Différences
Ci-dessous, les différences entre deux révisions de la page.
Les deux révisions précédentes Révision précédente Prochaine révision | Révision précédente Prochaine révision Les deux révisions suivantes | ||
travaux:ipv6-faq [2014/01/20 00:37] sthibaul [Stateless autoconfiguration] |
travaux:ipv6-faq [2015/07/08 10:16] sthibaul |
||
---|---|---|---|
Ligne 1: | Ligne 1: | ||
+ | |||
======= IPv6 FAQ ======= | ======= IPv6 FAQ ======= | ||
+ | |||
+ | or "IPv6 put simply" | ||
This FAQ is released under the WTFPL version 2. Please share it as much as possible, correct it (and it would be nice to feed back corrections), | This FAQ is released under the WTFPL version 2. Please share it as much as possible, correct it (and it would be nice to feed back corrections), | ||
- | This FAQ is meant as a quick-starter for people wondering about adding IPv6 support to their network. It is not meant as a documentation, | + | This FAQ is meant as a quick-starter for people wondering about adding IPv6 support to their network. It is not meant as a documentation, |
If you are wondering about adding IPv6 support and see one of your questions not answered here, please add the question, and lurkers will add the answer :) | If you are wondering about adding IPv6 support and see one of your questions not answered here, please add the question, and lurkers will add the answer :) | ||
Ligne 9: | Ligne 12: | ||
If you do not have an ffdn wiki account, you can ask for one (see http:// | If you do not have an ffdn wiki account, you can ask for one (see http:// | ||
- | That being said, the goal is to answer practical beginner questions, not trolls :) In particular, it won't detail at lengths **why** you want to use IPv6, although | + | That being said, the goal is to answer practical beginner questions, not trolls :) In particular, it won't detail at lengths **why** you want to use IPv6, although a brief non-detailed list is given. |
The structure of the FAQ is: | The structure of the FAQ is: | ||
Ligne 22: | Ligne 25: | ||
* Because there are no IPv4 addresses any more. | * Because there are no IPv4 addresses any more. | ||
- | * Because this permits to give a public IP address to all equipments (computer, phone, tablet, video game consoles, recorder, etc.) without having to use NAT any more, because there are a *lot* of IPv6 addresses (almost a million of billions of billions of IPv6 adresses per earth square meter, | + | * Because this permits to give a public IP address to all equipments (computer, phone, tablet, video game consoles, recorder, etc.) without having to use NAT any more, because there are a *lot* of IPv6 addresses (almost a million of billions of billions of IPv6 adresses per earth square meter, |
* Because there are no IPv4 addresses any more. | * Because there are no IPv4 addresses any more. | ||
* Because you have the opportunity to rethink your addressing scheme. | * Because you have the opportunity to rethink your addressing scheme. | ||
* Because there are no IPv4 addresses any more. | * Because there are no IPv4 addresses any more. | ||
- | * Because IPv4 will be yet more and more painful to make working at all. | + | * Because IPv4 will be yet more and more painful to make working at all. We have kept piling up tricks to continue using IPv4, but that has already cost more than just migrating to IPv6, and continue costing **again** even more than just migrating to IPv6. |
- | * http:// | + | * https:// |
- | * TODO: more | + | |
TODO: links to details | TODO: links to details | ||
Ligne 36: | Ligne 39: | ||
===== Is IPv6 very different from IPv4? ===== | ===== Is IPv6 very different from IPv4? ===== | ||
- | Basically no, the principles of IPv6 are very close to IPv4, even more so since IPv4 has more and more converged toward IPv6, using CIDR, multiple addresses, IPv6 now has NAT, etc. The differences one will have to cope with anyway are: | + | Basically no, the principles of IPv6 are very close to IPv4, even more so since IPv4 has more and more converged toward IPv6, using CIDR, multiple addresses, |
