Of course you can have default drop in your IPV6 firewall, but it's far easier to keep in your head that internal NATed IPs aren't accessible and "real" IPs are.
The people who are supposed to know IPv6 never seemed to have learned it and many of them don't seem to be open to the idea of learning something new. Of course half the world runs on IPv6 now so they'll have to get with the times eventually, but the prevalence of statements like these is quite depressing.
To the idea of learning something designed by commitee, over complex and stinking of enterprise and that you simply can't deploy "by hand".
One of the advantages of NAT by the way is that your "outside" configuration and "inside" configurations are completely independent with the exception of the snat rule.
If you can make your way through the absolute slog that is ARP+DHCP, you can get through NDP+SLAAC. Or even NDP+DHCPv6 if you're a control freak.
> One of the advantages of NAT by the way is that your "outside" configuration and "inside" configurations are completely independent with the exception of the snat rule.
If you want NAT, then set up NAT. Your fdb6:fc49:f5ae::/48 ULA is your 192.168.x.y address. Set up DHCPv6 if you'd like to pretend you control your address space. You could even just ignore the spec and use fdfd::/48 as your ULA so you can memorize addresses (fdfd::1, fdfd::2, that's even shorter than 192.168.1.2!). Use fe80::1 (a perfectly valid address) on your router as a standard gateway and have it do NAT to the outside world.
Even though it's heavily discouraged (because NAT is a massive hack after all), you can do NAT on IPv6 without any special tooling.
No it's not mine. It's the ISPs.
> which is useful for terrible ISPs with rotating network prefixes
... which is what you said :)
> If you can make your way through the absolute slog that is ARP+DHCP, you can get through NDP+SLAAC. Or even NDP+DHCPv6 if you're a control freak.
Oo enterprise. I believe you missed another 5 or 6 acronyms that are also required for having ipv6 internally.
It's not 2010 anymore, IPv6 works internally out of the box. If you don't know what ARP means then you will have no problems using IPv6.
Works if you rely on the ISP provided box?
And why pick on ARP and not on SLAAC, NDS, DAD, RS, RA... ?
Of course I'm sure you think about DHCP address management, DHCPDISCOVER and DHCPOFFER packets, mDNS, ACD, etc., since clearly you like to get into the weeds of your network
I have to because I have two fiber connections to the outside world :)
Nothing fancy like automatic failover or load balancing, they're just there.
With ipv4 i change the default route on a machine to the internal IP of one of the ISP provided routers, that one NATs it and i'm all set.
With ipv6 that insists on giving me an ISP assigned address internally, what do i do? It only works with that particular ISP. I'd still have to NAT and somehow disable the ISP addys, if i even can.
I suppose a $3000 Cisco box will solve all my problems, wouldn't it? Or maybe a $3000 + 150/month support contract? If Cisco even bothers for that little.