Verizon Fios and IPV6, Which Settings Work?
-
@jknott said in Verizon Fios and IPV6, Which Settings Work?:
If you had to use NAT, it wasn't working perfectly. You are using a hack that causes it's own problems.
I fundamentally disagree with this assertion.
NAT works, works well, and is even desirable in many circumstances. It is not just a hack, it is a valuable tool.
I feel like people overplay the issues with NAT, derisively calling it a hack, and completely dismiss its benefits.
No, I am not talking about security. Anyone who thinks NAT provides them with any level of security is in for a surprise. That's what the firewall is for. But NAT is an immensely valuable tool for flexibility.
I take exception with the concept that my local network is just a way to get to the greater internet, and because of this everything on my local network needs to be 1:1 addressable with everything else in the world. In fact, I fundamentally reject this concept.
My network is not part of the internet. It is a completely separate thing. The majority of my traffic never even leaves my LAN. It is separate from the internet, does not exist because of the internet, and really has very little to do with the internet at all, except for the occasional packet I direct to traverse my router to the outside world.
My network should be completely separate and completely independent of the internet. There being a firewall is not enough.
If I have to manage my internal network with coordinated globally unique addressing and DNS, there is something very very wrong.
This is what NAT buys me. Complete independence. I am not dependent on my ISP to provide me a block of some completely unintelligible hexadecimal nonsense address range. As long as I use the predefined private address blocks, I can set anything I want, and use it however I want, which is the way it should be, because it is my private network. I shouldn't be tied to the internet in any way.
In fact, I PREFER my local network being NAT:ed for this reason, and I don't want NAT to ever go away. Without NAT my network isn't truly mine.
As long as I control it, NAT doesn't cause me any problems at all. If I need to open and forward a port I can easily do so, no problem at all. And in return it offers me true flexibility with what I want to do with my local network. (This - however - only holds true if I am the one controlling the NAT. If my ISP uses CG-NAT to provide me a non-public IP address from upstream, I'll be pretty upset.)
Anyway, having done some reading, that if I switch to IPV6, I have determined that SLAAC is not going to work for me, so I am going to need DHCPv6, but I have also discovered that Google refuses to support DHCPv6 on their devices, leaving them with a broken IPV6 implementation. Because of this I am going to have to stay on IPV4 until Google pulls their heads out of their asses and properly implements IPV6. I'm not even going to try to transition until that happens....
...unless:
1.) My ISP eventually starts CG-NAT:ing me, and I can no longer use a dynamic DNS to access my network remotely; or
2.) I stop being able to access the remote sites I want to useIf either of these happen, I'll have to selectively enable IPV6 on a limited number of systems, but keep blocking it on everything else. I'd probably lean towards using the link local addresses and NAT66 though, because that's the way I like it.
I have zero tolerance for this "everything should be 1:1" mindset. There is absolutely no reason why my local media file server needs to be 1:1 with some guy halfway around the world's "smart" toaster.
When creating IPV6, the IETF made erroneous assumptions about how people want to use their networks that might work well for some, but certainly is not the solution for all.
-
The first issue with NAT I was aware of was active mode FTP didn't work. At that time most FTP clients didn't support passive mode. Browsers were still fairly new then, so FTP clients were generally used. These days, you need STUN servers for VoIP and some games, to get through NAT. It breaks IPSec authentication headers. It also adds extra overhead for routers to process NAT. You can get the same function as RFC1918 addresses with Unique Local Addresses on IPv6.
-
@mattlach IPv6 specifically has ULA addresses available to meet your desire for local addresses.
Meanwhile, NAT is problematic for security applications like IPSec, DNSSEC, and Geolocation. CGNAT just makes this problem even worse.
Also, private RFC1918 addressing makes combining internal networks with overlapping 10.x.x.x space unnecessarily complicated (very common in the case of business acquisitions and mergers). Never mind that the entire RFC1918 space is insufficient for large individual organizations.
-
@mattlach IPv6 has been working fine for Google, Facebook, and Verizon wireless for many years now. If you want to use site-specific addresses, those are called ULAs in IPv6.
-
@mattlach I suggest if you want to use private addresses use ULAs, however, keep in mind ULA address preference is lower on the source address selection - meaning if you use ULAs you may never use v6 at all because it's low on the source slection table.. If you want private, just do better on your firewalls and routing. Honestly, nothing is stopping the internet-community from routing 10/8 addresses on the internet except best common operating practices. There's no magic special sauce in 1918 addresses - just norms and rules.
-
@mattlach said in Verizon Fios and IPV6, Which Settings Work?:
When creating IPV6, the IETF made erroneous assumptions about how people want to use their networks that might work well for some, but certainly is not the solution for all.
I have been running IPv6 on my LAN for over 12 years. Works fine so far.
-
@jeremy-duncan said in Verizon Fios and IPV6, Which Settings Work?:
I suggest if you want to use private addresses use ULAs, however, keep in mind ULA address preference is lower on the source address selection - meaning if you use ULAs you may never use v6 at all because it's low on the source slection table.
???
I have both ULA and GUA on my LAN. No issues at all.
-
My CO supposedly went live a few weeks ago. A scrip to detect RAs did briefly show something.