- | * 128bit addresses instead of 32bit addresses, with an [[https:// | + | * 128bit addresses instead of 32bit addresses, with a [[https:// |
- | * Prefix sizes are thus between 0 and 128, e.g. 2001: | + | * Prefix sizes are thus between 0 and 128, usually one uses /64, e.g. 2001: |
- | * Well-known addresses are of course different, e.g. 127.0.0.1 is ::1 in IPv6. | + | * Well-known addresses are of course different, e.g. 127.0.0.1/8 is 0::1/128 in IPv6. |
- | * Interfaces always have at least an IPv6 address in fe80::/10, which is only used on the link scope (e.g. for NDP, see below). This is actually quite like IPv4's automatic private IP adressing (169.254.0.0/ | + | * Interfaces always have at least an IPv6 address in fe80::/10, which is only used on the link scope (e.g. for NDP, see below). This is actually quite like IPv4's automatic private IP adressing (169.254.0.0/ |
- | * DNS entries for IPv6 use " | + | * DNS entries for IPv6 use " |
* IPv6 and IPv4 can not natively talk to each other. More on this below. | * IPv6 and IPv4 can not natively talk to each other. More on this below. | ||
===== Do I have to completely migrate to IPv6? ===== | ===== Do I have to completely migrate to IPv6? ===== | ||
- | Well, in the end, all machines should have IPv6 configured. But that does not mean one has to get rid of IPv4 immediately. One can simply add IPv6 along IPv4, and IPv6 will be used whenever it can be, while IPv4 can still be used as a fallback, even if it is behind a CGN. | + | Well, in the end, all machines should have IPv6 configured. But that does not mean one has to get rid of IPv4 immediately. One can simply add IPv6 along IPv4, and IPv6 will be used whenever it can be, while IPv4 can still be used as a fallback, even if it is behind a CGN (see about CGN below). |
+ | |||
+ | That said, a combination of NAT64 + DNS64 can be used to set up an IPv6-only network, which can still transparently access the IPv4 world, see more on this below. | ||
- | The combination of NAT64 + DNS64 can however be used to set up an IPv6-only network, which can still transparently access the IPv4 world. | ||
===== Is IPv6 slower than IPv4? ===== | ===== Is IPv6 slower than IPv4? ===== | ||
- | There is no general answer to this. For various reasons, IPv6 is faster to process than IPv4 (e.g. no checksum in the IP header, no fragmentation). For others, it is slower (e.g. bigger addresses). IPv6 implementations might not have yet gotten as optimized as IPv4 ones. But the routing tables are much cleaner. | + | There is no general answer to this. |
+ | |||
+ | For various reasons, IPv6 is faster to process than IPv4 (e.g. no checksum in the IP header, no fragmentation, much simpler routing tables, which brings huge savings for routers, and much less use of Ethernet broadcasts). | ||
+ | |||
+ | For other reasons, it is slower (e.g. bigger addresses, leading to 1.33% bandwidth overhead on typical networks, and implementations might not have yet gotten as optimized as IPv4 ones). | ||
+ | |||
+ | In the end, some applications simply try both, and use the one that connects first, so whichever it is wins :) | ||
===== Does my machine support IPv6? ===== | ===== Does my machine support IPv6? ===== | ||
Ligne 72: | Ligne 83: | ||
===== How does DNS work with IPv6? ===== | ===== How does DNS work with IPv6? ===== | ||
- | DNS replies contain both IPv4 answers (in A records) and IPv6 answers (in AAAA records), independently of the protocol which was used for the request/reply: | + | DNS replies contain both IPv4 answers (in A records) and IPv6 answers (in AAAA records), independently of the protocol which was actually |
$ dig -4 any www.ffdn.org | $ dig -4 any www.ffdn.org | ||
Ligne 94: | Ligne 105: | ||
