What if I had two IPv6-capable ISPs for my home, and a /64 or a /56[...skip...]
from each of them? Is it possible to setup a backup link this way?
Can anyone enlighten me?
What if I had two IPv6-capable ISPs for my home, and a /64 or a /56
from each of them? Is it possible to setup a backup link this way?
I know that my home router can advertise multiple global IPv6
prefixes into the LAN, but how will LAN hosts failover to the
backup gateway if the primary ISP fails? They will have IPv6
addresses from both blocks, which should they choose for their
outgoing src address?
With two IPv4 ISPs and NAT, the setup is rather trivial, outgoing connections will work via either of the ISPs because the hosts
needn't be aware of the failure, and their src private IP is always
the same. Can anyone enlighten me?
What if I had two IPv6-capable ISPs for my home, and a /64 or a /56
from each of them? Is it possible to setup a backup link this way?
I know that my home router can advertise multiple global IPv6 prefixes into the LAN, but how will LAN hosts failover to the backup gateway if
the primary ISP fails? They will have IPv6 addresses from both blocks, which should they choose for their outgoing src address?
This is the preferred mode of operation, but it has (only) two disadvantages: 1. All hosts in the LAN must be able to do the switching|balancing on thy own (that means, run Linux; the BSD-style networking stack, like the one used in Windoze, has very limited functionality).
This is second option, but you'd lose the main advantage of IPv6: the
use of publicly routed addresses.
What if I had two IPv6-capable ISPs for my home, and a /64 or a[...skip...]
/56 from each of them? Is it possible to setup a backup link this
way?
Can anyone enlighten me?
I don't see how iPv6 differs from IPv4 in this regard.
Is it like you
have multiple A DNS records vs multiple AAAA records to point to your
node host name?
What if I had two IPv6-capable ISPs for my home, and a /64 or a
/56 from each of them? Is it possible to setup a backup link this
way?
Yes.
I know that my home router can advertise multiple global IPv6
prefixes into the LAN, but how will LAN hosts failover to the
backup gateway if the primary ISP fails? They will have IPv6
addresses from both blocks, which should they choose for their
outgoing src address?
This is the preferred mode of operation, but it has (only) two disadvantages: 1. All hosts in the LAN must be able to do the switching|balancing on thy own (that means, run Linux; the BSD-style networking stack, like the one used in Windoze, has very limited functionality). 2. This may require some manual configuration on every
of them. Not really a problem, but may be boring.
With two IPv4 ISPs and NAT, the setup is rather trivial, outgoing
connections will work via either of the ISPs because the hosts
needn't be aware of the failure, and their src private IP is
always the same. Can anyone enlighten me?
This is second option, but you'd lose the main advantage of IPv6: the
use of publicly routed addresses.
What if I had two IPv6-capable ISPs for my home, and a /64 or a
/56 from each of them? Is it possible to setup a backup link this
way?
Sure.
I know that my home router can advertise multiple global IPv6
prefixes into the LAN, but how will LAN hosts failover to the
backup gateway if the primary ISP fails? They will have IPv6
addresses from both blocks, which should they choose for their
outgoing src address?
NPTv6 is the answer (RFC 6296).
Not sure if your router can handle it.
I know that my home router can advertise multiple global IPv6
prefixes into the LAN, but how will LAN hosts failover to the
backup gateway if the primary ISP fails? They will have IPv6
addresses from both blocks, which should they choose for their
outgoing src address?
This is the preferred mode of operation, but it has (only) twoThis is not feasible because most of those LAN hosts are smartphones, smart TVs, vacuum cleaners, cameras and other IoT devices.
disadvantages: 1. All hosts in the LAN must be able to do the
switching|balancing on thy own (that means, run Linux; the
BSD-style networking stack, like the one used in Windoze, has
very limited functionality). 2. This may require some manual
configuration on every of them. Not really a problem, but may
be boring.
With two IPv4 ISPs and NAT, the setup is rather trivial, outgoing
connections will work via either of the ISPs because the hosts
needn't be aware of the failure, and their src private IP is
always the same. Can anyone enlighten me?
This is second option, but you'd lose the main advantage of IPv6:Indeed. I don't like the idea of using NAT in IPv6 even if I could.
the use of publicly routed addresses.
So what's the solution?
NPTv6 is the answer (RFC 6296).
It's not a good answer. One of the key priorities of IPv6 as touted by
its proponents is the end-to-end connectivity, freedom from NAT.
NPTv6 is the answer (RFC 6296).
It's not a good answer. One of the key priorities of IPv6 as
touted by its proponents is the end-to-end connectivity, freedom
from NAT.
NAT66 is what NAT for ipv6 is called.
NPTv6 is not a NAT, it's
stateless solution.
NAT66 is what NAT for ipv6 is called.
What was the incentive to create such an abomination?
NPTv6 is not a NAT, it's
stateless solution.
Even if NPT is called "prefix translation" and is stateless, it is
still a NAT (in IPv4 terms, a type of a one-to-one NAT).
