I’ve mostly stuck with IPv4 in my LAN, but ive been wanting more and more to more to move to IPv6, if only for the learning experience. Since my ISP only uses 6rd and so I can’t get a static IP much less a GUA subnet to use, I’m trying to decide strategy for setting up the network, NAT, etc. And I know it’s probably not worth the effort, but again at this point it’s more a learning exercise.
I have an OpnSense router and use Unbound on it for DNS, Kea for DHCP, and Caddy for reverse proxy, so I am pretty flexible. What strategies have others employed? I use static addresses assigned at the router’s Kea DHCP service for IPv4 for all known devices. I have 4 VLANS for guest, mostly trusted devices like my phone and laptop, private stuff like my NAS, Home Assistant server, and Kubernetes cluster, and IoT for stuff that is private but I don’t have as much control over like light switches, cameras, and the TV. I use a pihole on the VLAN my personal devices are on to allow for ad, tracking, and malicious site blocking. And I use Pangolin for external access to some private services. And I have a domain dedicated to LAN devices and another for externally hosted VPS servers. Though I dont host much externally now that I finally got access to fiber and no more asymmetric, slow up speeds from Cable service.
I use static IPv4 addresses in Kea DHCP, mostly to assign devices to VLANs and give devices domain names. I’m guessing that will still be necessary. I rarely use the IP addresses in service setup or browsing to services if I can help it, just domain names. What other concerns should I consider?
Any experiences or advice for similar IPv4 to IPv6 LAN conversions would be greatly appreciated, so I can plan ahead.
You must log in or # to comment.
move to IPv6, if only for the learning experience.
I’ll about the learning aspect. It is possible to have local IPV6 connectivity between devices, but only IPV4 for ingress and egress (IPv6-only LAN with IPv4-only WAN). Your router or access point will assign the IPv6 addresses to your devices usually via SLAAC or DHCPv6 and manages local IPv6 routing. Since there is no IPv6 route to the internet, it falls back to IPv4 if the application supports dual-stack or simply uses IPv4 if the OS is configured to prefer it. The router then translates or routes this traffic out via its IPv4 interface.
This is how I have configured my network. Not because my ISP doesn’t give me an IPV6 address, but because my commercial VPN does not support IPV6. In that scenario, there is a possibility of IPV6 ‘leaks’ outside of the VPN tunnel. I’m not sure about OpnSense, but pFsense has an option to enable IPv6 over IPv4 tunneling.
ETA: Did a little checking on OpnSense and it seems you can do IPV6 to IPV4 via a plugin called
os-6in4.The only thing I can tell is that it is totally worthless.
Because you can not have an uga ipv6, then obviously you will have an ula served via dhcpv6 with ipv4 local address (double stack).
And in this point you will realize that most computers implementation select which ip address to use following prio: ipv6 uga -> ipv4 -> ipv6 ula
So even if you do all the things right, your clients will not use it because ipv4 is there and you cannot deselect it because I assume you still want connectivity
Funny, right? :)
