Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Adding IPV6 to my home network - and putting on the brakes
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3475

PostPosted: Sat Jan 21, 2023 7:44 pm    Post subject: Adding IPV6 to my home network - and putting on the brakes Reply with quote

First I'll say that after years of participating here, I've been generally absent for a bunch of years as well. Now I need help, and this is probably the best place to get it. In return I'll try to be helpful to others - I believe I used to be and can do it again.

Recently my front-line appliance router needed replacement - they seem to be one of the less reliable parts. In the process I discovered that my cable modem was obsolete, so I ended up replacing it as well. While wandering through both I discovered that both are IPV6-ready. So this morning I installed the latest'n'greatest gentoo-sources and enabled IPV6. Then I took "-ipv6" out of make.conf and am rebuilding my main system to be IPV6-ready. (It's still running, 80 of 103, because it includes the generaly weekly updates as well as IPV6.) Then I started looking harder at the IPV6 section of the router manual.

My router doesn't really have an SPI firewall. It has a few firewall functions for things like SYN floods and a few other attacks, but in general it's just got NAT for protection. If I were to turn on IPV6 my home network would be out there with no firewall at all. So that aspect is being delayed. In the meantime, I think I'll keep it enabled for learning purposes.

Question one... I run my network with sort-of static IP served through DHCP. I have a pool for dynamic addresses, but for most of my systems I have the MACs coded into dhcpd.conf and fetch the IP from the local zone of my BIND nameserver to hand out. The MACs are coded into one file, the IPs are coded into two - the forward and reverse zone files. At some point in this IPV6 journey it would be nice to have those addresses properly resolve to names and vice versa. However I'd want this only on my home network, I don't think I could push my names out to the internet even if I wanted to. The odd thing is though that once IPV6 is working properly, it looks like the upper half (or so) of the address will be coming from Comcast and the lower half (or so) from my local configuration. Can someone explain how the two halves get married together in BIND? I see things about router advertisements and multicast channels for pushing the prefix around, but I'm not sure how they get married together for local DNS to work. Or is this a silly question and no one would want to do this anyway?

My old network architecture had an appliance firewall with a subnet behind it, then a bastion host acting as a second firewall and my home network behind that. I may have to go back to that configuration, or maybe I just have the wrong appliance firewall. It's hard to find wired-only home routers these days.
_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
pietinger
Moderator
Moderator


Joined: 17 Oct 2006
Posts: 2315
Location: Bavaria

PostPosted: Sun Jan 22, 2023 11:09 am    Post subject: Reply with quote

depontius,

please allow me to make some general recommendations:

a) I dont know if you use iptables or nftables for your firewalls; with a dual stack I recommend nftables (better than iptables+ip6tables). Maybe this link could be helpful:
https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables

b) You will need some knowledge about IPv6. Maybe this link could be helpful:
https://tldp.org/HOWTO/Linux+IPv6-HOWTO/

(see also here: https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s05.html )

c) IPv6 adresses have a part called "prefix" (this is the "first half" of your IPv6 address; some other provider will use only 48 bit). It is set by your internet provider. The other half is for you. You can use all these addresses for your stations in your local network (more than you ever will need).

d) I always recommend to use a personal firewall (at minimum on every server in your DMZ) - additionally - even if you have a network firewall.

I am sorry I cant help with your questions to DHCP because I would need many more informations.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 51923
Location: 56N 3W

PostPosted: Sun Jan 22, 2023 11:32 am    Post subject: Reply with quote

depontius,

An IPv6 /64 is the smallest that is supposed to be allocated to a network. You can subnet it, but you are not supposed to.
My provider gives me a /64 for my uplink, which is PPPoE, so at most, it uses 2 IP addresses from that entire /64.
Then I get a separate delegated /48 prefix for my home network. That's 65,536 /64 prefixes.