However, the creators of IPv6 had better invent something like "dead gateway detection" or some other way for end devices to select a
working outgoing address when they have several global prefixes (and gateways) available. I thought my knowledge was lacking, but it turns
out the new and flashy protocol stack is lacking.
Most of these devices have Linux kernel, but crippled userspace.
NAT66 is what NAT for ipv6 is called.
What was the incentive to create such an abomination?
"There are more things in heaven and earth, Horatio,
Than are dreamt of in your philosophy."(c)Shakespeare
And original ipv6 was just a miserable philosophy, created by people
with limited knowledge about real life.
NPTv6 is not a NAT, it's
stateless solution.
Even if NPT is called "prefix translation" and is stateless, it
is still a NAT (in IPv4 terms, a type of a one-to-one NAT).
NPTv6 is for prefix translation only, not for address translation.
It's much more lightweight and easy to implement.
However, the creators of IPv6 had better invent something like
"dead gateway detection" or some other way for end devices to
select a working outgoing address when they have several global
prefixes (and gateways) available. I thought my knowledge was
lacking, but it turns out the new and flashy protocol stack is
lacking.
Do you have a time machine to send some ideas to ipv6 creators? :)
The original IPv4 was also miserable with its classful networks, RIPv1 etc. I still cannot imagine however what "real life" problem they are solving by creating NAT for ipv6.
translation. It's much more lightweight and easy to implement.
Either you translate only the higher 64 bits of the address, or the
whole 128 bits of the address, you still rewrite the packet. True, you don't do PAT, that's why I said that it looks like a one-to-one IPv4
NAT (much like in AWS VPC "public" subnets).
Nope, but I think $subj can be implemented today, e.g. via some field
in RAs etc. In FreeBSD (and I'm sure in other IPv6 implementations)
you can select the prerred source address, you only have to add some
way to change it automatically when a "dead gateway" is detected.
The original IPv4 was also miserable with its classful networks,
RIPv1 etc. I still cannot imagine however what "real life"
problem they are solving by creating NAT for ipv6.
For example - rerouting traffic via VPN to get thru RKN's DPI.
Real life scenario :)
translation. It's much more lightweight and easy to implement.
Either you translate only the higher 64 bits of the address, or
the whole 128 bits of the address, you still rewrite the packet.
True, you don't do PAT, that's why I said that it looks like a
one-to-one IPv4 NAT (much like in AWS VPC "public" subnets).
Yeah, but you can have "host" part the same for several uplinks and
change prefix only on NPTv6 gateway. It's the best ipv6 can offer for
you, sorry.
Nope, but I think $subj can be implemented today, e.g. via some
field in RAs etc. In FreeBSD (and I'm sure in other IPv6
implementations) you can select the prerred source address, you
only have to add some way to change it automatically when a "dead
gateway" is detected.
It adds more complexity and cannot be implemented easily in userland across multiple OSes.
I know that my home router can advertise multiple global IPv6
prefixes into the LAN, but how will LAN hosts failover to the
backup gateway if the primary ISP fails? They will have IPv6
addresses from both blocks, which should they choose for their
outgoing src address?
This is the preferred mode of operation, but it has (only) two
disadvantages: 1. All hosts in the LAN must be able to do the
switching|balancing on thy own (that means, run Linux; the
BSD-style networking stack, like the one used in Windoze, has
very limited functionality). 2. This may require some manual
configuration on every of them. Not really a problem, but may
be boring.
This is not feasible because most of those LAN hosts are
smartphones, smart TVs, vacuum cleaners, cameras and other IoT
devices.
Most of these devices have Linux kernel, but crippled userspace.
With two IPv4 ISPs and NAT, the setup is rather trivial,
outgoing connections will work via either of the ISPs because
the hosts needn't be aware of the failure, and their src
private IP is always the same. Can anyone enlighten me?
This is second option, but you'd lose the main advantage of
IPv6: the use of publicly routed addresses.
Indeed. I don't like the idea of using NAT in IPv6 even if I
could. So what's the solution?
For dumb devices, especially portable, I'd suggest using NPT.
Fully
functional computers may be connected to some other VLANs (two at once
in your case) and configured to use real addresses.
For example - rerouting traffic via VPN to get thru RKN's DPI.
Real life scenario :)
Why would you need NAT for that? Get a VPN/tunnel provider who offers
a global /64 or /56 or even a /48, like HE does.
Yeah, but you can have "host" part the same for several uplinks
and change prefix only on NPTv6 gateway. It's the best ipv6 can
offer for you, sorry.
Too bad and a bit unexpected. There are/were rather complex things
like Mobile IPv6 and HMIP, and they have not thought of a simple
failover?
It adds more complexity and cannot be implemented easily in
userland across multiple OSes.
OK, let's start anew with a simple setup. If there are two routers in
a home LAN advertising different global prefixes, and one of them goes offline, will IPv6 end hosts detect that and remove the corresponding addresses from their configuration?
