that. It might also create problems later when you want multiple networks to reach your storage, because link-local addresses are not routable.

I would personally just use global addresses to keep things easy, and use simple firewall rules to block access to the storage network. If you really want private address I would recommend using ULA addresses over link-local for this purpose. Use one of the online ULA generators to get an almost certainly unique block, and use that. That way you can expand the number of networks, build a VPN for management etc if/when you need them.

Improve this answer
2
  • 2
    So to answer the question, link-local is not reasonable. Use your site's global allocation, or ULA. Plus a firewall and segmentation.
    – John Mahowald
    Oct 16, 2017 at 13:11
  • It is really odd how I feel so remedial using IPv6. I have been using/configuring IPv4 since the days when we were given our own "Class C" address space and every system had its own publicly routable IP address. It is just another illustration of how IPv6 is a lot more than just IPv4 with bigger addresses.
    – AlanObject
    Oct 16, 2017 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .