Hacker News Reader

Comment by zAy0LfpBZLC8mAC | Hacker News Reader

> I've found vultr.com to have solid IPv6. They give you a true /64

How is that solid IPv6? You can't even trivially subnet it! Sure, it's marginally better than the 16 address madness of other hosters, but it's still terrible. Especially so, given that you need an NDP proxy hack ... WTF?

View on HN

Does anyone actually give you a real /64?

The NDP proxy hack is easy: https://github.com/DanielAdolfsson/ndppd

Yes, Linode will route /64 and /48 subnets to you. They'll even give you several of each if you ask, and the subnets can be failed over to other nodes for high availability.

Linode are the only ones I have seen do IPv6 correctly. I wish they also knew how to do security correctly; unfortunately I can no longer recommend them in good conscience.

At vultr you have the option to "bring your own ip", as they call it. This really just allows you to use BGP to announce whatever prefixes you own. You could have a /40 behind each of your servers if you wanted to.

Which is great to have as an option--but otherwise, it's a stupid idea. The whole point of having such a large address space with IPv6 is to enable aggregation of routes. So, every vultr datacenter should have at most one route in the global IPv6 routing table, for a huge prefix that all their customers are aggregated under. Having customers announce their own provider independent address space might well have its legitimate uses, but it adds additional routing table entries to the global routing table, which is why it's a terrible idea to do this instead of just assigning customers /48s from their provider aggregated space.

Yes, good providers give you a real /48, routed to a link-local address, so it's all under your very own control, trivial to create subnets, tunnels, whatever, without any need for any hacks whatsoever.

As for the NDP proxy hack being easy: Well, sure, there are more difficult things (and yes, I once wrote an NDP proxy deamon myself, which wasn't particularly difficult either). But it still adds complexity, for no real reason. The question isn't whether you can work around this deficiency. The question is: What is the point of this deficiency in the first place?

Plus, you still only have one /64, which is just braindead.

And, with a proxy NDP setup, you are vulnerable to NDP cache DoS: Your upstream router needs to do NDP resolution for each individual address (instead of just the one router address that your prefix is routed to), which enterprising attackers can DoS by simply sending packets to a few thousand to million of your addresses which then will overload the NDP cache of that router, leading to your machine(s) potentially being unreachable.

Reply on news.ycombinator.com