← Back to context

Comment by hdgvhicv

7 days ago

Without nat, my understanding is the right way in v6 is to issue addresses of every network and then send a message to each end device asking it to use a specific ip address to route traffic and hope every client implements RFC 4191 in the right way.

4 comments

hdgvhicv

Reply
sekh60  7 days ago

There's a few options I'm aware of.

The "proper" way would be to get your own ASN and use BGP to route the traffic.

If you're wanting to use a secondary WAN link as a backup for when the other goes down you could have the backup link's LAN have a lower priority. (So I guess hope everything implements RFC 4191 like you said).

You can use NAT66/NPTv6 if you want (though it's icky I guess).

How are you doing it currently?

  • hdgvhicv  6 days ago

    Nat 4, it’s trivial. But IPv6 tell me how terrible nat is despite it being the only solution in both the v6 and v4 world.

    Sadly my 4g provider will not peer via bgp with me, even if I could provide an AS and Sufficiently large IP range.

    I think my home ISP will actually peer with me, but I’d have to tunnel to them over my non-fibre connection, and there’s reduced resilience in that case.

    At work that wouldn’t help at all, there are very few providers for many of our branch offices.

    So once again ipv6 only works with “icky” nat, or on simple 1990s style connections, and not in the real world of multiple providers. Now sure I can do npt which means I don’t need to keep track of state, but then if I didn’t keep track of state I lose the benefits of a stateful firewall.

    As such the only benefits of nat on v6 is that source ports will never need to change even if client 1 and client 2 both send to server 1 port 1234 from source port 5555. This helps with a handful of crappy protocols which embed the layer 4 data (port number) in a layer 6 or 7 protocol.