Recent posts

I can't ping tserv1.par2 over IPv6 from three different ISPs. Traceroutes stop at

100ge0-34.core2.bru1.he.net (184.104.194.110)

On https://tunnelbroker.net/status.php the Paris server is called tserv10.par1 and is shown "up", is that the same one, or am I somehow on an old unlisted/deprecated server???

#27

Questions & Answers / [Solved] Re: Native IPv6 confi...

Last post by cshilton - August 23, 2024, 05:53:21 AM

When I looked at this further, I discovered that I have my OpenBSD network stack to do IPv6 autoconf without an RA provider on the network. The ULA was self-generated.

Regarding the other part of the question: Should I use a ULA for local services like DNS resolution? A few people do this. It mainly involves assigning a ULA on the interface where you source your router advertisements and then statically assigning an IP address within that ULA to provide your service.

#28

Questions & Answers / Native IPv6 configuration ques...

Last post by cshilton - August 22, 2024, 09:34:07 AM

So, I figure that this may be forum for this question. About a year ago, Verizon rolled out native IPv6 to me. I'm still using my HE tunnel because I'm not clear on the some of the implications.

Question: With Verizon's native IPv6 I'm getting 3 meaningful IP addresses on my interface, public - [2600:4040:xxxx:yyyy::host-part], and ULA - [fdww:xxxx:yyyy:zzzz::host-part] and of course, an link-local [fe80::host-part] address. Is the function of the ULA assignment to run local services?

Question: Is it safe to run services on the link local address?

What I see is that native IPv6 changes the way I get my IPv6 address. Verizon assigns me an address via dhcp-pd. That assignment is static the way a CATV cable modem gets a, for all intents, static IP. But I still need to assign known IP addresses to my DNS resolvers for example. With HE, this was [<he-prefix>::<static-host-part>] but with Verizon, the prefix can change. Being clear, is the dhcpcd program assigning me a ULA address so I can put my DNS resolver at a configured place?

-- Chris

#29

Questions & Answers / IPv6 Connectivity Issue

Last post by mauropc - August 17, 2024, 05:25:21 PM

I hope this message finds you well.
I am writing to report a connectivity issue with my IPv6 host, specifically the address 2001:470:d:xxx::y. It appears that there is a block on incoming connections to this host (only this host), others works fine, which is affecting my ability to use the services associated with it.

The host use web/mail server. ports 80,443, 110, 143, 20 and 21.

#30

Questions & Answers / Re: Possible IPv6 Routing Issu...

Last post by cshilton - August 15, 2024, 02:44:53 PM

The streaming services have a problem in general with the HE tunnelbroker service. Netflix was the first but others have followed. Other people have issues too because the freedom and the performance that makes the service great opens the doors for a technical person to abuse things.

Netflix:

Netflix's specific beef was that there was a person or company somewhere in Europe who advertised a "service" that got you the United States Netflix catalog from Europe. It wasn't a service, the entity was setting up HE tunnels to Europe that terminated on East Coast tunnelbroker servers. So the IP addresses that you got were in the US and originally, Netflix gave you the US catalog rather than the European one. Netflix retaliated by blocking all of 2001:470::/32 via a proxy warning rather than just emitting a TCP RST. Sigh...

Other streaming services:

So far as I can see, many other streaming services followed Netflix. This kindof sucks.

Other issues:

There are people in the world who abuse the Tunnelbroker service to harass both Google and Wikipedia. In the case of Google, we vacillate between an outright kick/ban of 2001:470::/32 and a forced CAPTCHA if our devices hit google over IPv6. In Wikipedia it turns into long kick/bans for editing Wikipedia pages. I haven't seen issues with browsing Wikipedia though.

Conclusion:

None of the options are good here. Outside of HE, the opinion seems to be that "dynamic IP's" ought to be "dynamic" meaning that they should change often even if they don't need to. This belief seems to be as stubborn as the "NAT provides security" argument that's also prevalent. Just in general, people don't seem to get IPv6 because it breaks the conception of network addressing which seems to be bound to the limitations that we see with IPv4. I can get native IPv6 on one of my connections and possibly soon both, my wife works out of Boston so we keep an apartment up there but we generally live in CT, but I'm still using HE tunnels but the IP addresses are static and that's really really useful, especially at the price that HE is charging.

So long as the service is structured the way it is and free, as in freedom from restrictions, you're gonna see this. I think that leaves your choices as: Don't use the service because asshats being asshats, random stuff is going to get broken at random times; Do use the service and employ a subset of the workarounds for the breakage.

The workarounds are basically:

Employ a domain based dns block list -- E.g. doing resolve AAAA queries for anything in *.google.com;
Employ a program that does the DNS resolution periodically and update your firewall so as to block by external IP address;
Enumerate your internal assets which shouldn't be using IPv6 and arrange to block outbound IPv6 on them.

As an example of the last issue, if you use SLAAC, you can't stop an AppleTV from getting and IPv6 address. It won't be able to get to Netflix if your IPv6 address comes from HE. You could put your AppleTV into a separate VLAN but to have them in a different broadcast domain than your iPhones and iPads is to nerf a lot of their capabilities.

At the end of the day, none of the solutions are great. For me, using HE is still better than figuring out where my moved to on FiOS when Verizon changes my prefix. Before people start, I get that Verizon changing my IPv6 address is a "me" issue. But the fact that people think that dynamic means stuff should changes makes it a little harder to find the correct DHCPv6 configuration to use on Verizon for an OpenBSD router.

Pages 1 2 3 4 5 ... 10