I know that my home router can advertise multiple global IPv6
prefixes into the LAN, but how will LAN hosts failover to the
backup gateway if the primary ISP fails? They will have IPv6
addresses from both blocks, which should they choose for their
outgoing src address?
This is the preferred mode of operation
1. All hosts in the LAN must be able to do the switching|balancing
on thy own
2. This may require some manual configuration on every of them.
This is not feasible because most of those LAN hosts are
smartphones, smart TVs, vacuum cleaners, cameras and other IoT
devices.
Most of these devices have Linux kernel, but crippled userspace.
With two IPv4 ISPs and NAT, the setup is rather trivial,
outgoing connections will work via either of the ISPs because
the hosts needn't be aware of the failure, and their src
private IP is always the same. Can anyone enlighten me?
This is second option, but you'd lose the main advantage of
IPv6: the use of publicly routed addresses.
Indeed. I don't like the idea of using NAT in IPv6 even if I
could. So what's the solution?
For dumb devices, especially portable, I'd suggest using NPT.How well does NPT (being stateless) work with FTP, SIP and other
protocols which embed addresses into payload?
Fully functional computers may be connected to some other VLANsSpeaking of those fully functional computers in the LAN, do you
(two at once in your case) and configured to use real addresses.
mean the setup when there is a script pinging some outside hosts/ interfaces and modifying the IPv6 routing table, or something more advanced and interesting?
I don't see how iPv6 differs from IPv4 in this regard. Is it like you have multiple A DNS records vs multiple AAAA records to point to your node host name?
I know that my home router can advertise multiple global IPv6
prefixes into the LAN, but how will LAN hosts failover to the
backup gateway if the primary ISP fails? They will have IPv6
addresses from both blocks, which should they choose for
their outgoing src address?
This is the preferred mode of operation
1. All hosts in the LAN must be able to do the
switching|balancing on thy own 2. This may require some manual
configuration on every of them.
This is not feasible because most of those LAN hosts are
smartphones, smart TVs, vacuum cleaners, cameras and other IoT
devices.
Most of these devices have Linux kernel, but crippled userspace.
In general, IoT devices should reside in a separate VLAN without any access to outer world.
Whether you need to access any of them from
outside, you have SSH running on the gateway for that.
With two IPv4 ISPs and NAT, the setup is rather trivial,
outgoing connections will work via either of the ISPs because
the hosts needn't be aware of the failure, and their src
private IP is always the same. Can anyone enlighten me?
This is second option, but you'd lose the main advantage of
IPv6: the use of publicly routed addresses.
Indeed. I don't like the idea of using NAT in IPv6 even if I
could. So what's the solution?
For dumb devices, especially portable, I'd suggest using NPT.
How well does NPT (being stateless) work with FTP, SIP and other
protocols which embed addresses into payload?
FTP is dead.
SIP clients normally use only LAN (everything else should
be performed by a gateway).
Well, I can imagine a SIP client connecting to the corporate SIP PBX.
To work properly in a multi-link environment, it have to establish
_two_ connections for the SIP control channels.
Fully functional computers may be connected to some other VLANs
(two at once in your case) and configured to use real addresses.
Speaking of those fully functional computers in the LAN, do you
mean the setup when there is a script pinging some outside hosts/
interfaces and modifying the IPv6 routing table, or something
more advanced and interesting?
Trivial per-interface VRF.
For example - rerouting traffic via VPN to get thru RKN's DPI.
Real life scenario :)
Why would you need NAT for that? Get a VPN/tunnel provider who
offers a global /64 or /56 or even a /48, like HE does.
With he.net you'll loose access to local google caches and to local
CDNs. With ipv4 I can forward only blocked subnetworks via VPN, with
ipv6 and without NAT66 I can't do that.
Yeah, but you can have "host" part the same for several uplinks
and change prefix only on NPTv6 gateway. It's the best ipv6 can
offer for you, sorry.
Too bad and a bit unexpected. There are/were rather complex
things like Mobile IPv6 and HMIP, and they have not thought of a
simple failover?
Mobile IPV6 is an operator controlled tool to keep your IPv6 address intact. But you are asking for exactly the opposite solution - to
change your IPv6 address.
It adds more complexity and cannot be implemented easily in
userland across multiple OSes.
OK, let's start anew with a simple setup. If there are two
routers in a home LAN advertising different global prefixes, and
one of them goes offline, will IPv6 end hosts detect that and
remove the corresponding addresses from their configuration?
Yes but you'll still have single routing table and timeout for client
to remove dead ipv6 address from interface and routing table is large enough to be unacceptable for general use.
Well, it's a valid point of course. The protocol designers are not required to forsee the acts of malicious morons breaking the Internet intentionally. But they could have provided for a simple failover mechanism.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 374 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 131:15:25 |
| Calls: | 7,957 |
| Calls today: | 2 |
| Files: | 13,008 |
| Messages: | 5,812,960 |