except for nor using it at all, of course.
So I want to make my homelab IPv6 ready, because I have too much free time, i guess. There are two decisions that I’m currently unsure about:
- ULA or not. Do you have local only addresses or do your clients communicate using the global IPv6 address? Does not using ULAs work without a static IP from the ISP?
- DHCPv6 or is SLAAC enough?
For each question both options seem to be possible and I’m interested in your experience
Cheers
You must log in or register to comment.
Don’t use ULA, those are non internet routable addresses so they will never use v6 for internet things. Use the range assigned from your ISP.
SLAAC. Because Android has one ass of a dev who refuses to include DHCPv6ISP issues a prefix that I delegate.
Also delegate an ULA prefix, intended for stake local addresses but d actually just use ipv4 for those (also had difficulty getting ipv6 to work with microk8s and multus due to inexperience).
SLAAC.
I use ULA for my WireGuard tunnels, otherwise it’s all public IPv6 (mostly lightly firewalled).
I’m fine with SLAAC, even for servers. I just manually update my DNS with the server addresses when I set them up.
I can’t get IPv6 in any worthwhile form from my ISP. IMHO IPv6 isn’t any more useful than IPv4 if you only have ULA. And NAT is not as well supported since it wasn’t intended to even be really necessary for example. So even if you are starting from scratch or just using it internally, there are some disadvantages to implementing it over just sticking with IPv6. But if your ISP actually provides IPv6 it might be worth it as long as your devices all support it. But otherwise you’re going to need to set up IPv4 in addition, anyway, so you’re just going to create problems for no good reason, IMHO.
Dual stack setups are not an issue unless your router doesn’t support it or your ISP sucks.
But why bother if you get ULAs. It doesn’t enhance anything and adds complexity if you use NAT or other routing as you need to add rules for both IPv4 and IPv6. Most ISPs, in the US anyway, don’t offer true IPv6 only what was supposed to be transitional technology decades ago like 6rd. I hate to say anything good about Comcast, but it’s the single thing I miss from that they actually do. But having such limited upstream speeds on cable just isn’t reasonable for much of anything these days, but definitely not when self-hosting. 1-10Mbps up on Cable or most DSL just doesn’t cut it.
If you’re starting from scratch implementing IPv6 on your LAN might be worthwhile if you dont mind the limitations of or don’t require the transitional technologies on your LAN like NAT64 and the hit to performance from the translations/tunneling when accessing the internet doesn’t bother you (it sure annoyed the hell out of me every time I accessed a website, among other things).
But dual stack, seems like it’s not worthwhile. Just choose one or the other. Few software applications or modern hardware are going to have an issue with IPv6. But if you’re using both ULAs and IPv4 private addresses, it seems like a lot of extra hassle to write duplicate routing rules for everything.
Like I said: unless your ISP sucks. I don’t see the issue with dual stack and I don’t know why you’re bringing other transition mechanisms into this. Obviously they kinda suck. Dual stack really doesn’t have much of a downside or a performance hit unless your clients or DNS are doing something stupid. In which case you can still choose to configure a client to use one over the other. Many ISPs, especially outside the US, don’t have enough IPv4 address space and have to use CGNAT, in which case you’re much better off with a dual stack setup and a DNS config that prefers AAAA records, imho. IPv4 only leaves you with NAT, which sucks and IPv6 only isn’t feasible currently.
Right, but my point is, most US ISP are shitty and don’t offer IPv6 blocks. If you are in the lucky minority who’s ISP does provide proper support for IPv6, then why bother dealing with IPv4 at all, ignore it. Almost nothing needs it anymore besides the majority of ISPs in the US which all suck.
There are some cases where locally defined addresses (private IPv4 or IPv6 ULAs) and NAT are useful for controlling what people and devices on your LAN can access, but usually not in a residential or home lab situation. So why bother. Either if your ISP offers proper IPv6, just use that, or if they don’t, just use IPv4 and ignore the transitional IPv6 addresses. With both you end up writing every NAT and firewall rule twice, I don’t see the point unless you have an old device that can’t handle IPv6.
As for performance hits, I was referring to the fact that most ISPs dont offer proper blocks of IPv6 and the transitional technologies they do offer like 6rd or 6to4 do have performance hits, sometimes extremely significant ones. So if you implement dual stack and your DNS query returns AAAA record and your systems prefer it, they will always take a hit. This is from lots of experience. I always disable IPv6 because my ISP uses 6rd and it is the only one in the major city I live in that offers >10Mbps upstream, so it’s not feasible to switch. When I was on Comcast and got an IPv6 block, I disabled IPv4. Dual stack would be too much work.
My setup is a pile of kludges built on top of each other over the last two decades.
I started with ULAs distributed through DHCP, connected to named, which allows hosts do declare their own name and let me access local services as though I had a real domain.
My ISP eventually started supporting IPV6, but only assigned /128, so the ULAs got NAT-6ed out to the real world.
I eventually learned how to request prefix delegation from the ISP and set up SLAAC.
So now, my PIv6 clients have a) their link-local address, b) the ULA, c) a “privacy” SLAAC, and d) a unique SLAAC. All my internal services still refer to the ULAs.
I don’t think I’d recommend this system for someone setting up from scratch. The easiest thing would be to go with SLAAC, if you can get prefix delegation, and set your DNS/pihole to send the unique-SLAAC address of any servers you run.
I use IPv6 local only. Everything else is IPv4. Reason being, my commercial VPN does not support IPv6 and I have reservations about leakage. My ISP already ships with IPv4 & IPv6.
I use both ULA and global addresses. Servers set a token to make the last 64bits predictable, which simplifies dyndns. For some critical internal communication, I hard code the ULA address in my hosts file, for everything else, I rely on DNS (with global addresses). No DHCPv6.
I usually just disable IPv4 on my VMs, unless there is a specific need for IPv4. Most container networks are single stack as well. I have a squid proxy that services can use to access IPv4 http/https destinations if really necessary (combined with some additional filter rules); ideally I would like to have 464xlat/a nat64 gateway, but I never bothered to set that up yet. I will likely do that when I buy a new router (end of year?). I expect all my devices to support CLAT by then, so that will be the end of IPv4 on my network.
SLAAC with ISP-provided prefix. Everything that wants an IPv6 address gets one and I’ve got my firewall set to block pretty much all in-bound traffic other than SSH. It’s nice being able to SSH directly to something rather than using a jump host or VPN.
I also use ULA because NFS mounts over IPv6 on the global addresses would hang/timeout every time the SLAAC address rotated which is frequent due to privacy extensions.
Until very recently, I exclusively used the /56 prefix I get from my ISP exclusively. This is still relatively annoying in my case as this prefix changes at least daily for some reason. Clients get their IP via SLAAC.
I’ve added ULA literally less than a week ago as I have a local reverse proxy I want to handle both local and external request, in both v6 and v4. Obviously more hosts should be accessible from local clients. But I can’t tell local clients apart except by IP, and since the prefix is unstable this would require some sort of hook to update the proxy with that new prefix (might be possible, but seems like a real hassle). So here we are.
My provider doesn’t provide IPv6, but I rented a server in a data center, bought a subnet, and tunneled it home via WireGuard. So the scheme is roughly: VPS (fd00:1::/64) <-> (fd00:1::/64) Home router (realv6/64) <-> Home network
Router configuration:
/etc/sysctl.d/10-ipv6-privacy.conf
net.ipv6.conf.all.use_tempaddr = 0 net.ipv6.conf.default.use_tempaddr = 0 net.ipv6.conf.all.forwarding = 1 net.ipv6.conf.default.forwarding = 1/etc/radvd.conf
interface br0 { AdvSendAdvert on; MinRtrAdvInterval 3; MaxRtrAdvInterval 30; AdvManagedFlag on; # M=1 → Address via DHCPv6 AdvOtherConfigFlag on; # O=1 → Additional options via DHCPv6 # SLAAC is still possible for Android prefix realv6::/64 { AdvOnLink on; AdvAutonomous on; # Allow SLAAC }; RDNSS realv6::1 { AdvRDNSSLifetime 1800; }; DNSSL home.lan { AdvDNSSLLifetime 1800; }; };/etc/kea/kea-dhcp6.conf
{ "Dhcp6": { "interfaces-config": { "interfaces": [ "br0" ] }, "lease-database": { "type": "memfile", "persist": true, "lfc-interval": 86400, "name": "/var/lib/kea/dhcp6.leases" }, "renew-timer": 21600, "rebind-timer": 43200, "preferred-lifetime": 43200, "valid-lifetime": 86400, "subnet6": [ { "id": 1, "subnet": "realv6::/64", "interface": "br0", "pools": [ { "pool": "realv6::1000 - realv6::ffff" } ], "option-data": [ { "name": "dns-servers", "data": "realv6::1" }, { "name": "domain-search", "data": "home.lan" } ] } ], "loggers": [ { "name": "kea-dhcp6", "output-options": [ { "output": "stdout" } ], "severity": "WARN" } ] } }And of course, iptables is necessary. Something like: /etc/iptables/ip6tables.rules
# Generated by ip6tables-save v1.6.0 on Thu Sep 8 13:29:11 2016 *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] COMMIT *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] #BASE INPUT -A INPUT -i eno1 -j DROP -A OUTPUT -o eno1 -j DROP -A INPUT -i lo -j ACCEPT -A INPUT -i br0 -j ACCEPT -A INPUT -p ipv6-icmp -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i eno1 -j DROP -A FORWARD -i br0 -j ACCEPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -p ipv6-icmp -j ACCEPT COMMIT- Probably wouldn’t hurt to set them up, especially if you don’t have a static prefix. The good thing is that interfaces can have multiple IPv6 addresses, so they can use both the public address and the ULA.
