Setting up an IPv6 home network properly
Summary
James Bottomley describes the practical set-up of an IPv6 home network with prefix delegation, router advertisements, DNS and a stateful firewall. IPv6 uses 128-bit addresses. Link-local addresses usually start with fe80.
Ideas
- The provider delegates a publicly routable prefix to the router.
- Router advertisements distribute network prefixes and the default route to devices.
- SLAAC generates addresses without a central DHCPv6 address pool.
- A firewall filters incoming connections despite global addresses.
Insights
- Global addressability removes NAT, but not the need for a security policy.
- Running IPv6 requires understanding several addresses that are valid at the same time.
- Dual stack doubles diagnostic paths and possible misconfigurations.
Facts
- ICMPv6 takes over important functions for neighbour discovery and path determination.
Recommendations
- Allow necessary ICMPv6 instead of blocking it across the board.
- Document delegated prefixes, router advertisements and firewall rules together.
References
Links to the original source and the Web Archive open in a new tab.