* Configure your host operating system for IPv6 (unless automatically done through dynamic configuration or stateless auto-configuration) | * Configure your host operating system for IPv6 (unless automatically done through dynamic configuration or stateless auto-configuration) | ||
* Make sure your applications know how to connect through IPv6. | * Make sure your applications know how to connect through IPv6. | ||
+ | |||
+ | Those are summarized below. | ||
==== How do I enable IPv6 for my server applications? | ==== How do I enable IPv6 for my server applications? | ||
Ligne 102: | Ligne 115: | ||
* Configure your host operating system for IPv6 (unless automatically done through dynamic configuration or stateless auto-configuration) | * Configure your host operating system for IPv6 (unless automatically done through dynamic configuration or stateless auto-configuration) | ||
* Make sure your server software listens for IPv6 connections | * Make sure your server software listens for IPv6 connections | ||
- | * Publish DNS AAAA records, so people start connecting to your server | + | * Publish DNS AAAA records, so people start connecting to your server |
+ | Those are summarized below. | ||
==== How to bring IPv6 routing up to my machine? ==== | ==== How to bring IPv6 routing up to my machine? ==== | ||
- | Hopefully, your ISP brings IPv6 up to your router. You then just need to configure the router to route IPv6 (that step will be extremely similar to IPv4 routing), and for instance | + | Hopefully, your ISP brings IPv6 up to your router, if not, ask them for it. You then just need to configure the router to route IPv6 (which is extremely similar to IPv4 routing, |
- | + | ||
- | You also need to make sure IPv6 resolution works. For instance, '' | + | |
If your ISP does not bring IPv6 up to your router, you can use an IPv6 tunnel, see below. | If your ISP does not bring IPv6 up to your router, you can use an IPv6 tunnel, see below. | ||
- | Of course, don't forget to set up a firewall along the way. Yes, a firewall, not NAT. | + | Of course, don't forget to set up a firewall along the way. Yes, a firewall, not NAT, see below. |
- | [[http:// | ||
==== Does my ISP bring IPv6 up to my router? ==== | ==== Does my ISP bring IPv6 up to my router? ==== | ||
* France: | * France: | ||
* Renater' | * Renater' | ||
- | * Free provides a /60, but as of jan' 2014, it does not provide a firewall feature on the router to protect it. | + | * Free provides a /60 prefix, but as of jan' 2014, it does not provide a firewall feature on the router to protect it. |
* Nerim provides IPv6 | * Nerim provides IPv6 | ||
* FDN provides a /48 prefix | * FDN provides a /48 prefix | ||
* TODO... | * TODO... | ||
* TODO... | * TODO... | ||
- | ==== How to configure my server operating system for IPv6? ==== | ||
- | The simplest way is simply not to have to configure it, by just configuring DHCPv6 or stateless autoconfiguration on your router. Machines on the network will then automatically configure themselves, just like they can do for IPv4. | + | ==== How to configure my server or client operating system for IPv6? ==== |
+ | |||
+ | The simplest way is simply not to have to configure it, by just configuring DHCPv6 or stateless autoconfiguration, as well as Router Advertisement (RA) on your router, see the "quick examples" | ||
+ | |||
+ | You can however also configure the IPv6 address, default gateway and DNS server by hand, similarly to manual configuration of the IPv4 address. | ||
+ | |||
+ | You need to make sure IPv6 resolution works. For instance, '' | ||
+ | |||
+ | [[http:// | ||
- | You can however also configure the IPv6 address, default gateway and DNS server by hand, similarly to the configuration of the IPv4 address. | ||
==== How to make sure my client software knows how to connect through IPv6? ==== | ==== How to make sure my client software knows how to connect through IPv6? ==== | ||
- | You can tcpdump | + | You can use '' |
