All consumer and enterprise equipment made in the last 10+ years natively support IPv6.
I object to this statement. You can buy name brand routers today that don’t implement it properly. Sure, they route packets, but they have broken stateless auto configuration or don’t respect DHCPv6 options correctly, and the situation is made worse because you don’t know how your ISP implements IPv6 until you try it.
God help you if you need a firewall where you can open ports on v6. Three years ago I bought one that doesn’t even properly firewall IPv6.
I tested a top-of-the-line Netgear router to find that it doesn’t support opening ports and once again doesn’t correctly support forwarded IP DHCPv6, which even if that works correctly, your Android clients can’t use it 🫠 Decades later there’s no consensus on how it should function on every device. This is a severe problem when you are a standard.
The state of IPv6 on consumer hardware is absolute garbage. You have to guess how your ISP implements it if at all, and even then you’re at the mercy of your limited implementation. If you’re lucky it just works with your ISP router. If you’re not, it’s a PITA.
You shouldn’t be forwarding anything - lan devices are directly accessible from the internet with ipv6. The router’s job now is to firewall inbound ipv6 packets. You should be able to simply open the inbound port for that device in particular.
Right, that’s how it should work. Unfortunately that’s not how it actually works most of the time in consumer.
Many devices don’t provide an option in the UI to open an inbound port on IPv6. For example, the latest and most expensive Linksys gaming router blocks all inbound connections and there are no options for different behavior. It doesn’t support opening any ports for v6.
The most recent TP link device I tested for my dad doesn’t even have a firewall. If you know the global IP, you can connect to any port you want.
And that’s why I abandoned cheap consumer routers many years ago… closest devices to implement ipv6 port management firewalling even half good was/is the ASUS devices. I got fed up and went pfsense and/or unifi one day and never looked back.
UDM handles ipv6 real good, and pfsense can even get /64 subs from an ATT router for all its lan interfaces.
The problem is mainly that IPv4 port forwarding is network address translation, but on IPv6 it’s instead IP forwarding with a firewall rule.
The latter is conceptually simpler, but it’s a different mechanism and one that most home routers don’t bother to implement. This is quite ironic because IPv6 was intended to restore end to end connectivity principles.
Don’t get me wrong; I’m quite happy with the standard. They are very few good implementations of that standard, and given the momentum of its predecessor, implementers just don’t care.
I absolutely hate how dependent we’ve gotten to IPv4. To the point that Amazon is charging almost $4 a month per IP. It used to be free. These assholes are buying IPv4 addresses so fast that they are literally driving up the price.
Is there a resource that you can recommend on learning IPv6 based on my knowledge on IPv4? A lot of resources I’ve seen are way over engineered for my feeble brain.
Like I know what IP addresses are and what port numbers are. I don’t understand the difference between how IPv6 addresses are assigned (both locally and generally speaking) and what makes it different from IPv4.
It absolutely can be DHCP. There’s two main ways to do it: stateless auto configuration, and DHCP. Super briefly, you can assign IP addresses the same way you used to if you want, or you can let devices pick their own.
I’m afraid I can’t recommend a great resource, but I really like the Wikipedia article because it’s very precise in its terminology. I appreciate that with learning a new subject. I’m not even that precise here. For example, I use the term IP forwarding more liberally than what it actually means.
This is why I use PFSense and Hurricane Electric as a v6 tunnelbroker. I have working functional IPv6 with SLAAC and DHCPv6 and full Routing Advertisements on my LAN running side-by-side so that no matter which the device implements how poorly; it gets an IPv6 address and it works and is protected by the firewall.
I really like stateless, but it bugs me that the router has to snoop on traffic if you want a list of devices. The good ones will actually do this, but most are blind to how your network is being used with IPv6.
And it really bothers me that Android just refuses to support DHCPv6 in any capacity. Seems like a weird hill to die on. There are too many legitimate use cases.
I run both because of this; and because SLAAC enables features in Desktop OSes that offer some level of additional privacy.
For example; Windows can do “Temporary IPv6 Addressing” that it will hand out to various applications and browsers. That IPv6 address rotates on a periodic basis; once every 24 hours by default; and can be configured to behave differently depending on your needs via registry keys.
