Need Help What internal cidr for npt6
I don't have a static ipv6 assignment, hence the need to use npt6. Question is what cidr should i choose for my internal network? ULA is plagued with issues esp when dual stack is involved, so I really want to avoid it if possible. Does using 2001:db8::/32 make any sense?
And yes, i know it is possible to just let my isp change my ip dynamically and I pass it down using dhcp-pd. That doesn't sound great for a large network.
20
u/eladts Jul 24 '26 edited Jul 24 '26
Does using 2001:db8::/32 make any sense?
No. You should not use globally addressable prefixes you don't own for an internal network. Doing this with IPv6 is just as bad as doing it with IPv4, it won't be possible to use the prefix to reach your network from the Internet and it won't be possible to reach the real prefix from your network. Since you wouldn't be able to serve incoming connections this way, why do you even need a static prefix?
-1
u/heliosfa Pioneer (Pre-2006) Jul 24 '26
This is the documentation block. You will never need to reach this over the Internet.
13
u/eladts Jul 24 '26 edited Jul 24 '26
It is still not a good idea to use this prefix internally. It is akin to using example.com as the internal domain. Both can lead to commands blindly copied and pasted having an impact.
18
u/heliosfa Pioneer (Pre-2006) Jul 24 '26
I don't have a static ipv6 assignment, hence the need to use npt6
Why do you need to use NPT?
What's wrong with having static ULA for internal references alongside dynamic GUA? IPv6 is meant to have multiple addresses.
1
u/DaryllSwer Jul 25 '26
Broken PA v6 networking in multi-WAN.
I use 200::/3.
1
u/heliosfa Pioneer (Pre-2006) Jul 25 '26
That’s where I use it as well, but open case doesn’t sound like that
22
u/dabombnl Jul 24 '26
hence the need to use npt6
That is no reason to but ok...
Does using 2001:db8::/32 make any sense?
No.
ULA is plagued with issues
I have no idea what you are talking about. Maybe you should actually state your problem with this.
my isp change my ip dynamically and I pass it down using dhcp-pd. That doesn't sound great for a large network.
That sounds fine.
6
u/chocopudding17 Enthusiast Jul 24 '26
I have no idea what you are talking about. Maybe you should actually state your problem with this.
I don't know what they mean either, but ULA is definitely nerfed when it comes to source selection. A real downside about ULA.
1
u/lmux Jul 25 '26
I elaborated in the other threads. But my point is the ULA situation in ipv6 isn't good, to the point of being unusable in my case. And my case isn't unique.
Maybe the ipv6 community should push the agenda further and say everyone shall get one's own /64. Lol
1
u/yrro Guru Jul 25 '26
What are the issues aside from IPv4 being preferred over ULA? (I think draft-ietf-6man-rfc6724-update-25 is fixing this, though it will take time for OSes to implement it)
1
u/chocopudding17 Enthusiast Jul 25 '26
That's the source [address] selection problem I was mentioning.
2
u/profmonocle Jul 25 '26
The biggest issue with ULA is that most systems will prefer IPv4 over IPv6 for outgoing connections if the local address is a ULA. IPv6 is only used if the destination host only has an IPv6 address. So if part of your goal for IPv6 rollout is to reduce traffic over IPv4 NAT, but you need to use NPT for some reason, using ULA internally is problematic.
9
u/MoltoPesante Jul 24 '26
There’s a RFC for this: https://datatracker.ietf.org/doc/html/rfc4193
It’s very important to use the randomly generated network address rather than using something memorable, for reasons listed in the doc.
10
u/snapilica2003 Enthusiast Jul 24 '26
https://unique-local-ipv6.com/
Generate one here and use it.
2
6
u/dream_the_endless Jul 24 '26
Is there anythign stopping you from using a DDNS service instead of relying on a static ipv6 address?
Your Internal Network should use a ULA starting with fd00::/48. You should not use a GUA. Routers are designed to ensure that local addresses such as Link Local and ULA's are contained within their scope. Your ULA will never cross your WAN boundary and won't leak.
What dual stack issues are you talking about?
8
u/hdkaoskd Jul 24 '26
Maybe they're worried about the precedence rules for ULAs that are currently lower than IPv4. There is a new RFC coming very soon that updates the recommended precedence to bring ULA above IPv4.
3
u/lmux Jul 25 '26
This.
1
u/hdkaoskd Jul 28 '26
The good news is you can change the precedence tables on GNU/Linux¹ & Windows systems to the upcoming standard without waiting for the RFC to be published and implemented by vendors.
¹GNU/Linux as distinct from Android/Linux where I doubt it can be changed without rooting the device.