When I signed up the the trial, they asked if a /48 would be enough for my subnets :)

My /48 was statically assigned. Now its dynamic, The range never changes but my ISP drops my unused /64 at their boundary, instead of passing rubbish to me.
Not that there every was very much, the IPv6 address space is almost empty, so port scanning is rare.

My setup is described on the wiki.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3475

PostPosted: Sun Jan 22, 2023 10:59 pm    Post subject: Reply with quote

pietinger wrote:
depontius,

please allow me to make some general recommendations:

a) I dont know if you use iptables or nftables for your firewalls; with a dual stack I recommend nftables (better than iptables+ip6tables). Maybe this link could be helpful:
https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables


I last wrote a firewall with iptables, but have looked at nftables with interest. I appreciate what you say about a unified approach.

pietinger wrote:

b) You will need some knowledge about IPv6. Maybe this link could be helpful:
https://tldp.org/HOWTO/Linux+IPv6-HOWTO/


Light lunchtime reading today, and will keep visiting it. (I just took a quick look at the next link, I like it.)

pietinger wrote:

(see also here: https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s05.html )

c) IPv6 adresses have a part called "prefix" (this is the "first half" of your IPv6 address; some other provider will use only 48 bit). It is set by your internet provider. The other half is for you. You can use all these addresses for your stations in your local network (more than you ever will need).


I've been picking up the prefix issue. I believe Comcast might hand out a /59, but that remains to be verified.

pietinger wrote:

d) I always recommend to use a personal firewall (at minimum on every server in your DMZ) - additionally - even if you have a network firewall.


At the moment I have nothing on a DMZ and only a single port forwarded. I'm not going to activate IPV6 at the router until I've got proper firewalls in place. Today I tried "ip -6 neigh show" and it did - nothing. Then I did an ssh between two systems using the IPV6 address and after that the command would show the other system. So it's really not doing what I thought it should, but I suspect that's because I have no router advertisement in place. I think I need to look at my router and see if I can turn IPV6 on for the LAN without turning it on for the WAN. Then I can be safe, but hopefully have a complete local infrastructure for this stuff. Something tells me that won't work, though.

I knowingly have two IPV6 systems on my LAN. I also have some commercial gear and have no idea how much of that is IPV6-ready. Which is why I want a network-level firewall in place, for that stuff.

pietinger wrote:

I am sorry I cant help with your questions to DHCP because I would need many more informations.

_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 51923
Location: 56N 3W

PostPosted: Tue Jan 24, 2023 11:25 am    Post subject: Reply with quote

depontius,

IPv6 addresses starting with digit 2 or 3 are public. That's the big bad internet delivered right to your system.

IPv6 also has site local and link local addressing, much like IPv4.
Like IPv4, its a convention. Your boundary router is supposed to not route outbound packets in these address ranges. Nobody else will route them either.
It should be safe to play with IPv6 using the site local address range.

The worst that can happen is that your ISP asks you not to sent them any site local packets. :)
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3475

PostPosted: Tue Jan 24, 2023 5:15 pm    Post subject: Reply with quote

NeddySeagoon wrote:
depontius,

IPv6 addresses starting with digit 2 or 3 are public. That's the big bad internet delivered right to your system.

IPv6 also has site local and link local addressing, much like IPv4.
Like IPv4, its a convention. Your boundary router is supposed to not route outbound packets in these address ranges. Nobody else will route them either.
It should be safe to play with IPv6 using the site local address range.

The worst that can happen is that your ISP asks you not to sent them any site local packets. :)


From all of the reading I've been doing, including your stuff, I was coming to that conclusion. I think I'm going to install rdadv on my server and give it a site-local prefix, then see what that starts looking like on my network. Hopefully then the "neighborhood" commands will show the whole neighborhood, and not just the one system that I ssh'ed to with the ipv6 address. Last night I took a closer look at my phone and saw that it had a link-local ipv6 address as well as the ipv4 one.

