Learning/Playing with IPv6 at home. Keith Garner, Gradebook Team Lead

Transcription

1 Learning/Playing with IPv6 at home Keith Garner, Gradebook Team Lead

2 Who am I?

3 tl;dr: Its an IP address

4 The good IPv4 old days Address Netmask Gateway DNS

5 IPv4 Quick review example address: Netmask example: or /24 DNS returns A record gateway router needs to be defined auto configuration: DHCP MAC address is unique key

6 Why IPv6? In Sept 2015ish, IPv4 ran out NAT can only take us so far Private network collision Internet of Things IPv4: 2 32 addresses IPv6: addresses

7 Why IPv6 for you? Ahead of curve Curiosity / learning Being cool

8 Some IPv6 features Large address space Auto-configuration Header rearranged for faster routing Anycast support

9 IPv6 Address 8 groups of 4 hexadecimal digits 2001:0db8:85a3:0000:0000:8a2e:0370:7334 Leading 0s may be omitted 2001:db8:85a3:0:0:8a2e:370:7334 Longest group of consecutive 0s can be omitted 2001:db8:85a3::8a2e:370:7334

10 IPv6 Address Localhost 0:0:0:0:0:0:0:1 ::1 Unspecified 0:0:0:0:0:0:0:0 :: Brackets for URLs and other colon normal places

11 IPv6 Address

12 Address types Link-Local Address Unique-Local Address similar to IPv4 private network Global Unicast Address Your Public IP

13 Link-Local Address Every link has one fe80:: Needed for Neighbor Discovery Protocol, etc Duplicate address detection algorithms

14 Link-Local Address Every link has one fe80:: Needed for Neighbor Discovery Protocol, etc Duplicate address detection algorithms

15 Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC

16 Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC

17 Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC

18 Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC

19 Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC

20 Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC

21 Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC

22 Unique-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC

23 Unique-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC

24 Global Unicast Address Wireless Access Point Tablet Laptop The Internets Firewall PC

25 Global Unicast Address Wireless Access Point Tablet Laptop The Internets Firewall PC

26 You ll have more than one

27 You ll have more than one

28 ICMPv6 Neighbor Discovery Protocol - link-local Neighbor Solicitation Neighbor Advertisement Router Solicitation Router Advertisement

29 Router Advertisement One or more IPv6 prefixes (Link-local scope) Prefix lifetime information Flag information Default device information Default router to use and its lifetime

30 Stateless Autoconfiguration SLAAC IP derived from router prefix and MAC address Can be identified by FF:FE in address 2000:1234:5678::EBFF:FEA4:C1AE SLAAC privacy extension addresses

31 Stateless Autoconfiguration

32 Stateless Autoconfiguration

33 Stateless Autoconfiguration

34 Stateless Autoconfiguration No tracking No reservation (beyond MAC address based.) May need assist from Stateless DHCPv6 servers: NTP, SIP, NIS

35 Stateful Autoconfiguration DHCPv6 Unique Identifier is DUID not MAC Router Advertisement can still be involved

36 DNS AAAA record Reverse is UGLY

37 DNS Via Router Advertisement Recursive DNS Server (RDNSS) DNS Search List (DNSSL) Via DHCPv6

38 Address Space RFC6177 recommends /56 for homes Comcast subnet to a house is /64 /56 4,722,366,482,869,645,213,696 /60 295,147,905,179,352,825,856 /64 18,446,744,073,709,551,616 /72 72,057,594,037,927,936

39 unix tools ping6 traceroute6-6 flags also popular ip can have extended information

40 unix tools ping6 traceroute6-6 flags also popular ip can have extended information

41 Firewall

42 Adoption

43 Adoption

44 Adoption issues NAT is working pretty good and some consider it a security measure Devices aren t using it because its not deployed because devices aren t using it because Most home routers didn t have support until recently and they tend to default off Addresses are hard to remember

45 Sites IPv6 Enabled Netflix Google Facebook whitehouse.gov us.archive.ubuntu.com att.com yahoo.com irc.freenode.net Not so much CNN FoxNews Twitter Microsoft ubuntu.com Bing Amazon Instructure

46 In practice, (at my house)

47 LAN 2601:246:4400:7690::/64 fd88:4c50:7548:0::/ :558:6033:7c:2c99:41d:7efb:da51/128 GUEST 2601:246:4400:7691::/64 fd88:4c50:7548:1::/ :246:4400:7690::/60 fd88:4c50:7548::/48

48 Home Network Dual-stacked DHCPv6 for WAN/Prefix from Comcast Request /60 from Comcast ULA prefix defined for v6 addressing in LAN Give /64 to LAN and to GUEST Have firewall rules for GUEST to get DNS, DHCP

49 Devices in my house IPv6 Enabled Apple devices (Watch/ TV/iPad/iPhone/ TimeCapsule/OS X) ps4 linux Nest thermostat Not so much WeMo Fitbit scale Smarthings Hub August Connect MyQ garage idevices HomeKit switch

50 Getting Started Does your ISP support? IPv6 tunnel brokers Does your router support it? Does your router support OpenWRT? Fastest route: supported ISP + Apple Airport

51 Things to be aware of Or maybe rather Things I ran in to.

52 Don t delete NDP rules

53 Firewall

54 OS X ignores ULA

55 OpenWRT issues odhcpd stops communicating odhcpd doesn t persist leases across restarts Because of those, might need to re-up clients often Default GUI doesn t have place to enter DUID

56 Resources

57 Hurricane Electric

58 Hurricane Electric

59 test-ipv6.com

60 test-ipv6.com

61 Any questions? Keith Garner, Gradebook Team Lead