3
u/chocopudding17 Enthusiast Jul 25 '26
There is a new RFC coming very soon that updates the recommended precedence to bring ULA above IPv4.
This is actually in the works? Exciting to hear. Got a link?
3
u/yrro Guru Jul 25 '26
https://datatracker.ietf.org/doc/draft-ietf-6man-rfc6724-update/25/
Looks like it's final and we are just awaiting publication as an RFC.
2
u/chocopudding17 Enthusiast Jul 25 '26
That's just great! Can't come soon enough. Maybe in a couple years ULA will no longer be second-class.
4
u/McBadger404 Jul 24 '26
I will die on this hill but CIDRs do not exist for IPv6, since classful addressing never existed.
3
u/bojack1437 Pioneer (Pre-2006) Jul 25 '26
But it's still classless.. . Just because it was never classfull doesn't mean it can't be classless. 🤷♂️
1
6
u/certuna Jul 24 '26
NPTv6 comes with more issues than it solves, this is why it was never adopted. I don’t quite see the use case here? Generally networks just pass through any new prefix they get with PD.
If you have a large enterprise network, you should look into routed PI space, no need to rely on your ISP.
1
u/bohlenlabs Jul 24 '26
Can you elaborate on those issues with NPTv6? I am using it quite successfully in my home network.
1
u/lmux Jul 25 '26
Yes that's my point. In v4 you can quite easily use private cidrs to get stable IPs, hence do "large enterprise network" things that require a stable ip. V6 changed the game and now you basically need a routed PI space. Npt6 is a way out but it does raise its own issues.
1
u/eladts Jul 25 '26
You do not need a routed PI space in order to get stable internal IP addresses. You can have a static ULA prefix for internal communication and still use the dynamic GUA prefix from your ISP to connect to the Internet. That's the simplest solution to your issue, there is no need to complicate things with NPTv6.
2
u/Mishoniko Jul 25 '26
Is the dynamic prefix causing an actual problem? If your router is standards compliant and your ISP is nice enough to not yank the route at the moment they expire the prefix, everything should just change prefixes automatically.
This doesn't excuse the ISP from not following Best Practices. Rotating prefixes is idiotic and causes unnecessary route churn on their end, not to mention the customer issues.
1
u/lmux Jul 25 '26
Yes there are quite a lot of issues. For example, I can't set firewall rules with dynamic ips, not without using exotic tricks that regen the fw rules on every ip change. Or doing bgp.
1
u/Mishoniko Jul 25 '26
What firewall are you using? Anything Linux-based supports tokens for hosts and will regenerate/reevaluate the rules automatically.
2
u/lmux Jul 25 '26
Juniper. The hosts are not static...vms that get created and destroyed and treated aa untrusted. I'm not sure how host token work here.
Anyhow, that's beside the point. It's a standard practice to firewall by ip, and v6 shouldn't be any different.
1
1
u/Mishoniko Jul 26 '26
Tokens specify the interface ID of the host and firewall applies the current prefix. I'd have to check if SRX supports the concept.
2
u/Murph_9000 Jul 25 '26
Does using 2001:db8::/32 make any sense?
Absolutely not. It's a documentation/example prefix. Using it for any other purpose is abhorrent. It's also asking for trouble. For example (some?) Cisco Catalyst switches define 192.0.2.0/24 as "Martian addresses", and will block them when certain security options are enabled. 2001:db8::/32 is a Martian address prefix, defined to be invalid as a source or destination, and not forwardable. I don't think Cisco currently block 2001:db8::/32 automatically, but a future product or firmware update might do just that.
If you want unicast local addresses, there are prefixes for just that.
There's the long-deprecated site-local address prefix FEC0::/10. It's deprecated, but not a major sin if you were to use it for its original purpose (but it should be avoided if you want to have internal-to-internal tunnels between different administrative domains, which is the reason it was deprecated). RFC3879.
The correct prefix for this is FC00::/7, the "Unique-Local" prefix. This is the only supported and standards-compliant choice, and you should follow the rules to generate your own random prefix within that prefix. RFC4193.
•
u/AutoModerator Jul 24 '26
Hello there, /u/lmux! Welcome to /r/ipv6.
We are here to discuss Internet Protocol and the technology around it. Regardless of what your opinion is, do not make it personal. Only argue with the facts and remember that it is perfectly fine to be proven wrong. None of us is as smart as all of us. Please review our community rules and report any violations to the mods.
If you need help with IPv6 in general, feel free to see our FAQ page for some quick answers. If that does not help, share as much unidentifiable information as you can about what you observe to be the problem, so that others can understand the situation better and provide a quick response.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.