One can force the application to use IPv6 by specifying the IPv6 address by hand. This can for instance be done in URLs, by putting the address inside braces (to avoid confusion with the TCP port number), for instance http:// | One can force the application to use IPv6 by specifying the IPv6 address by hand. This can for instance be done in URLs, by putting the address inside braces (to avoid confusion with the TCP port number), for instance http:// | ||
A lot of command-line tools (e.g. ssh, wget, dig, ...) have '' | A lot of command-line tools (e.g. ssh, wget, dig, ...) have '' | ||
- | ==== How to make sure my server software listens for IPv6 connections? | ||
- | One can see this in netstat -Ainet6, e.g.: | + | ==== How to make sure my server software listens to IPv6 connections? |
+ | |||
+ | One can see this in '' | ||
'' | '' | ||
Ligne 145: | Ligne 163: | ||
ssh is properly listening on TCPv6 port 22. | ssh is properly listening on TCPv6 port 22. | ||
- | Some software may have to be explicitly told to listen | + | Some software may have to be explicitly told to listen |
'' | '' | ||
- | where 0.0.0.0 is for all IPv4 addresses, and :: is for all IPv6 addresses. | + | where 0.0.0.0 is for all IPv4 addresses, and :: is for all IPv6 addresses. See the "quick examples" |
==== How to publish AAAA DNS records ==== | ==== How to publish AAAA DNS records ==== | ||
- | IPv6 AAAA DNS records are just like IPv4 A records, except they contain an IPv6 (which is 4 times bigger than an IPv4, thus the 4 A's :) ) | + | IPv6 AAAA DNS records are just like IPv4 A records, except they contain an IPv6 (which is 4 times bigger than an IPv4, thus the 4 A's :) ). For instance, here ' |
+ | |||
+ | '' | ||
+ | '' | ||
===== Can an IPv6-only machine A connect to an IPv4-only machine B? ===== | ===== Can an IPv6-only machine A connect to an IPv4-only machine B? ===== | ||
- | Not natively: there has to be a router R in between which has both IPv6 and IPv4 configured, and performs NAT64 address translation. | + | Not natively: there has to be a router |
+ | |||
+ | '' | ||
+ | '' | ||
+ | |||
+ | All the magic happens at the router in-between: it will translate both ways, masquerading the IPv6 address of '' | ||
+ | |||
+ | Since '' | ||
+ | |||
+ | See http:// | ||
- | A will talk IPv6 using its IPv6 address as source, and :: | ||
===== Can an IPv4-only machine A connect to an IPv6-only machine B? ===== | ===== Can an IPv4-only machine A connect to an IPv6-only machine B? ===== | ||
- | No. A will only be able to connect to B by setting up an IPv6 tunnel | + | No. A will only be able to connect to B by setting up an IPv6 tunnel (i.e. A will not be IPv4-only any more actually). See more about tunnels |
===== What is an IPv6 tunnel? ===== | ===== What is an IPv6 tunnel? ===== | ||
- | It is a tunnel with one end connected to the IPv6 world, thus letting a machine in an IPv4 world have a route to the IPv6 world. A huge lot of various tunnel possibilities exist (TODO: mention a list, but without going into details, just urls). | + | It is a tunnel with one end connected to the IPv6 world, thus letting a machine in an IPv4 world have a route to the IPv6 world. A huge lot of various tunnel possibilities exist (TODO: mention a list, but without going into details, just URLs). Ideally you should not use a tunnel, and just convince your ISP to bring IPv6 to you natively. |
===== I have heard that IPv6 is less secure because it does not have NAT, is that so? ===== | ===== I have heard that IPv6 is less secure because it does not have NAT, is that so? ===== | ||
- | Well, IPv6 does have NAT support nowadays actually. But you don't want to enable it (see below). | + | Well, IPv6 does have NAT support nowadays actually |
- | And not using NAT does not make your network | + | And anyway, |
===== Is NAT available with IPv6? ===== | ===== Is NAT available with IPv6? ===== | ||
