Learning/Playing with IPv6 at home Keith Garner, Gradebook Team Lead
Who am I?
tl;dr: Its an IP address
The good IPv4 old days Address Netmask Gateway DNS
IPv4 Quick review example address: 192.168.123.251 Netmask example: 255.255.255.0 or /24 DNS returns A record gateway router needs to be defined auto configuration: DHCP MAC address is unique key
Why IPv6? In Sept 2015ish, IPv4 ran out NAT can only take us so far Private network collision Internet of Things IPv4: 2 32 addresses IPv6: 2 128 addresses
Why IPv6 for you? Ahead of curve Curiosity / learning Being cool
Some IPv6 features Large address space Auto-configuration Header rearranged for faster routing Anycast support
IPv6 Address 8 groups of 4 hexadecimal digits 2001:0db8:85a3:0000:0000:8a2e:0370:7334 Leading 0s may be omitted 2001:db8:85a3:0:0:8a2e:370:7334 Longest group of consecutive 0s can be omitted 2001:db8:85a3::8a2e:370:7334
IPv6 Address Localhost 0:0:0:0:0:0:0:1 ::1 Unspecified 0:0:0:0:0:0:0:0 :: Brackets for URLs and other colon normal places http://[2001:db8:85a3::23]:80/
IPv6 Address
Address types Link-Local Address Unique-Local Address similar to IPv4 private network Global Unicast Address Your Public IP
Link-Local Address Every link has one fe80:: Needed for Neighbor Discovery Protocol, etc Duplicate address detection algorithms
Link-Local Address Every link has one fe80:: Needed for Neighbor Discovery Protocol, etc Duplicate address detection algorithms
Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC
Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC
Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC
Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC
Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC
Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC
Link-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC
Unique-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC
Unique-Local Address Wireless Access Point Tablet Laptop The Internets Firewall PC
Global Unicast Address Wireless Access Point Tablet Laptop The Internets Firewall PC
Global Unicast Address Wireless Access Point Tablet Laptop The Internets Firewall PC
You ll have more than one
You ll have more than one
ICMPv6 Neighbor Discovery Protocol - link-local Neighbor Solicitation Neighbor Advertisement Router Solicitation Router Advertisement
Router Advertisement One or more IPv6 prefixes (Link-local scope) Prefix lifetime information Flag information Default device information Default router to use and its lifetime
Stateless Autoconfiguration SLAAC IP derived from router prefix and MAC address Can be identified by FF:FE in address 2000:1234:5678::EBFF:FEA4:C1AE SLAAC privacy extension addresses
Stateless Autoconfiguration
Stateless Autoconfiguration
Stateless Autoconfiguration
Stateless Autoconfiguration No tracking No reservation (beyond MAC address based.) May need assist from Stateless DHCPv6 servers: NTP, SIP, NIS
Stateful Autoconfiguration DHCPv6 Unique Identifier is DUID not MAC Router Advertisement can still be involved
DNS AAAA record Reverse is UGLY
DNS Via Router Advertisement Recursive DNS Server (RDNSS) DNS Search List (DNSSL) Via DHCPv6
Address Space RFC6177 recommends /56 for homes Comcast subnet to a house is /64 /56 4,722,366,482,869,645,213,696 /60 295,147,905,179,352,825,856 /64 18,446,744,073,709,551,616 /72 72,057,594,037,927,936
unix tools ping6 traceroute6-6 flags also popular ip can have extended information
unix tools ping6 traceroute6-6 flags also popular ip can have extended information
Firewall
Adoption
Adoption
Adoption issues NAT is working pretty good and some consider it a security measure Devices aren t using it because its not deployed because devices aren t using it because Most home routers didn t have support until recently and they tend to default off Addresses are hard to remember
Sites IPv6 Enabled Netflix Google Facebook whitehouse.gov us.archive.ubuntu.com att.com yahoo.com irc.freenode.net Not so much CNN FoxNews Twitter Microsoft ubuntu.com Bing Amazon Instructure
In practice, (at my house)
LAN 2601:246:4400:7690::/64 fd88:4c50:7548:0::/64 2001:558:6033:7c:2c99:41d:7efb:da51/128 GUEST 2601:246:4400:7691::/64 fd88:4c50:7548:1::/64 2601:246:4400:7690::/60 fd88:4c50:7548::/48
Home Network Dual-stacked DHCPv6 for WAN/Prefix from Comcast Request /60 from Comcast ULA prefix defined for v6 addressing in LAN Give /64 to LAN and to GUEST Have firewall rules for GUEST to get DNS, DHCP
Devices in my house IPv6 Enabled Apple devices (Watch/ TV/iPad/iPhone/ TimeCapsule/OS X) ps4 linux Nest thermostat Not so much WeMo Fitbit scale Smarthings Hub August Connect MyQ garage idevices HomeKit switch
Getting Started Does your ISP support? IPv6 tunnel brokers Does your router support it? Does your router support OpenWRT? Fastest route: supported ISP + Apple Airport
Things to be aware of Or maybe rather Things I ran in to.
Don t delete NDP rules
Firewall
OS X ignores ULA
OpenWRT issues odhcpd stops communicating odhcpd doesn t persist leases across restarts Because of those, might need to re-up clients often Default GUI doesn t have place to enter DUID
Resources
Hurricane Electric
Hurricane Electric
test-ipv6.com
test-ipv6.com
Any questions? Keith Garner, Gradebook Team Lead