Hacker News Reader

Comment by noinsight | Hacker News Reader

You could be using IPv6 ULA addresses internally on your home network to have static addressing. The real solution is moving to DNS names though with your router maintaining them based on DHCP leases or just using multicast DNS (Zeroconf).

In the future you can probably go "IPv6-mostly" with a CLAT engine to ditch dual-stack: https://blog.apnic.net/2022/11/21/deploying-ipv6-mostly-acce...

View on HN

You could, but now you have three addresses per node instead of one. Plus, the mechanisms for assigning those addresses are weird compared to DHCP and static assignment. I get that it facilitates packets being routed reliably, but some of us want maintainable firewall rules that don't have to deal with IP addresses changing out of the blue.

You can DHCP or static assign those addresses the same. The trick to FW rules is you don't route the local prefix out so you only need rules for anything leaving or anything staying.

If you don't need cross subnet communication of your self hosted services you can also get away with just a static link-local and a dynamic general.

> In the future you can probably go "IPv6-mostly" with a CLAT engine

...although there still isn't any kernel support for the necessary SIIT v4<->v6 translation, so to implement CLAT you end up using unmaintained (and unmergeably bad) out-of-tree kernel modules or unmaintained (and slow) userspace daemons hanging off a tuntap interface.

pf on OpenBSD does it fine.

It does yes. I should have written 'no Linux kernel support' rather than 'no kernel support', sorry. The BSDs are better off than Linux here.

Reply on news.ycombinator.com