Last night, there was an outage that I hoped was some further progress.Today, my LAN interface as a 2600:4040 IP, but my WAN only has fe80s. LAN devices have
I can ping 2600:: from LAN devices and from the pfSense WAN interface.
Is this normal? Should I expect the 2600:4040 address on the firewall to be on the LAN interface and not the WAN and to have the one without the 2600:4040 address to be able to ping 260::?
-
@sophware said in Verizon Fios and IPV6, Which Settings Work?:
but my WAN only has fe80s.
Depending on your ISP, that may be normal. On IPv6, link local addresses (fe80) are often used for routing.
-
@jknott Thank you. That makes setting up HAProxy to handle inbound internet traffic interesting (or not possible).
-
@nolaquen said in Verizon Fios and IPV6, Which Settings Work?:
For the folks that have had IPv6 up and running for a while, has anyone had the /56 prefix change on them?
I've only had mine for a week and yes, the /56 has already changed twice. I'm hoping that's just because they're still monkeying around during the rollout.
-
Have you enabled Do not allow PD/Address release?
-
@jknott Yes, I have that enabled. It's possible over the last week of lots and lots of config changes and testing, that I may have briefly had it off. I also changed the seed number in my DHCP6 DUID once, which could have caused it.
-
M MaxK 0 referenced this topic on
-
M MaxK 0 referenced this topic on
-
@mikev7896 if I've used the settings you are suggesting and I'm not passing ipv6 traffic, is that an indication that my area isn't using it yet, or is there a better way to confirm that?
Thanks!
-
@mkomar Hard to say. As far as their "standard" GPON service area (which I believe should be nearly all of their footprint), they should have IPv6 rolled out completely. I've heard of no new areas from other users... Verizon doesn't share info on where IPv6 is available or not. But since it's been almost a year since they started rolling it out, I think they should be done by now.
I've seen some posts from people in NYC that have been upgraded to NG-PON2 (for multi-gig) that don't seem to be able to get IPv6 working... so it's possible that Verizon hasn't enabled it on that infrastructure yet. But I'm pretty sure that in most other areas where Fios is available, IPv6 should be working.
There have been some issues that seem to have arisen lately regarding IPv6 on pfSense, especially pfSense Plus 23.01, but I'm running it right now and don't seem to have any IPv6 issues... so not sure if related or not.
-
@mikev7896 I apprecaite it. I appear to be getting an an assignment, but ping6 is reporting:
ping6: UDP connect: No route to host
-
@mkomar I think my brother had the same thing last week - he got IPv6 addresses, but no routing. My parents had it happen a few months ago too. (Both are in Montgomery County, MD. I'm a few miles north of them in a different CO area, and it's been working for me for many months, so I'm guessing some of the CO's don't have routing set up properly.)
-
@kohenkatz sounds good. I'm in Culpeper, VA.
-
Hi everyone,
Just adding my 2 cents to this discussion to report that I was able to get IPv6 working with Verizon FIOS out of New York City today (Manhattan, Battery Park City). The settings I used were pretty much the ones that have already been discussed here at length, but it took quite a bit of toiling, turning them off and back on a few times, and even a reboot at one point, before my test VLAN's DHCP6 server started successfully assigning v6 IPs to its clients.
And, even after that, my clients were still unable to route any traffic on that VLAN, they were essentially cut off. So at first I made sure the DNS resolver was properly listening on the VLAN's interface, that no firewall rules were blocking traffic, and finally the change that tipped the balance was setting router mode to Assisted in Router Advertisements.
I think the only other thing I did, that probably deviates from the general guidance here, is setting the DHCP6 DUID to "DUID-LL: Based on Link-layer Address" in System -> Advanced -> Networking -> IPv6 Options, using my WAN's MAC address (with my WAN interface being the one connected directly to the FIOS ONT).
Hope that helps people here still struggling with FIOS and IPv6!
PS: Needless to say, I'm all ears if anyone here more knowledgable on IPv6 than me (just about anyone) has some strong advice against how I set up my connection, thanks!
-
A little extra info I learned today when tweaking my IPv6 settings that might be of interest to this forum.
When trying to get IPv6 working on my LAN interface, I made the cardinal sin of disabling it in an attempt to avoid rebooting the router for the config to take, and of course locked myself out of the GUI. That forced me to reassign interfaces on the console to regain access, which in turn caused me to spend the entire day restoring my configuration to a working state (interface assignments, VLANs, firewall rules, etc.).
That, of course, broke my fledgling IPv6 setup completely, and at some point attempting to restore it (and after checking everything else was configured as expected, e.g. interface assignments, firewall rules, DCHP6 settings, DNS Forwarder, etc.) I enabled the "Advanced Configuration" option for the DHCP6 client on my WAN interface, to make sure the correct Prefix Interface was selected, but without configuring any other advanced option. Well, until I disabled that (and without changing anything else), none of my LAN clients were getting any IPv6 assignments, and I was back almost to square 1; but when I did disable it, in desperation, all my LAN clients immediately got their IPv6 addresses!
Hope that helps at least some desperate, IPv6 neophytes souls such as myself!