Until I have the firewall situation in control I'm not turning on any ipv6 at my router.
_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
szatox
Advocate
Advocate


Joined: 27 Aug 2013
Posts: 2517

PostPosted: Tue Jan 24, 2023 7:29 pm    Post subject: Reply with quote

Do you even need firewall on router when using local addresses?
I mean, nobody will be able to call your machine through NAT anyway unless you explicitly redirect a port, right?
And if you set up an actual server, with a routable address, you should absolutely configure a firewall directly on that machine anyway, making a firewall on your router redundant.
Back to top
View user's profile Send private message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3475

PostPosted: Wed Jan 25, 2023 9:55 pm    Post subject: Reply with quote

szatox wrote:
Do you even need firewall on router when using local addresses?
I mean, nobody will be able to call your machine through NAT anyway unless you explicitly redirect a port, right?
And if you set up an actual server, with a routable address, you should absolutely configure a firewall directly on that machine anyway, making a firewall on your router redundant.


This is IPV6 - everything routes, that's a feature. My current plan is to enable my LAN for IPV6 but leave it turned off at the router. In the long term I'm either going to find a router that actually firewalls IPV6 or I'm going to dual-home my server, use it to route to my LAN, and write my own firewall for it. Really, I can just block all incoming STATE=NEW packets on IPV6 because at the moment I never plan to do any services that way. I have one incoming port for OpenVPN and that's IPV4 for the foreseeable future.
_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
szatox
Advocate
Advocate


Joined: 27 Aug 2013
Posts: 2517

PostPosted: Wed Jan 25, 2023 10:46 pm    Post subject: Reply with quote

Quote:
This is IPV6 - everything routes, that's a feature
Only if you actually use the global prefix assigned by ISP within your LAN.
You can still use link-local instead though. Without even using any daemons, since it autoconfigures on all devices, and your router might even respond to calls directed at ff02::2

This said, if you go with global ipv6 prefix, just configure the firewall on your machine. Router's job is to let packets find their destinations, not to keep them out.
Mixing those 2 roles doesn't seem fail-safe.
Back to top
View user's profile Send private message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3475

PostPosted: Fri Jan 27, 2023 12:44 am    Post subject: Reply with quote

szatox wrote:
Quote:
This is IPV6 - everything routes, that's a feature
Only if you actually use the global prefix assigned by ISP within your LAN.
You can still use link-local instead though. Without even using any daemons, since it autoconfigures on all devices, and your router might even respond to calls directed at ff02::2

This said, if you go with global ipv6 prefix, just configure the firewall on your machine. Router's job is to let packets find their destinations, not to keep them out.
Mixing those 2 roles doesn't seem fail-safe.


From what I can see neighborhood discovery doesn't work correctly with link-local. I knew two machines on my network were IPV6-ready, yet the discover-neighbor command returned nothing. Then I did an ssh by IPV6 IP, which worked, and after that it showed as a neighbor. I was hoping to discover other IPV6-ready stuff on my network, some of the commercial things that I've bought. I've since looked and see that my Android phone is IV6-ready when on wifi, for instance.

I want a firewall somewhere in the route because I can firewall machines I administer, but I don't administer everything. I'm light on the IOT gear, but for instance my printer, the phones, the video capture device, my work laptop. (I haven't checked it, yet.)
_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
szatox
Advocate
Advocate


Joined: 27 Aug 2013
Posts: 2517

PostPosted: Fri Jan 27, 2023 3:18 am    Post subject: Reply with quote

Huh, that's weird.
My rpi replies to ping6 ff02::1 on both interfaces, directly attached ethernet, and over wifi going through a SOHO router, and it uses link-local addresses.
AFAIR the router itself is older than ipv6, so no wonder it does not respond itself.