- | With recent versions of Operating Systems, yes (TODO: which versions). | + | With recent versions of Operating Systems, yes (In Linux: starting from kernel 3.7). |
That being said, this is usually not a good idea, as NAT breaks a lot of application protocols, see below, and IPv6 is precisely meant to let all machines have their own public IP. | That being said, this is usually not a good idea, as NAT breaks a lot of application protocols, see below, and IPv6 is precisely meant to let all machines have their own public IP. | ||
- | If you really | + | If you really want to, you can use a random fd00::/8 prefix for defining a private local network, see below. |
===== What are the downsides of NAT? ===== | ===== What are the downsides of NAT? ===== | ||
- | * In IPv4, because | + | * In IPv4, it only shifts the lack of addresses a bit: instead of lacking addresses, you are then lacking ports on the few public addresses you are using to masquerade the private addresses. This limits the number of connections each machine can keep open at the same time. This leads for instance to broken images in web pages (because the webbrowser tried to load them in parallel, and that failed). |
* It breaks protocols which explicitly use IP addresses | * It breaks protocols which explicitly use IP addresses | ||
* FTP | * FTP | ||
Ligne 190: | Ligne 219: | ||
* IRC's DCC | * IRC's DCC | ||
* Voice over IP: SIP | * Voice over IP: SIP | ||
- | * And any such protocol that anybody on earth might want to invent. Firewall plugins | + | * And any such protocol that anybody on earth might want to invent. Firewall plugins |
* Consequently, | * Consequently, | ||
+ | |||
+ | ===== Why CGN has more downsides? ===== | ||
+ | |||
+ | Well, it's basically the same as NAT, but to a larger scale: Carrier-Grade NAT (CGN) means it is all customers of an ISP which are masqueraded behind the same public IP addresses, and out of control from the customers. As a consequence: | ||
+ | |||
* All users sharing the same public IP address appear the same on the Internet. | * All users sharing the same public IP address appear the same on the Internet. | ||
* If one of them gets blacklisted based on its IP address, all of them get blacklisted. This has already happened on a very large scale due to CGN. | * If one of them gets blacklisted based on its IP address, all of them get blacklisted. This has already happened on a very large scale due to CGN. | ||
- | * Tracing a network issue gets more complex when you only have a public IP address behind which there are thousands | + | * Tracing a network issue gets more complex when you only have a public IP address behind which there are hundreds |
- | * If a customer does bad (really bad) things on the Internet, the police | + | * If a customer does bad (really bad) things on the Internet, the police |
* machines behind the NAT require port forwarding to act as servers. This hinders innovation. | * machines behind the NAT require port forwarding to act as servers. This hinders innovation. | ||
- | + | * ISPs have millions of customers, 10.0.0.0/8 contains only 16 million IPs. | |
- | ===== Why CGN poses more downsides? ===== | + | * Geolocalisation of customers can not happen any more. |
- | + | | |
- | Well, it's basically the same as NAT, but first to a larger scale: Carrier-Grade NAT (CGN) means it is all customers of an ISP which are masqueraded behind the same public IP addresses. Also, ISPs have millions of customers, 10.0.0.0/8 contains only 16 million IPs. Geolocalisation of customers | + | * The CGN not being controlled by the customer, mostly only TCP and UDP will get through (ICMP too, if the ISP is no too dumb). This hinders possibilities of innovation in the transport layer. |
- | + | ||
- | It is also worse because | + | |
- | + | ||
- | Last but not least, the NAT not being controlled by the customer, mostly only TCP and UDP will get through (ICMP too, if the ISP is no too dumb). This hinders possibilities of innovation in the transport layer. | + | |