This could for example, allow you to quickly spin up a small application server for something; like a gaming session; and let you use/bind that IPv6 address for it. Once the application stops using it and the time period has elapsed; Windows drops the IP address and statelessly configures itself a new one.
I also like the privacy extensions, but how often does your prefix even change? Most places I’ve seen you get a /64 announced and it basically never changes – so somewhat elementary to “break through” that regardless.
A /64 is more than enough though to prevent most casual attempts at entry; and does force more work / enumeration to be done to break into a network and do damage with. I’m not saying the privacy extensions are the greatest; but they do work to slightly increase the difficulty of tracking and exploitation.
With a /48 or even a /56; I can subdivide things and hand out several /64s to each device too; which would shake up things if tracking expects a /64 explicitly.
I actually use /55s to cordon off blocks inside the /48 that aren’t used too. So dialing a random prefix won’t help. You’d be surprised how often I get intrusive portsweeps trying to enumerate my /64s this way…and it doesn’t work because I’m not subnetting on any standard behavior.
Comcast has finally gotten around to giving hosts inside the firewall publicly routable IPv6 addresses, but port forwarding (which, by the way, can only be done through Xfinity’s website or mobile app which then connect to and configure the router through the ISP interface – if you go to the port forward configuration in the router’s webui, all you’ll see is a message that it’s now “easier than ever” to configure port forwards) can only happen on IPv4. Want to open a hole in the IPv6 firewall? Well that’s just too fucken bad.
Funny, I have an ancient DOCSIS modem from a company that went bankrupt ages ago which supports all these features flawlessly. Only thing it’s missing is DNS options, it’s hardcoded to use the ISPs DNS. Oh well.
I object to this statement. You can buy name brand routers today that don’t implement it properly. Sure, they route packets, but they have broken stateless auto configuration or don’t respect DHCPv6 options correctly, and the situation is made worse because you don’t know how your ISP implements IPv6 until you try it.
God help you if you need a firewall where you can open ports on v6. Three years ago I bought one that doesn’t even properly firewall IPv6.
I tested a top-of-the-line Netgear router to find that it doesn’t support opening ports and once again doesn’t correctly support forwarded IP DHCPv6, which even if that works correctly, your Android clients can’t use it 🫠 Decades later there’s no consensus on how it should function on every device. This is a severe problem when you are a standard.
The state of IPv6 on consumer hardware is absolute garbage. You have to guess how your ISP implements it if at all, and even then you’re at the mercy of your limited implementation. If you’re lucky it just works with your ISP router. If you’re not, it’s a PITA.
EDITs: spell corrections and clarification.
You shouldn’t be forwarding anything - lan devices are directly accessible from the internet with ipv6. The router’s job now is to firewall inbound ipv6 packets. You should be able to simply open the inbound port for that device in particular.
Right, that’s how it should work. Unfortunately that’s not how it actually works most of the time in consumer.
Many devices don’t provide an option in the UI to open an inbound port on IPv6. For example, the latest and most expensive Linksys gaming router blocks all inbound connections and there are no options for different behavior. It doesn’t support opening any ports for v6.
The most recent TP link device I tested for my dad doesn’t even have a firewall. If you know the global IP, you can connect to any port you want.
And that’s why I abandoned cheap consumer routers many years ago… closest devices to implement ipv6 port management firewalling even half good was/is the ASUS devices. I got fed up and went pfsense and/or unifi one day and never looked back.
UDM handles ipv6 real good, and pfsense can even get /64 subs from an ATT router for all its lan interfaces.
I’ve never tried ASUS or UDM. I might have to give that a go. Alas, I can only speak on the selection of what I have tried in the recent past.
Omg…I thought I was doing it wrong. I was trying to map ports on my router and it just wouldn’t do it properly.
Networking is not my strong suit so I assumed I was being an idiot and reverted back to IPv4.
IPv6 does not do NAT - you allow the ports for a device instead in the firewall.
The problem is mainly that IPv4 port forwarding is network address translation, but on IPv6 it’s instead IP forwarding with a firewall rule.
The latter is conceptually simpler, but it’s a different mechanism and one that most home routers don’t bother to implement. This is quite ironic because IPv6 was intended to restore end to end connectivity principles.
Don’t get me wrong; I’m quite happy with the standard. They are very few good implementations of that standard, and given the momentum of its predecessor, implementers just don’t care.
