Hacker News Reader

When exposing services to the internet it's even more PITA since each device needs a DynDNS client configured, whereas with IPv4 just the router needs one for my single public IP.

Presumably because you configured the forwarding on the router? I mean, that should still be possible, right? Set up a name for the routers IP, and have it forward the connections statically.

IPv6 on the LAN is quite a pita due to the massive "random" prefix, gone are the days of easy addresses like 10.0.0.12.

Or just use the hostname? Sometime a couple of years ago, local names just started working, sort of on their own. My Synology is nas.local, Linux boxes are reachable using their configured hostname, even my elderly printer shows up as vigor2.local.

> Set up a name for the routers IP, and have it forward the connections statically.

If you mean NAT, then what does that buy me over what I got? If you don't mean NAT then how would that work?

> Or just use the hostname?

Right, but that requires the DNS to register the host names, and for it to respond. Or since you mention .local I guess you mean mDNS, which requires a service to run on each device and seems to be hit and miss at least for me (I just tried, several of my devices do not respond).

If you mean NAT, then what does that buy me over what I got? If you don't mean NAT then how would that work?

Nothing. But you can just keep doing what you are doing now, even with IPv6. That's what I meant.

I just tried, several of my devices do not respond

Ok. Like I said, it Just Works for me.

> But you can just keep doing what you are doing now, even with IPv6.

Do you mean keep using IPv4 or use NAT with IPv6? If the former then well, so much for that IPv6 future. If you mean the latter, the whole point of IPv6 was death to NAT no?

The whole point of IPv6 was we ran out of IPv4. NAT was a kludge necessary because "we" didn't act fast enough on that fact.

> Or just use the hostname? Sometime a couple of years ago, local names just started working, sort of on their own.

That highly depends on what router you have. For mine, the actual suffix is Speedport_W_123V_2_34_000, which is complex and/or invalid enough that a lot of software refuses to resolve it.

> each device needs a DynDNS client configured

My home router does something even better out of the box: Every device that's hostname.local or hostname.my.router locally is also globally resolvable through hostname.myusername.routervendor.com.

This is basically DnyDNS at the router level, rather than the device level (which has many downsides as you describe), and it's been a game changer for my IPv6 home use.

pfsense (the router magicalhippo is using) also supports this. Its under Services > DHCP Server (and/or DHCPv6 Server) > Dynamic DNS

That seems to require a RFC 2136 compatible DNS server on the other end, yes? So my regular dyndns ain't gonna cut it I assume.

How did we end up in this world where regular DNS updates aren't considered to be "regular dyndns" :/

Not my area, but what I can say is that the DNS provider I've used for ages (Domeneshop) does not support RFC 2136.

So I guess I either have to switch (to who?) or I set up some alias and run my own bind (another service to admin, yay). Or am I missing something?

I run my own copy of bind, and use https://dns.he.net as a slave pulling the zones from it. As a result I can actually use all DNS features.

I find it super frustrating that most dynamic DNS providers use their own custom API rather than just using the update mechanism that's in the protocol itself. That said, if they support v6 then you can probably use them by installing their update client on each machine that you want a hostname for. It just won't integrate with pfsense.

it has nothing to do with IPv6 specifically but i mostly have a haproxy instance on every "edge" for public and private services. I also do TLS there. However, everything gets its own records in DNS too. I use dynamic updates from my DHCP server to a bind9 instance for that. This all works very well for IPv4 and IPv6 simultaneously... I admit its more complicated to set all of this up properly but maybe its just the way it is ;)

Interesting approach, thanks.

There is a huge hole in functionality of IPv6 in most common networking equipment. I have a Mikrotik and the IPv6 functionality is signifiantly worse than the IPv4 one:

- There's no caching DNS and I can't set static DNS entries for IPv6

- There's no way to use DHCPv6 to give out addresses.

- Because of lack of DHCPv6, there's not way to give out static addresses to devices on LAN and manage them centrally.

- Because of lack of DHCPv6 and static addressing, it's really annoying to configure firewall to allow outside access to services on LAN devices (on IPv4 you either have static entries or NAT-PMP).

- There's no fasttrack functionality so IPv6 traffic will max out CPU and prevent me from fully using my Gbit fiber line.

- There's no UI way of announcing DNS to clients via DHCPv6 - you can set some option amanually but it's far from setting a nice UI entry like for DNS.