===== Do I have to rethink my firewall rules? ===== | ===== Do I have to rethink my firewall rules? ===== | ||
Ligne 210: | Ligne 240: | ||
Essentially, | Essentially, | ||
- | One exception | + | Two exceptions |
* ARP is replaced with NDP, which is contained in ICMPv6, so make sure to enable ICMPv6 (at least types neighbradv and neighbrsol) on prefixes fe80::/64 and ff02: | * ARP is replaced with NDP, which is contained in ICMPv6, so make sure to enable ICMPv6 (at least types neighbradv and neighbrsol) on prefixes fe80::/64 and ff02: | ||
+ | * Routers do not fragment packets any more, so be sure to let ICMPv6 packet-too-big pass, so clients can discover the PMTU (Path MTU) automatically. | ||
(TODO: any other?) | (TODO: any other?) | ||
+ | |||
+ | See the "quick examples" | ||
===== Do I have to rethink my addressing scheme? ===== | ===== Do I have to rethink my addressing scheme? ===== | ||
Well, it can be a good opportunity to clean up the addressing scheme. That said, you don't strictly have to, since there is so much room, you could even, for a machine which has IPv4 192.0.2.128, | Well, it can be a good opportunity to clean up the addressing scheme. That said, you don't strictly have to, since there is so much room, you could even, for a machine which has IPv4 192.0.2.128, | ||
+ | |||
+ | Since there is so much room, one can use prefix sizes that are multiple of 4, and thus not have to care about bitmasks any more since network/ | ||
===== Which addresses can be used for local use? (i.e. equivalent of 192.168.0.0/ | ===== Which addresses can be used for local use? (i.e. equivalent of 192.168.0.0/ | ||
Ligne 224: | Ligne 259: | ||
A very strict equivalent would be using prefixes in fec0::/10 (site-local addresses). For instance, one can typically use fec0::/64. | A very strict equivalent would be using prefixes in fec0::/10 (site-local addresses). For instance, one can typically use fec0::/64. | ||
- | One of the issues in IPv4 was however when merging two networks which use 192.168.0.0/ | + | One of the issues in IPv4 is however when merging two networks which already |
- | + | ||
- | For this reason, it is recommended to rather use Unique Local Addresses (ULA): take one 40-bit random number for your site, and append it to fd00::/8, leading to a /48 prefix. For instance, one could end up with fd12: | + | |
+ | For this reason, it is recommended to rather use Unique Local Addresses (ULA): take one 40-bit random number for your site, and append it to fd00::/8, leading to a /48 prefix. For instance, one could end up with fd12: | ||
===== How does dynamic routing work? (BGP, | ===== How does dynamic routing work? (BGP, | ||
- | Essentially the same way as IPv4 dynamic routing, simply alongside IPv4, for instance by running a bgp daemon for IPv4, and another one for IPv6. You can for instance have exactly the same peering policy (at least with your peers who support IPv6). | + | Essentially the same way as IPv4 dynamic routing, simply alongside IPv4, for instance by running a BGP daemon for IPv4, and another one for IPv6. You can for instance have exactly the same peering policy (at least with your peers who support IPv6). |
===== Does my IPv6 address leak information on my machine? ===== | ===== Does my IPv6 address leak information on my machine? ===== | ||
- | If you configure your network with stateless configuration, | + | If you configure your network with stateless configuration, |
But that's only in that case. With static configuration, | But that's only in that case. With static configuration, | ||
+ | The privacy extension is usually not enabled by default, but can be enabled this way on Linux (here on eth0): | ||
+ | |||
+ | '' | ||
+ | |||
+ | TODO: other OSes | ||
===== Do I have to change all my equipments? ===== | ===== Do I have to change all my equipments? ===== | ||
