Comment on IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos
InnerScientist@lemmy.world 1 week ago
Either use ipv6 privacy extension (enabled by default, so this can just be called ipv6) or don’t enable ipv6.
That way you have working ipv6 or wait until you come to your senses. Using nat6 ipv6 isn’t worth it.
glizzyguzzler@piefed.blahaj.zone 1 week ago
I see people say “not worth it” but never expound on what exactly makes it not worth it?
Most I get is a vibe (using a metaphor) “python-like judging where people prefer to do it in a ‘pythonic’ way” but of course that’s silly. There must be more to it, but I never seen interoperability issues called out
InnerScientist@lemmy.world 1 week ago
Most (all?) advantage of ipv6 when compared to ipv4 don’t work behind Nat. Thus there’s no reason to use it.
Either use Nat with ipv4 or don’t use Nat with ipv6.
Why did you want to use ipv6 when you don’t want what it represents? (End to end communication/IPs)
glizzyguzzler@piefed.blahaj.zone 1 week ago
Mobile devices are largely IPv6-only now, messing with VPN to home. The IPv6-to-4 conversion seems to be shoddy for my mobile carrier.
Not here for what it represents, just want it to work.
I haven’t run into NAT issues that I’ve noticed, would IPv6 avoid issues with cgnat that people complain about? (If/when it happens in the future)
InnerScientist@lemmy.world 1 week ago
Use ULA addresses for hosts inside your LAN, they are static, cannot be used to reach outside your LAN and use IPv6. Then give your server/VPN endpoint a real ipv6, that’s your VPN endpoint. This doesn’t require any nat and can be easily changed to GUA when you want to.
CGnat is a “solution” for running out of ipv4 addresses, it has the same problems as any other nat but the problems are even more noticeable because the out-facing ipv4 address changes more often than the typical home nat configuration and tricks like FTP- and other helpers don’t work as well.
Ipv6 would not only avoid the issues of cgnat, it would avoid cgnat entirely because you don’t need to Nat when you have enough ips.
Overspark@feddit.nl 1 week ago
NAT is not a firewall and it’s not that great for privacy either, it’s not hard to fingerprint individual devices behind NAT. There are no cases where NAT is better than the alternatives, except when you’re out of public IP’s, which isn’t an issue with IPv6.
So you’re much better off by not trying to reinvent the wheel and using IPv6 the way it was intended. Use privacy extensions for privacy. Use proper firewall rules for security. Revel in the fact that NAT isn’t fucking up your inbound connections. Do not under any circumstances force the horrible kludge that is NAT into your IPv6 network.
glizzyguzzler@piefed.blahaj.zone 1 week ago
I gather people talk like NAT is a rung of hell, but I guess it works because I never think of it. Maybe it becomes shittastic at multiple NATs? With one router it seems straight forward to have port forwarding.
I do not understand why I want better inbound connections - but maybe if I get hit with a cgnat then I’ll understand?
Overspark@feddit.nl 1 week ago
Yeah multiple NAT is a lot worse, but normal NAT has a lot of corner cases too that most people just don’t run into that often. For example if two computers behind NAT want to listen on the same port, that just doesn’t work.
NAT is a “good enough” solution that tricked a whole generation of people growing up with it into thinking it’s a good thing. While in reality the best case is that you don’t run into issues and the worst case is that performance is horrible and you can’t do the things you want to do. The only people that benefit from it are lazy ISPs, not their users.