Hacker News Reader

Comment by nisa | Hacker News Reader

So why don't I get at least an /48 if I rent a server online? Hetzner gives you a /64 and a lot of providers only provide something like /80 or /112.

Having a /48 oder /44 would make deploying IPv6 VPNs a breeze because of ULA and prefix translation. https://tools.ietf.org/html/rfc6296

Where is the problem?

View on HN

Router hardware cannot keep up with any real number of IPv6 addresses. You'll quickly overflow router tables if you try to use even a tiny fraction of that /48 at once.

For example, Cisco Nexus 9000 can deal with 30k IPv6 neighbors. Once you cross that, things start blowing up.

This isn't really a limit for the backbone routers, because they're all dealing with routes, not individual IPs (they know that 2001:DB8::/32 goes to peer A, which only consumes one routing table entry). It's only a provide when you get to the network edge.

And thus SDN was born.

> ...when you get to the network edge.

I'm not a networking guy. Where is the difference? One table entry for the /48 should be enough? Where is the difference to a /64 that still allows enough IP addresses to blow something up? I can't image that a lot of people map their ULA network 1:1 to a /48 or is this the reason? As far as I undetstand it it shouldn't matter because the prefix translation is happening on the server itself on not on the router. So a single router should suffice?

Wasn't at least the IPv6 header explicitly designed to be more router friendly?

At the edge, the last router before your server has to have a mapping that a single particular IPv6 address maps to a specific MAC address. You can't really condense this down to a single entry, because any given switchport might have multiple MAC addresses active (think of the case where you have a dumb switch attached to your router, and 20 servers attached to that dumb switch. You're looking at 20 different mac addresses, so no way to condense that down to a few entries).

Even a /64 is more then enough to blow up a router at this point. The /48 just makes it a lot more likely that that will happen.

The simplest solution here is to route the entire /48 at a specific IPv6 address. This brings you back down to a couple table entries, but requires that your customer configure things properly.

That's when you do DHCP-PD and the router (last hop before your server) sets up a route for that entire /48 to the link-local address of your server.

Or you set up a static route (as a provider this would be recommended) or let the edge do a BGP announcement of it's address space.

Why do either of these solve the problem mentioned, and why would you allocate a /48 to a single server?

Wait, when you said

"...the router (last hop before your server) sets up a route for that entire /48 to the link-local address of your server."

Was "your server" the ISP's server, or the customer's server? If the former, why are you saying "server", rather than "router"?

It's the customers server. If they need a /48 of address space, you just want to route all of it to them.

The router should only care about the prefix, right? If a server has a /48, what it does with that is not really the upstream routers business.

The upstream router doesn't care, but the closest router to your server needs a mapping between IPv6 address and MAC address.

Route the /48 to the edge (the customers server)

Well, you're renting a server.

I'd recommend getting your own allocation and running your own network and AS if you want to offer VPN services.

Have you run your own AS? If you have, do you have any links to good documentation on the process, (maybe) including costs?

Thanks!

A lot of the cool stuff of IPv6 like ULA or prefix translation is only working if you have more than a /64 for an server. A /64 is specified as an endpoint. If you want to run a few VMs that are globally routable without DHCPv6 you need more than a /64.

In my case we have a local mesh network that we'd like to switch to IPv6 using ULA - no more hassle with IP-configuration... would be cool if could do 1:1 VPN with prefix translation but it's hard to get a server with a /48.

For a mostly hobbyist project running your own AS and BGB and having at least some redundancy for VPN services e.g. at least 2 providers looks like it's quite a challenge. The organisation got a /44 for each community but try finding a provider that reasonable cheap and that offers announcing your AS.

I'm just curious because it's definitely not lack of addresses that seems to be limit here.

Reply on news.ycombinator.com