I absolutely hate how dependent we’ve gotten to IPv4. To the point that Amazon is charging almost $4 a month per IP. It used to be free. These assholes are buying IPv4 addresses so fast that they are literally driving up the price.
Is there a resource that you can recommend on learning IPv6 based on my knowledge on IPv4? A lot of resources I’ve seen are way over engineered for my feeble brain.
Like I know what IP addresses are and what port numbers are. I don’t understand the difference between how IPv6 addresses are assigned (both locally and generally speaking) and what makes it different from IPv4.
I know it’s not DHCP.
Edit: This post provides a link to a great summary for those who know IPv4 but need to learn IPv6.
It absolutely can be DHCP. There’s two main ways to do it: stateless auto configuration, and DHCP. Super briefly, you can assign IP addresses the same way you used to if you want, or you can let devices pick their own.
I’m afraid I can’t recommend a great resource, but I really like the Wikipedia article because it’s very precise in its terminology. I appreciate that with learning a new subject. I’m not even that precise here. For example, I use the term IP forwarding more liberally than what it actually means.
This is why I use PFSense and Hurricane Electric as a v6 tunnelbroker. I have working functional IPv6 with SLAAC and DHCPv6 and full Routing Advertisements on my LAN running side-by-side so that no matter which the device implements how poorly; it gets an IPv6 address and it works and is protected by the firewall.
That sounds awesome.
I really like stateless, but it bugs me that the router has to snoop on traffic if you want a list of devices. The good ones will actually do this, but most are blind to how your network is being used with IPv6.
And it really bothers me that Android just refuses to support DHCPv6 in any capacity. Seems like a weird hill to die on. There are too many legitimate use cases.
It is a weird hill to die on for sure.
I run both because of this; and because SLAAC enables features in Desktop OSes that offer some level of additional privacy.
For example; Windows can do “Temporary IPv6 Addressing” that it will hand out to various applications and browsers. That IPv6 address rotates on a periodic basis; once every 24 hours by default; and can be configured to behave differently depending on your needs via registry keys.
This could for example, allow you to quickly spin up a small application server for something; like a gaming session; and let you use/bind that IPv6 address for it. Once the application stops using it and the time period has elapsed; Windows drops the IP address and statelessly configures itself a new one.
I also like the privacy extensions, but how often does your prefix even change? Most places I’ve seen you get a /64 announced and it basically never changes – so somewhat elementary to “break through” that regardless.
I have a /48 that I can basically roll through.
A /64 is more than enough though to prevent most casual attempts at entry; and does force more work / enumeration to be done to break into a network and do damage with. I’m not saying the privacy extensions are the greatest; but they do work to slightly increase the difficulty of tracking and exploitation.
With a /48 or even a /56; I can subdivide things and hand out several /64s to each device too; which would shake up things if tracking expects a /64 explicitly.
I actually use /55s to cordon off blocks inside the /48 that aren’t used too. So dialing a random prefix won’t help. You’d be surprised how often I get intrusive portsweeps trying to enumerate my /64s this way…and it doesn’t work because I’m not subnetting on any standard behavior.
This. Ipv6 on all house routers are for scrolling facebook only. Want to do anything more? Switch back to ipv4
Comcast has finally gotten around to giving hosts inside the firewall publicly routable IPv6 addresses, but port forwarding (which, by the way, can only be done through Xfinity’s website or mobile app which then connect to and configure the router through the ISP interface – if you go to the port forward configuration in the router’s webui, all you’ll see is a message that it’s now “easier than ever” to configure port forwards) can only happen on IPv4. Want to open a hole in the IPv6 firewall? Well that’s just too fucken bad.
Funny, I have an ancient DOCSIS modem from a company that went bankrupt ages ago which supports all these features flawlessly. Only thing it’s missing is DNS options, it’s hardcoded to use the ISPs DNS. Oh well.
Just use openwrt
Sadly it’s not an option for example you want WiFi 6. A good chunk of really awesome hardware doesn’t support it.
Of course, it’s always possible to use bridging and multiple devices. That’s what I have now.
Lastly, the original statement supposed that all recent hardware supports IPv6 by default. OpenWRT doesn’t typically fit that description.