Ramblings of an aging IT geek
← Ramblings of an aging IT geek
networking

ipv6 at home, after only a decade of putting it off

Getting a working dual-stack IPv6 setup on a home connection, and the prefix-delegation gotcha that kept it broken for a fortnight.

Network cables in a patch panel

I have been "about to sort out IPv6" at home since roughly 2011. This week I finally did, mostly because I got bored and partly because a service I was poking at only handed out a v6 address and I got tired of going through a proxy to reach it.

The connection itself was the easy part. The ISP delegates a /56, so there is no shortage of room, and the router happily picks up a /64 on the LAN. What took me the better part of two evenings was working out why the LAN clients got addresses but couldn't actually route out. The answer, as ever, was unglamorous: the router was requesting prefix delegation but not handing a sub-prefix to the bridge interface my VLANs hang off. Once I told it to delegate a /60 down to the right interface, every host on the network sprouted a globally routable address within seconds. It is a strange feeling watching your laptop get a public address for the first time. Faintly alarming, even.

The thing nobody warns you about is the firewall. With NAT gone, every device is reachable from the outside unless you say otherwise. The default-deny inbound rule that v4 gave you for free is now your job. I spent a while convinced something was misconfigured before I realised my rules were working perfectly and that was the point.

ping6 ipv6.google.com from the kitchen tablet. Ten years late, but it works.