- | No. All equipments which only talk L2 protocols such as Ethernet do not need to be changed: to them, IPv6 is just another kind of payload among others (86dd for IPv6 instead of 0x0800 for IPv4). The ethernet protocol itself is completely unchanged. | + | No. All equipments which only talk L2 protocols such as Ethernet do not have to be changed: to them, IPv6 is just another kind of payload among others (0x86dd |
- | Routers, however, might have to be changed if they are really old, because | + | L3 routers, however, might have to be changed if they are really old, because |
===== Do I have to recode all my software? ===== | ===== Do I have to recode all my software? ===== | ||
Ligne 249: | Ligne 289: | ||
* it does not deal with IPv4 addresses at all, | * it does not deal with IPv4 addresses at all, | ||
- | * and it uses IPv4/ | + | * and it uses IPv4/ |
+ | |||
+ | For instance, if your software just passes a (hostname, | ||
- | For instance, if your software just passes a (hostname, | + | Most notably, the historical C network |
- | Most notably, the historical C network programming interface is not completely IPv4/ | ||
===== Can I still do XXX with IPv6? ===== | ===== Can I still do XXX with IPv6? ===== | ||
Ligne 262: | Ligne 303: | ||
===== Is there ARP in IPv6? ===== | ===== Is there ARP in IPv6? ===== | ||
- | Yes, although it is rather | + | It was reworked and called Neighbour Discovery Protocol (NDP), and is contained in ICMPv6 instead of a special type of ethernet frame. In the end NDP is basically the same principle |
====== Cheatsheet ====== | ====== Cheatsheet ====== | ||
Ligne 271: | Ligne 312: | ||
::1 | ::1 | ||
+ | |||
+ | (i.e. 0::1) | ||
+ | |||
+ | ===== What is IPv6's 0.0.0.0? ===== | ||
+ | |||
+ | :: | ||
+ | |||
+ | (i.e. 0::0) | ||
===== Which addresses can be used for local use? (i.e. equivalent of 192.168.0.0/ | ===== Which addresses can be used for local use? (i.e. equivalent of 192.168.0.0/ | ||
Ligne 280: | Ligne 329: | ||
====== Some quick examples ====== | ====== Some quick examples ====== | ||
+ | ===== Firefox ===== | ||
+ | |||
+ | Out of the box, firefox should use IPv6 connectivity when available. However, it is not visible to the user. | ||
+ | |||
+ | There is a firefox extension that displays whether the current page is loaded over IPv4 or IPv6: https:// | ||
+ | |||
+ | You can test it on this wiki: if you have IPv6 connectivity, | ||
+ | |||
+ | If IPv6 connectivity does not work, make sure that it is not disabled: in '' | ||
===== Basic OS checks ===== | ===== Basic OS checks ===== | ||
Ligne 336: | Ligne 394: | ||
TODO: how to deactivate ipv4 completely, to check ipv6 for sure? | TODO: how to deactivate ipv4 completely, to check ipv6 for sure? | ||
+ | |||
+ | ==== *BSD ==== | ||
+ | |||
+ | TODO | ||
==== MacOS ==== | ==== MacOS ==== | ||
Ligne 364: | Ligne 426: | ||
TODO | TODO | ||
+ | |||
+ | ==== nginx ==== | ||
+ | |||
+ | First, check if your Nginx is compiled with ipv6 support using '' | ||
+ | |||
+ | On Nginx, you need to add '' | ||
+ | If your server is ipv6only, you can also add '' | ||
+ | |||
+ | Same thing for 443. | ||
+ | |||
+ | ==== openvpn ==== | ||
+ | |||
+ | To establish the connection with the server using IPv6, add '' | ||
+ | |||
+ | To enable IPv6 in the tunnel, **TODO**. | ||
==== TODO: more ==== | ==== TODO: more ==== | ||
+ | |||
===== radvd configuration example ===== | ===== radvd configuration example ===== | ||
- | This makes hosts on the ethernet | + | This announces |
interface eth0 { | interface eth0 { | ||
AdvSendAdvert on; | AdvSendAdvert on; | ||
- | prefix 2001: | + | prefix 2001: |
- | route ::/0 { }; | + | route ::/0 { }; # default route through us |
- | RDNSS 2001: | + | RDNSS 2001: |
} | } | ||
+ | |||
+ | '' | ||
===== DHCPv6 configuration example ===== | ===== DHCPv6 configuration example ===== | ||
+ | |||
+ | Note: DHCPv6 does not provide route information to machines on the network. A router advertisement is necessary for that, e.g. thanks to radvd (or just dnsmasq) | ||