And yes, those are all holes in my routers Firmware, but it's been YEARS and they're still lacking. Other SOHO routers aren't faring any better, I haven't seen these features configurable on any of them.

I have a LAN which has a PiHole and a Synology NAS at home + some entertainment devices. Configuring IPv6 to allow access to same services as IPv4 from WAN via public DNS has been practically impossible, undocumented and huge pain. For pretty much no gain and loss of bandwidth.

That sounds more like a Mikrotik problem than an IPv6 problem. OpenWRT does most or all of that, for instance.

I would never recommend <Foo>WRT to anyone.

It's a shiny toy to play with. However, it has so many weird bugs that never get addressed that it's just not worth the grief.

Why can't the wired ping the wireless but the wireless can ping the wired? Why can I connect every device except my Samsung phone? Why is my throughput so much worse than the manufacturer firmware? Why are the LED's doing weird things that correspond to nothing useful?

I've never even tried IPv6 on a <Foo>WRT because it's handling of basic IPv4 stuff is so dreadful.

(Please don't read this is as dig on the <Foo>WRT developers--they're doing their best. However, the sheer variety of platforms, the lack of documentation, and the small number of developers simply creates an impossible situation.)

I can't say I've had those problems, other than throughput being worse (which is a result of proprietary acceleration chips with no published specs to write OSS drivers with). v6 works great on OpenWRT for me -- but then again, so does v4.

I addressed that - OpenWRT is a 3rd party firmware you need to reflash on your router (if you're lucky). It also doesn't install on an equipment I need.

I've never seen this features out of the box on SOHO equipment like ASUS routers, TP-Links, FritzBoxes, Apple routers and other equipment that actually ends up in peoples homes. And again, we're YEARS after the standard and there still doesn't seem to be feature parity between the two stadards on even basic home equipment.

One of my routers came with OpenWRT, so it's certainly possible to get routers that use it as 1st party firmware.

As for routers with random vendor firmware, I'm not familiar enough with all of the vendors out there to give an authoritative answer but I've seen or helped with plenty of routers that support many of the things on your list.

My off-the-shelf home router (sub-100€, very popular brand in Germany) supports all of that. I don't doubt that this will vary across vendors, but it definitely does exist.

> whenever the device gets a new IP (say new prefix)

Prefixes shouldn't change, that's the whole point. And you can use fixed addresses for IPv6 just as you had for IPv4.

> each device needs a DynDNS client configured, whereas with IPv4 just the router needs one for my single public IP.

Sure, but if you're doing that at an industrial size, you should consider buying/renting a fixed IP (range). You don't do production at home now, do you?

> IPv6 on the LAN is quite a pita due to the massive "random" prefix

You probably mean suffix? Anyway, your systems can be configured to either not have that random suffix, and they can also be configured to still reply on their fixed address (the one that's not random). Maybe try using the fe80:: address if your prefix does change.

> Prefixes shouldn't change, that's the whole point.

Well that's not the world I live in. And even if they didn't by default, I might want to change my prefix from a privacy point of view.

> You don't do production at home now, do you?

Not for paying customers, but I have plenty of services that I would like myself, my gf, my buddy etc to be able to access from the internet.

> You probably mean suffix?

No I meant the prefix, see above.

> Prefixes shouldn't change, that's the whole point.

Tell that to my residential ISP!

>Prefixes shouldn't change, that's the whole point.

They shouldn't, but they change all the time. I gave up on Ipv6 in my last house because of this reason: my prefixes were changing every few weeks. In my new household, my ISP doesn't even off IPv6.

You shouldn't get a new prefix - it should be static from your ISP, and your IP shouldn't be changing, so you don't need DynDNS per-client and can just add a static entry to a hosted DNS zone file somewhere that shouldn't change.

You use the word "shouldn't" like ISPs give a rats ass.

No ISP here hands out static prefixes for residential clients

I get a new prefix every 24 hour (around 3am).

This is intentional. In order to make renumbering possible at all, it needs to be done regularly. If the equipment didn’t handle DHCP-PD regularly the code would rot and other devices and people would assume that address prefixes would never change. That, in turn, would cause lots of things to break when prefixes were forced to change (new ISP, merger, change in upstream architecture, etc).

I get that, and personally I've thought the same that it would be better to change it often than not. Similar to Let's Encrypt.

If only the software worked with it, which it doesn't for me.