Perhaps there is something else wrong with your setup. Say, wired interface has higher priority and multicasts will be sent there instead of wifi whenever its flagged UP and LOWER_UP.
Also, link-local unicast does not know which network device it should use, so you often must explicitly name the interface.
You've got yourself quite a complicated situation there. I wonder what the actual problem is, it's not supposed to behave they way you report it. BTW, can avahi discover stuff on your network? It might at least provide some information...
I would still try to put IOT things on link-local, I suppose they are internal-use-only and you're just cutting costs by putting them on the same LAN as everything else.
Back to top
View user's profile Send private message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3475

PostPosted: Sat Jan 28, 2023 12:57 am    Post subject: Reply with quote

szatox wrote:
Huh, that's weird.
My rpi replies to ping6 ff02::1 on both interfaces, directly attached ethernet, and over wifi going through a SOHO router, and it uses link-local addresses.
AFAIR the router itself is older than ipv6, so no wonder it does not respond itself.

Perhaps there is something else wrong with your setup. Say, wired interface has higher priority and multicasts will be sent there instead of wifi whenever its flagged UP and LOWER_UP.
Also, link-local unicast does not know which network device it should use, so you often must explicitly name the interface.
You've got yourself quite a complicated situation there. I wonder what the actual problem is, it's not supposed to behave they way you report it. BTW, can avahi discover stuff on your network? It might at least provide some information...
I would still try to put IOT things on link-local, I suppose they are internal-use-only and you're just cutting costs by putting them on the same LAN as everything else.


I'll be the first to admit that I don't know what I'm doing, but at some pace I'm trying to learn. When I tried "neighborhood discovery" before I was using one of the "ip" subcommands, which forgotten now. I just tried your ping6 command and got some surprises and fiddled around a bit more. When I do "ping6 ff02::1 -c 2" I get six lines out, with five different fe80 addresses - the sixth is a repeat of the fifth and has icmp_seq=2, which probably means that's how it figured out that it was time to quit. Each address had "%" and the name of my ethernet device at the end, so I presume that means it got to that address using my ethernet card - not that my card has 5 aliases that are responding to the ping. Actually this rather surprises me. I know I have two IPV6-ready computers and presumably the two phones. I'm not sure what the fifth device is, though I'm guessing that it's my work laptop which is plugged in and turned on at the moment. I'll check it after posting this. By the way, the two computers and work laptop are wired, the phones are wifi.
_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 51923
Location: 56N 3W

PostPosted: Sat Jan 28, 2023 10:03 am    Post subject: Reply with quote

depontius,

Being old, cynical and paranoid, I've always had trusted and untrusted devices on their own subnets on their own wires.
Until recently, that split nicely into wired and wifi. That continued with IPv6, so they have their own public IPv6 /64s

Trusted == Gentoo
Untrusted == Android, Windows, TVs and Blue ray.

The amount of outgoing junk from Android that my firewall drops, trying to establish its own VPN with Google ...
My work Windows laptop does the same thing with Microsoft but if I drop that, some things don't work.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3475

PostPosted: Sat Jan 28, 2023 12:06 pm    Post subject: Reply with quote

NeddySeagoon wrote:
depontius,

Being old, cynical and paranoid, I've always had trusted and untrusted devices on their own subnets on their own wires.
Until recently, that split nicely into wired and wifi. That continued with IPv6, so they have their own public IPv6 /64s

Trusted == Gentoo
Untrusted == Android, Windows, TVs and Blue ray.

The amount of outgoing junk from Android that my firewall drops, trying to establish its own VPN with Google ...
My work Windows laptop does the same thing with Microsoft but if I drop that, some things don't work.


Getting there is one of my goals, maybe this year.
_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
szatox
Advocate
Advocate


Joined: 27 Aug 2013
Posts: 2517

PostPosted: Sun Jan 29, 2023 3:37 am    Post subject: Reply with quote

I guess that ip command was ip neigh
I think it only shows neighbors you already talked to. Not sure, I haven't looked too deep into this one.

Pinging a multicast address on the other hand effectively requests your neighbors to introduce themselves. Chances are ip n will report more entries afterwards.
And yes, % specifies the interface. And some programs will even accept an IP with %if appended and will force the outgoing traffic via the explicitly named interface.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum