• litchralee@sh.itjust.worksEnglish
    9·
    2 months ago

    You might also try asking on !ipv6@lemmy.world .

    Be advised that even if a VPN offers IPv6, they may not necessarily offer it sensibly. For example, some might only give you a single address (aka a routed /128). That might work for basic web fetching but it’s wholly inadequate if you wanted the VPN to also give addresses to any VMs, or if you want each outbound connection to use a unique IP. And that’s a fair ask, because a normal v6 network can usually do that, even though a typical Legacy IP network can’t.

    Some VPNs will offer you a /64 subnet, but their software might not check if your SLAAC-assigned address is leaking your physical MAC address. Your OS should have privacy-extensions enabled to prevent this, but good VPN software should explicitly check for that. Not all software does.

    • vividspecter@aussie.zoneEnglish
      2·
      2 months ago

      Yeah, you’re stuck with NAT66 with most commercial VPNs that support IPv6. If you’ve got ISP level ipv6 you can still allow inbound connections directly at least.

      If you do go the NAT66 route, consider assigning a fake GUA from an unassigned prefix as if you use standard ULAs outbound connections will always prefer ipv4.

      None of this is in the spirit of proper ipv6 but it “works”.

      • litchralee@sh.itjust.worksEnglish
        1·
        2 months ago

        I’ve seen the suggestion of buying a GUA subnet, purely to use as a routable-but-unique prefix that will never collide, and will always win over ULA or Legacy IP routes. When I last checked, it was something like €1 for a /48 off of someone’s /32 prefix, complete with a letter of authorization and reverse IP delegation. So it could be routable, if one so chooses.

  • irmadlad@lemmy.worldEnglish
    5·
    2 months ago

    From what I’ve read, he primary concern with VPNs that do not support IPv6 is leakage. If a user’s device tries to access an IPv6 resource while connected to a VPN that only routes IPv4 traffic, the IPv6 packets can escape the VPN tunnel. This exposes the user’s real IP address to external servers, undermining the privacy that the VPN is supposed to provide. Some servers have moved to strictly IPv6. Some servers only accept IPv4.

    Some of you networking gods set me straight.