- SLAAC should always be enough. Make sure you don’t block the ICMP6 messages it needs though (I’ve been bitten by that once, firewalld behaves weirdly around this).
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CGNAT Carrier-Grade NAT DHCP Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network DNS Domain Name Service/System IP Internet Protocol NAT Network Address Translation NFS Network File System, a Unix-based file-sharing protocol known for performance and efficiency SSH Secure Shell for remote terminal access VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)
[Thread #284 for this comm, first seen 11th May 2026, 19:20] [FAQ] [Full list] [Contact] [Source code]
Hey bot, you missed ULA, ICMP, and SLAAC
Edit; and ISP
Happy to take definitions and plug them into the database, if you have them to hand. If not, I’ll put aside a few minutes this weekend to look them up.
ULA = Unique Local Address, non routable address scheme in IPv6 for use in local networks
SLAAC = Stateless Address Autoconfiguration, a process in IPv6 that allows a host to assign itself an unique IP by listening to other traffic to determine the network ID and then creating the host ID
ICMP = Internet Control Message Protocol, these a specific messages that allow for higher coordination and control rather that data exchange, like ping or dhcp.
ISP = Internet Service Provider, the company that provides your internet acccess like Comcast, Google Fiber, AT&T, etc.
Many thanks, added to the database.
In the home/lab, I use public addresses with mostly SLAAC, but the host server has a static IP. I get A public /56 prefix via DHCPv6-PD from my ISP. There is a bit of a pain point if the prefix changes but it hasn’t happened since I moved here.
My ”production” setup is a bit more controversial. Since Hetzner charges extra for extra IPv6 subnets I simply created small /80 subnets for the VMs. While this does mean that SLAAC doesn’t work I can simply generate and assign static IPv6 IPs, same way as I do with IPv4. All generated from an ansible playbook that creates the VMs.
I have some ULA ranges as well, but it’s a bit of a special case as I only use it as internal IP ranges in a Kubernetes cluster. This is completely separated from the external network, with the cluster doing NAT to the node IPs anyway (even for IPv6), and all internal traffic being on an overlay network.
I have that conf:
/etc/sysctl.d/01-ipv6.confnet.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 net.ipv6.conf.lo.disable_ipv6 = 1But that falls under your exception. It seems to me that IPv6 causes more problems than it solves.
I mean, you can get rid of NAT and subnet your systems in a logical fashion. That’s pretty awesome.
Yes, maybe, but do I want to do that? Everything’s going perfectly right now.
You can subnet logically with IPv4.
If you go IPv6 on the internal network you ‘win’ not having NAT, and exposing all your intrrnal services to the net (which… just why?), but lose the ability to do redundant ISPs/failover/loadbalancing, policy based routing, VPNs… Unless you do IPv6 address translation. Which puts you back to “IPv4+NAT, except more complicated.”
IPv6 inside the firewall is more or less entirely pointless.
I’m doing slaac and some reservations for devices that just randomly pop new MACs (vms or something, I don’t remember why.
I use aliases for my firewall rules. DNS I don’t really have working.
