Comments on: IPv6 at home – a guide to getting started

By: sgroarke

sgroarke — Thu, 08 Dec 2011 06:30:40 +0000

Fixed. Thanks!!

By: Andrew J. Leer

Andrew J. Leer — Thu, 08 Dec 2011 02:38:25 +0000

Thanks for writing this tutorial! I am enjoying it greatly.

There’s a spelling mistake (no big deal I’m sure) but if you want to correct it I’m letting you know in the “DHCP client I get, but what’s with DHCP server versus radvd?” it reads “since it dos not allocate any” instead of “since it does not allocate any”

You can delete my comment if you like, I just wanted to let you know about it.

By: Setting up a IPv6 Gateway on Hurricane Electric using Ubuntu 10.04.2 | The Internet made me do it!

Mon, 29 Aug 2011 11:16:12 +0000

[...] Hurricane Electric – Tunnel Broker Easy Config for Linux Router Building a IPv6 Gateway anyweb sample configurations IPv6 – Ubuntu Wiki Ubuntu UFW Firewall Private Class B Network Address Neighbor Discovery for IP Version 6 Radvd config manpage Enabling IPv6 Privacy Extensions on Ubuntu Linux IPv6 at home – A guide to getting started [...]

By: sgroarke

sgroarke — Sat, 04 Dec 2010 07:58:27 +0000

Thanks for those thoughts. Absolutely good points all. However I think my omission is actually that I have not defined just *what* it is that this IPv6 box/firewall/router/VPN/younameit is actually ultimately going to be used for!!! Thus far, as this incremental project has progressed, all my IPv6 has terminated (in various manners) on the firewall box itself. (Note to purists: Yes, the firewall should NOT be the same device as the router/server/younnameit box… but it usually is!) When (if? No when, it will happen eventually…) I have this firewall actually routing traffic to/from the internal networks, then such matters as mentioned here need closer attention.

The RFC link is good for those in to RFCs…. But for those who have led an unblemished life, free from the taint of data comms RFCs, I advise caution. They drive you mad if treated without care.

Anyway, good information. One day when I write further articles about my IPv6 project, I’ll be sure to refer folks back to your comment here!! Thanks!

By: J. Grizzard

J. Grizzard — Fri, 03 Dec 2010 22:34:26 +0000

You imply above that the only reason you allow ICMPv6 through your firewall is so that pings will work for testing (and thus could be removed after testing). This is a very bad thing to teach people, because it has the potential to be destructive in the IPv6 world. You need to let several different types of ICMPv6 messages through, for things to work correctly.

In particular, type 2 datagrams (“packet too big”) are used for path MTU discovery. IPv6 does not support packet fragmentation — if your MTU is too big for something in your path, that traffic will get dropped, and the sending system will never know that it needs to back off on packet sizes. This type of problem can be *very* difficult to debug… it appears as a problem with an upstream connection, even though the problem is actually right there on your firewall.

Some type 1, type 3, and type 4 codes should also be allowed, no matter what.

RFC 4890 (http://www.ietf.org/rfc/rfc4890.txt) has a more thorough discussion of ICMPv6 filtering requirements and recommendations.

By: sgroarke

sgroarke — Tue, 23 Mar 2010 14:02:36 +0000

I’ve rather glossed over the whole question of DNS… Since we’re choosing to not implement IPv6 DHCP server, how do clients machine pick up the DNS? Sure, they get the address prefix from RADVD, but what about anything else?

In the first instance all my client will be dual-stack IPv4 & IPv6. They already have the IPv4 DNS known and active so we will let them continue to use that. Of course if IPv4 does one day disappear, and we run as single-stack IPv6, this would need to be addressed.

By: sgroarke

sgroarke — Fri, 05 Mar 2010 14:09:02 +0000

Once IPv6 is set up and working, prior to us becoming a fully-fledged router we need to enable forwarding. This is covered, along with the problems it then brings, in this post here.

By: sgroarke

sgroarke — Thu, 25 Feb 2010 13:05:48 +0000

Here’s another article where I tackle the issue of IPv6 firewall logging: http://www.ipsidixit.net/2010/02/25/231/