IPv6 only network, possible?
-
Hey guys,
Our ISP has asked us to give some of our IP space back (we have between a /24 and /25) and IPv6 testing with PFsense has been great so well done :)I'm just wondering if its feasible to have an IPv6 only network with some kind of translation at the pfsense side so hosts can access IPv4 internet hosts. I have seen TOTD and PTRTD. Are these good options or valid under PFsense? Ideally don't want to dual stack.
-
If you want to access IPv4 hosts then it's not exactly an IPv6-only network :-)
I don't think we have anything for NAT64 yet, but if you are willing to run things through a proxy for web access I think it works to access squid over local v6 and let it grab pages for v4, but that does require an external v4 address.
We do have a couple v6-only systems out there, including one on a line that has no IPv4 uplink connectivity.
Is there some reason you can't dual stack it on everything and just let IPv6 flow free but do NAT for IPv4?
-
Well the problem is we have 18 hosts in a /27 subnet. I want to cut that to a /29 with only the public facing servers requiring IPs but I want to maintain all the hosts on the same subnet.
On PFsense, if I set the IPv4 interface for that subnet to the /29, there will be a major shortfall in IPs. The only other way I could see this working is to install another NIC in PFsense to the same switch with the private IPv4 space. So on one segment there is an IPv6 block, a public /29 ipv4 block and private /24 ipv4 block.
Is this a common problem?
-
NAT is the most common solution there. Or if you have a requirement for public IPs directly on servers, a separate private subnet on a VLAN. Best to isolate hosts that are publicly reachable and those that aren't anyway.
-
@cmb:
NAT is the most common solution there. Or if you have a requirement for public IPs directly on servers, a separate private subnet on a VLAN. Best to isolate hosts that are publicly reachable and those that aren't anyway.
Thanks fort he advice - added in a separate NIC onto PFsense and made a separate network for servers requiring public IPs. Works fine. Only thing is I needed to set a manual oubound NAT rule for the private IPv4 interface range
