1

My ISP has kindly handed me a /64 prefix, and I'm building an Ubuntu router, as most of my existing equipment is too old to support IPv6. Using various articles, I've managed to get it mostly working, but most examples I've found are centered around tunnel routers, which I've also built, but I guess I'm looking more for best practices when it comes to a native IPv6 router/firewall.

As background, eth0 is my internal interface, and eth1 is external. I currently have something like:

iface eth0 inet6 static
address 2605:xxxx:yyyy:zzzz::1
netmask 64

iface eth1 inet6 static
address 2605:xxxx:yyyy:zzzz::2
netmask 64

Connectivity has been verified in/out on eth1, so I'm being routed correctly by my ISP. I'm planning on using radvd on eth0. I'm also planning on using ip6tables as the firewall.

Where I'm fuzzy is how (or if) I should sub-divide my prefix. I have a number of VLANs accessible to eth0, though given the age of my equipment, I'll probably have to route them via this (virtual) router, so I may end up with either more interfaces or use trunking in some form on eth0.

Most of the machines on this network are virtual, largely on two VLANs. There are probably fewer than 200 active machines, most IPv6-capable.

I originally considered building a bridge instead of a router, but I do want some protection on my network - most machines only want outbound access, and we won't be hosting any public servers at this point.

My questions are pretty basic:

  1. From a best-practices standpoint, what prefix should I use for a VLAN/subnet? /72? /68?
  2. Should eth0 and eth1 be on separate subnets? Is this a dumb question?
  3. Should I be using a bridge instead of a router? Advantages/disadvantages?

My main issue is that there don't seem to be a lot of native examples out there that aren't simple, aren't about Cisco equipment, or don't use BGP. One, good simple example would probably answer all my questions.

Thanks!

2 Answers 2

1

The size you should route to a subnet is a /64. Things like autoconfiguration don't work if you don't use a /64 per subnet. If you only get a single /64 from your ISP then you won't be able to route it in any convenient way. An ISP should give you a /48, or at least a /56, and route that whole prefix to your gateway router. Then you can create subnets and route.

Basically, with your current setup you are limited to a single subnet. So you should create a bridge.

3
  • Thanks for the reply. First, let me say that it's the blind leading the blind, as I don't think my ISP really understands IPv6 at this point (or, at the point they gave me my prefix) either. I'll check with them about a /56 or larger block. For example, I did find out accidentally that their router/bridge lives at (my prefix)::1, as I got a nasty TACACS warning trying to SSH into it. In the end, at least for now, I'm using /80, with the external IP now 2605:xxxx:yyyy:zzzz:1::1 and internal IP now 2605:xxxx:yyyy:zzzz:2::1, and this seems to work, at least in my very limited testing. Apr 1, 2015 at 23:20
  • ...and, point taken about the bridge if I can't get a larger allocation. My use of /80 may explain some weirdness on a test client in terms of its addressing. Apr 1, 2015 at 23:27
  • A /80 will work fine as long as you manually configure every device. Autoconfiguration won't work though, so you won't be able to get e.g. an android device on that network on IPv6 because they require autoconfiguration. And because your ISP thinks your whole /64 is on the LAN their router provides you have to play tricks with proxy NDP to get routing working to your /80. Better to avoid such tricks and just use the /64 provided by your up as one big LAN until they get proper DHCPv6-PD running. Apr 1, 2015 at 23:31
0

I would reconsider using your ISP as a IPv6 provider if they have not given you at least one IPv6 /64 net that is routed to you and one IPv6 address for your external interfacenfor your router. It could aldo benthe case that you have misunderstood what they given you.

You need one IPv6 address on a net provided by your ISP for your external interface. That is their net, not yours, that your router reaches Internet. It could be given to you as a static, DHCPv6 or by SLAAC. The first and second need you and your ISP to communicate addresses, like MAC of your router or the IPV6 address and netmask (CIDR format). With SLAA, all this is automaticly set.

The net you have must be /64, or SLAAC and therfore radvd will not work. Then you have to manually set all your machines addresses. No, DHCPv6 will not work either, as it is built on top of same mechanism as SLAAC uses.

And if your ISP doesn't give you an /48 or /56 net when ask, you should again reconsider your choice of ISP.

So, one plain IPv6 connection to your ISP, like you would with a tunnel. And one routed net for your LANs, and nothing less than /64 and when asked /48 or /56 net that you then can divide into different /64 nets for your LANs. Do not use anything except /64 for a LAN, or you will get problems.

For firewall, don't use pure ip6tables, unless you have read and understood all relevant RFCs.

I would recommend ufw for servers and shorewall6 for routers. You should aldo consider configure DNS through radvd (or DHCPv6 if you consider using that and not SLAAC), and then you need a package for each clent to set that. Also in Debian based distributions like Ubuntu, install the package resolvconf.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .