Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




9 posts

Wannabe Geek


# 214135 29-Apr-2017 07:31
Send private message

I'm in wellington on the 27.252.128.0/22 subnet. I have noticed there is now IPv6 via dhcpv6.

 

 

 

I'm using an edgerouter-lite, and thought id share my config, and start a thread to discuss any teething pains.

 



i had a wee bit of trouble with routing, but after configuring it to use eui64, it seemed to work. annoyingly vyatta wouldnt let me commit that config because the ipv6 address was already present.

Remember: if using ipv6, dont forget to properly firewall. especially if you're advertising onto lan, as there is no nat (internal devices are externally reachable).

 

 

 

set interfaces ethernet eth0 vif 10 address dhcp
set interfaces ethernet eth0 vif 10 address dhcpv6
set interfaces ethernet eth0 vif 10 dhcp-options default-route update
set interfaces ethernet eth0 vif 10 dhcp-options default-route-distance 210
set interfaces ethernet eth0 vif 10 dhcp-options name-server no-update
set interfaces ethernet eth0 vif 10 dhcpv6-options
set interfaces ethernet eth0 vif 10 dhcpv6-pd rapid-commit enable
set interfaces ethernet eth0 vif 10 firewall in name WAN_IN
set interfaces ethernet eth0 vif 10 firewall local ipv6-name WAN_LOCAL_6
set interfaces ethernet eth0 vif 10 firewall local name WAN_LOCAL
set interfaces ethernet eth0 vif 10 ipv6 address autoconf
set interfaces ethernet eth0 vif 10 ipv6 dup-addr-detect-transmits 1

set firewall ipv6-name WAN_LOCAL_6 default-action drop
set firewall ipv6-name WAN_LOCAL_6 enable-default-log
set firewall ipv6-name WAN_LOCAL_6 rule 10 action drop
set firewall ipv6-name WAN_LOCAL_6 rule 10 state invalid enable
set firewall ipv6-name WAN_LOCAL_6 rule 20 action accept
set firewall ipv6-name WAN_LOCAL_6 rule 20 state established enable
set firewall ipv6-name WAN_LOCAL_6 rule 20 state related enable
set firewall ipv6-name WAN_LOCAL_6 rule 100 action accept
set firewall ipv6-name WAN_LOCAL_6 rule 100 protocol icmpv6
set firewall ipv6-name WAN_LOCAL_6 rule 200 action accept
set firewall ipv6-name WAN_LOCAL_6 rule 200 destination port 546
set firewall ipv6-name WAN_LOCAL_6 rule 200 protocol udp
set firewall ipv6-name WAN_LOCAL_6 rule 200 source port 547
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable

 

 

 

I'll check out how the performance is. Ive heard people have been having a lot of dns issues in wellington lately, perhaps due to the rollout?

dns can sometimes be unpredictable when ipv6 is in use because it alternates between giving you ipv4 A records and ipv6 AAAA records.
My DNS has been pretty solid because rather using vodafones notorious server, i have unbound running on my router, giving secure, reliable, fast resolving. for those on ubiquiti or openwrt, id recommend this.

The main issue here in wellington appears to be DHCPv4, hopefully now ipv6 may provide a fallback, and possibly more reliability, at least in cases where theres problems on the v4 side

 

 

 

The prefix is 2407:7000:f01c:0:[duid]/64

 

where duid is based on your mac address


Create new topic
2 posts

Wannabe Geek


  # 1772844 30-Apr-2017 14:25
Send private message

Would be interesting to see the IPv6 performance over FibreX




9 posts

Wannabe Geek


  # 1773123 1-May-2017 04:02
Send private message

I did a couple of tests with ping and http on a couple of my ramnode vps servers, no significant difference between the two with respect to latency and throughput, it's quality of service that will be the factor. These tests were done on the router itself.

Before I advertise to my LAN, I'm going to take the time to read through RFC4890 and construct a proper firewall config. With a high speed connection shared by a bunch  of insecure hauwei routers, you're inevitability going to face the problem of DDoS, from both compromised neighbours and external threats.

While IPv6 isn't inherently less secure, "internal" and "external" are no longer conceptually and logically separated by default like in ipv4-nat and require explicit filtering. If ipv6 automatically is given out by the stock CPE, i wonder what impact all the traffic to/from externally reachable customer end devices will have on the overall performance of the vodafone network.


 
 
 
 


Mr Snotty
8764 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  # 1773131 1-May-2017 07:12
Send private message

The configuration that I have in my Edgerouter guide should work too and is the better way of doing it (look at the IPoE config). The way you've done it will work however is an older way of doing it. Mind giving it a test? You'll just need to add it on the vif 10 interface (and remove your existing IPv6 config).





2922 posts

Uber Geek

Trusted

  # 1773955 2-May-2017 00:24
Send private message

Must be on certain nodes, my router still isn't picking up an IPv6 address


Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Intel expands 10th Gen Intel Core Mobile processor family
Posted 23-Aug-2019 10:22


Digital innovation drives new investment provider
Posted 23-Aug-2019 08:29


Catalyst Cloud becomes a Kubernetes Certified Service Provider (KCSP)
Posted 23-Aug-2019 08:21


New AI legaltech product launched in New Zealand
Posted 21-Aug-2019 17:01


Yubico launches first Lightning-compatible security key, the YubiKey 5Ci
Posted 21-Aug-2019 16:46


Disney+ streaming service confirmed launch in New Zealand
Posted 20-Aug-2019 09:29


Industry plan could create a billion dollar interactive games sector
Posted 19-Aug-2019 20:41


Personal cyber insurance a New Zealand first
Posted 19-Aug-2019 20:26


University of Waikato launches space for esports
Posted 19-Aug-2019 20:20


D-Link ANZ expands mydlink ecosystem with new mydlink Mini Wi-Fi Smart Plug
Posted 19-Aug-2019 20:14


Kiwi workers still falling victim to old cyber tricks
Posted 12-Aug-2019 20:47


Lightning Lab GovTech launches 2019 programme
Posted 12-Aug-2019 20:41


Epson launches portable laser projector
Posted 12-Aug-2019 20:27


Huawei launches new distributed HarmonyOS
Posted 12-Aug-2019 20:20


Lenovo introduces single-socket servers for edge and data-intensive workloads
Posted 9-Aug-2019 21:26



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.