I am bringing up an NFS server (actually a ZFS pool with any number of data sets exported with NFS) in a co-location rack. I don't need or want any outside systems to have NFS access.

Is there any reason not to simply use the IPv6 link-local address for the server and restrict the NFS server to using only that? It seems that this would help secure the SAN.

  • Do you want the NFS server to have Internet access, e.g. to download software updates? – Mike Scott Oct 15 '17 at 18:14
  • @MikeScott Yes I do of course and also for remote management (via SSH) but it has a separate port for that. – AlanObject Oct 16 '17 at 0:41

Technically it should be possible. Configuration might be a bit more difficult because on every device you'll need to configure not only the IPv6 address of the server but also which network interface to use for reaching it. Some client software might not provide an option for that. It might also create problems later when you want multiple networks to reach your storage, because link-local addresses are not routable.

I would personally just use global addresses to keep things easy, and use simple firewall rules to block access to the storage network. If you really want private address I would recommend using ULA addresses over link-local for this purpose. Use one of the online ULA generators to get an almost certainly unique block, and use that. That way you can expand the number of networks, build a VPN for management etc if/when you need them.

| improve this answer | |
  • 2
    So to answer the question, link-local is not reasonable. Use your site's global allocation, or ULA. Plus a firewall and segmentation. – John Mahowald Oct 16 '17 at 13:11
  • It is really odd how I feel so remedial using IPv6. I have been using/configuring IPv4 since the days when we were given our own "Class C" address space and every system had its own publicly routable IP address. It is just another illustration of how IPv6 is a lot more than just IPv4 with bigger addresses. – AlanObject Oct 16 '17 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.