Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


EtherARP

9 posts

Wannabe Geek


#214135 29-Apr-2017 07:31
Send private message

I'm in wellington on the 27.252.128.0/22 subnet. I have noticed there is now IPv6 via dhcpv6.

 

 

 

I'm using an edgerouter-lite, and thought id share my config, and start a thread to discuss any teething pains.

 



i had a wee bit of trouble with routing, but after configuring it to use eui64, it seemed to work. annoyingly vyatta wouldnt let me commit that config because the ipv6 address was already present.

Remember: if using ipv6, dont forget to properly firewall. especially if you're advertising onto lan, as there is no nat (internal devices are externally reachable).

 

 

 

set interfaces ethernet eth0 vif 10 address dhcp
set interfaces ethernet eth0 vif 10 address dhcpv6
set interfaces ethernet eth0 vif 10 dhcp-options default-route update
set interfaces ethernet eth0 vif 10 dhcp-options default-route-distance 210
set interfaces ethernet eth0 vif 10 dhcp-options name-server no-update
set interfaces ethernet eth0 vif 10 dhcpv6-options
set interfaces ethernet eth0 vif 10 dhcpv6-pd rapid-commit enable
set interfaces ethernet eth0 vif 10 firewall in name WAN_IN
set interfaces ethernet eth0 vif 10 firewall local ipv6-name WAN_LOCAL_6
set interfaces ethernet eth0 vif 10 firewall local name WAN_LOCAL
set interfaces ethernet eth0 vif 10 ipv6 address autoconf
set interfaces ethernet eth0 vif 10 ipv6 dup-addr-detect-transmits 1

set firewall ipv6-name WAN_LOCAL_6 default-action drop
set firewall ipv6-name WAN_LOCAL_6 enable-default-log
set firewall ipv6-name WAN_LOCAL_6 rule 10 action drop
set firewall ipv6-name WAN_LOCAL_6 rule 10 state invalid enable
set firewall ipv6-name WAN_LOCAL_6 rule 20 action accept
set firewall ipv6-name WAN_LOCAL_6 rule 20 state established enable
set firewall ipv6-name WAN_LOCAL_6 rule 20 state related enable
set firewall ipv6-name WAN_LOCAL_6 rule 100 action accept
set firewall ipv6-name WAN_LOCAL_6 rule 100 protocol icmpv6
set firewall ipv6-name WAN_LOCAL_6 rule 200 action accept
set firewall ipv6-name WAN_LOCAL_6 rule 200 destination port 546
set firewall ipv6-name WAN_LOCAL_6 rule 200 protocol udp
set firewall ipv6-name WAN_LOCAL_6 rule 200 source port 547
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable

 

 

 

I'll check out how the performance is. Ive heard people have been having a lot of dns issues in wellington lately, perhaps due to the rollout?

dns can sometimes be unpredictable when ipv6 is in use because it alternates between giving you ipv4 A records and ipv6 AAAA records.
My DNS has been pretty solid because rather using vodafones notorious server, i have unbound running on my router, giving secure, reliable, fast resolving. for those on ubiquiti or openwrt, id recommend this.

The main issue here in wellington appears to be DHCPv4, hopefully now ipv6 may provide a fallback, and possibly more reliability, at least in cases where theres problems on the v4 side

 

 

 

The prefix is 2407:7000:f01c:0:[duid]/64

 

where duid is based on your mac address


Create new topic
chicoo
7 posts

Wannabe Geek


  #1772844 30-Apr-2017 14:25
Send private message

Would be interesting to see the IPv6 performance over FibreX




EtherARP

9 posts

Wannabe Geek


  #1773123 1-May-2017 04:02
Send private message

I did a couple of tests with ping and http on a couple of my ramnode vps servers, no significant difference between the two with respect to latency and throughput, it's quality of service that will be the factor. These tests were done on the router itself.

Before I advertise to my LAN, I'm going to take the time to read through RFC4890 and construct a proper firewall config. With a high speed connection shared by a bunch  of insecure hauwei routers, you're inevitability going to face the problem of DDoS, from both compromised neighbours and external threats.

While IPv6 isn't inherently less secure, "internal" and "external" are no longer conceptually and logically separated by default like in ipv4-nat and require explicit filtering. If ipv6 automatically is given out by the stock CPE, i wonder what impact all the traffic to/from externally reachable customer end devices will have on the overall performance of the vodafone network.


michaelmurfy
meow
13275 posts

Uber Geek

Moderator
ID Verified
Trusted
Lifetime subscriber

  #1773131 1-May-2017 07:12
Send private message

The configuration that I have in my Edgerouter guide should work too and is the better way of doing it (look at the IPoE config). The way you've done it will work however is an older way of doing it. Mind giving it a test? You'll just need to add it on the vif 10 interface (and remove your existing IPv6 config).





Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.




DjShadow
4093 posts

Uber Geek

ID Verified
Trusted

  #1773955 2-May-2017 00:24
Send private message

Must be on certain nodes, my router still isn't picking up an IPv6 address


Create new topic





News and reviews »

Gen Threat Report Reveals Rise in Crypto, Sextortion and Tech Support Scams
Posted 7-Aug-2025 13:09


Logitech G and McLaren Racing Sign New, Expanded Multi-Year Partnership
Posted 7-Aug-2025 13:00


A Third of New Zealanders Fall for Online Scams Says Trend Micro
Posted 7-Aug-2025 12:43


OPPO Releases Its Most Stylish and Compact Smartwatch Yet, the Watch X2 Mini.
Posted 7-Aug-2025 12:37


Epson Launches New High-End EH-LS9000B Home Theatre Laser Projector
Posted 7-Aug-2025 12:34


Air New Zealand Starts AI adoption with OpenAI
Posted 24-Jul-2025 16:00


eero Pro 7 Review
Posted 23-Jul-2025 12:07


BeeStation Plus Review
Posted 21-Jul-2025 14:21


eero Unveils New Wi-Fi 7 Products in New Zealand
Posted 21-Jul-2025 00:01


WiZ Introduces HDMI Sync Box and other Light Devices
Posted 20-Jul-2025 17:32


RedShield Enhances DDoS and Bot Attack Protection
Posted 20-Jul-2025 17:26


Seagate Ships 30TB Drives
Posted 17-Jul-2025 11:24


Oclean AirPump A10 Water Flosser Review
Posted 13-Jul-2025 11:05


Samsung Galaxy Z Fold7: Raising the Bar for Smartphones
Posted 10-Jul-2025 02:01


Samsung Galaxy Z Flip7 Brings New Edge-To-Edge FlexWindow
Posted 10-Jul-2025 02:01









Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.