Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Hot answers tagged

33

IPv6 is designed to not do that. Trying IPv4 style NAT with IPv6 will break things. That said, I'm pretty sure you can do NAT IPv6 with Linux iptables, so it's not impossible. But I would strongly recommend not to do it.


20

IPv6 doesn't have a NAT standard the way IPv4 does. There is an EXPERIMENMTAL RFC for one-to-one NAT (one outside address for each inside address) on IPv6, but explicitly forbids what you want to do (I highlighted it below): 6. A Note on Port Mapping In addition to overwriting IP addresses when datagrams are forwarded, NAPT44 devices overwrite the ...


8

IPv6 addresses are not the most powerful way to track. DNS traffic shows where on the Internet you are going. On desktop and mobile, ad and social tracking identifiers follow users across devices and IPs. IPv6 addresses can be changed frequently, leaving only the common prefix identifying your site, not the host. On devices without privacy extensions, ...


6

As others have noted, there are many ways your devices will be tracked. Even if you had thousands (instead of just dozens) of them and mapped them all on same IP it wouldn't make much difference. See for example https://panopticlick.eff.org/ if you want to try it yourself, and click on "Show full results". Try with different devices, even change your IP ...


5

If you want to do unusual/frowned upon stuff then using a pre-canned "router distro" as your edge router probablly isn't the best way to go. Further pfsense is based on freebsd pf which does not support "one to many" ipv6 NAT. If you want to do one to many ipv6 NAT I would suggest using a recent version of a generic linux distro as your edge router. Linux ...


2

Migrate all applications to use DNS, and document your findings. As you do not know all of them, this will be a discovery process. Configure a new different IP address on the host and put that in DNS as the service address, db.example.net or so. Communicate to all possible application owners the rename project, and that things will not work if no action is ...


2

The quote from Neil Brown in the old thread, that you posted, is followed by a reference to the source code: See the comment at line 1605 of multi.c and the surrounding code. I think he was referring to the comment that is now at line 2569: /* make sure that source address is associated with this client */ Later on, at lines 2580 and 2690, you can see ...


1

You can do IPv6 NAT just fine with any sufficiently modern iptables-supporting router between the network you are hiding and the network you have the single IP on. It is in practice used to put several machines behind a gateway on the cjdns IPv6 overlay network, as documented here. Assuming you have IPv6 forwarding set up in your kernel, and your router is ...


1

In general, what you depicted is exactly an ECMP route. Although dynamic routing protocols can (and will) install such routes, if you don't expect your network topology to change, running an dynamic routing protocol adds complexity and I feel that is an overkill. OSPF is not a piece of cake, trust me. Sure, you can install such route by hand: ip route add ...


1

If your purpose in having multiple routes is robustness (redundancy in case of failure of a mid node), run OSPF on all five nodes. One option is Quagga, which provides OSPF and other routing protocols for for various Linux flavors including CentOS. Running OSPF on the nodes makes each one of them a router, and communications between master and slave will ...


1

The reason for what you are seeing is documented, but there is not a lot of detail or discussion of the implications provided in the documentation. The CloudFront network has two tiers. There's the outer "global" tier and the inner "regional" tier. Most AWS regions have a regional CloudFront edge in them, but not all -- and Hong Kong is currently an ...


1

To fully understand packet flow through Linux iptables, you will need this diagram or something similar for reference. In the diagram, ping lives in the "local process" box in the application layer. With your current routing table, the system wil "think" only traffic addressed to 10.8.0.0/24 will be routed to the VPN tunnel interface; everything else must ...


1

@John Mahowald's suggestions are sound, especially logging the IPs that connect to 172.17.178.100 to determine which hosts are still using the old IP. Depending on your situation, it may be possible to tunnel the IP you require from the old subnet to the new one. This could be helpful if you are under a deadline to complete the move of the server to the ...


Only top voted, non community-wiki answers of a minimum length are eligible