+ | |||
+ | TODO | ||
+ | |||
+ | ===== dnsmasq ===== | ||
+ | |||
+ | dnsmasq can provide both DHCPv6 and Router Advertisement (RA). | ||
TODO | TODO | ||
Ligne 383: | Ligne 471: | ||
===== Firewall example ===== | ===== Firewall example ===== | ||
- | Here are example | + | Here are examples |
==== iptables ==== | ==== iptables ==== | ||
- | # ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbour-solicitation -m hl --hl-eq 255 -j ACCEPT | + | # Accept and forward communication error reporting |
- | | + | ip6tables -A INPUT -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT |
- | # ip6tables -A INPUT -i lo -j ACCEPT | + | ip6tables -A INPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT |
- | | + | ip6tables -A INPUT -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT |
- | # ip6tables -A INPUT -i ppp0 -m state --state ESTABLISHED, | + | ip6tables -A INPUT -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT |
- | # ip6tables -P INPUT DROP | + | ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT |
- | # ip6tables -A FORWARD -i eth0 -j ACCEPT | + | ip6tables -A FORWARD -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT |
- | | + | ip6tables -A FORWARD -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT |
- | # ip6tables -P FORWARD DROP | + | ip6tables -A FORWARD -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT |
- | # ip6tables -P OUTPUT ACCEPT | + | ip6tables -A FORWARD -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT |
+ | ip6tables -A FORWARD -p icmpv6 --icmpv6-type echo-request -j ACCEPT | ||
+ | |||
+ | # Accept local network configuration | ||
+ | ip6tables -A INPUT -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT | ||
+ | ip6tables -A INPUT -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT | ||
+ | | ||
+ | ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -j ACCEPT | ||
+ | ip6tables -A INPUT -p icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -j ACCEPT | ||
+ | ip6tables -A INPUT -p icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -j ACCEPT | ||
+ | | ||
+ | # Accept local trafic | ||
+ | | ||
+ | ip6tables -A INPUT -i eth0 -j ACCEPT | ||
+ | | ||
+ | # Accept incoming WAN trafic related to our own requests | ||
+ | | ||
+ | | ||
+ | # And nothing else | ||
+ | | ||
+ | | ||
+ | # Accept forwarding trafic from us, and related trafic from WAN | ||
+ | | ||
+ | ip6tables -A FORWARD -i ppp0 -m state --state ESTABLISHED, | ||
+ | | ||
+ | # And nothing else | ||
+ | | ||
+ | | ||
+ | # Accept emiting anything ourself | ||
+ | | ||
==== pf ==== | ==== pf ==== | ||
Ligne 405: | Ligne 522: | ||
TODO | TODO | ||
+ | |||
+ | ===== DNS64 ===== | ||
+ | |||
+ | This gives examples of how to configure a DNS64 server in order to make client machines automatically use DNS64. One just needs to pick a /96 prefix among one's own addresses, or use the well-known 64: | ||
+ | |||
+ | ==== bind ==== | ||
+ | |||
+ | / | ||
+ | | ||
+ | dns64 2001: | ||
+ | clients { any; }; | ||
+ | } | ||
====== Advanced features of IPv6 ====== | ====== Advanced features of IPv6 ====== | ||
Ligne 415: | Ligne 544: | ||
RDNSS can also be used to announce the address of a DNS server. The use of a DHCPv6 server may still be useful, configuring it to not distribute IP address, but distribute other kinds of information, | RDNSS can also be used to announce the address of a DNS server. The use of a DHCPv6 server may still be useful, configuring it to not distribute IP address, but distribute other kinds of information, | ||
+ | |||
===== Mobile IPv6 ===== | ===== Mobile IPv6 ===== | ||
- | Although not widely used, this allows a machine to roam between IPv6 networks without losing | + | Although not widely used, this allows a machine to roam between IPv6 networks without losing connections: |
====== Why is there no IPv5? ====== | ====== Why is there no IPv5? ====== |