Need Help What's the "right way" to make a device IPv6 only?
Turning off DHCP seems the most obvious and straightforward, and that's what I've done on my Linux workstation after installing clatd, works like a charm.
The less straightforward devices are the ones without this option. I've just blocked their MAC addresses from getting DHCP leases in pfSense, and that works but definitely doesn't scale well and I have to keep a notepad of which is which.
Pfsense also supports whitelisting instead but too many devices require v4 sadly.
I wish pfsense just let me pull up the lease list and block devices right from there. Does other router software support this?
Or is there a better way?
•
u/bojack1437 Pioneer (Pre-2006) 6d ago
I just set DHCP Option 108, If a device supports it then cool, if not they are still dual stack with DNS64 and likely preferring that anyways,
•
u/burajin 6d ago edited 6d ago
Figured this out! Pfsense covers this on their IPv6 page. Seems to be working, thanks!
I did notice my Google Nest display which I had forced on v6 by blocking its MAC went back to having a v4 address, which is annoying but mine and wife's Android devices all continue to be v6 only.
edit: my stupid nvidia shield also went back to a v4 address, and that's Android :/ what gives!?
•
u/bojack1437 Pioneer (Pre-2006) 6d ago
Android has supported it since I believe 14, could be wrong with that.
iOS supports it.
Heck, since my Onn streaming sticks run Android, even they support it natively.
One of the last ones to the party is Windows, although they are testing it.
For bonus points, You can also add in the Perf64 in RAs, although if using the well-known prefix for NAT64 not as useful but, why not, heh, I'm using a non-standard prefix for NAT64, And while they can also discover it via DNS64, doesn't hurt to give clients every possible opportunity to get all the information they need and whatever way they want to do it.
•
u/burajin 6d ago
Heck, since my Onn streaming sticks run Android, even they support it natively.
So my Nvidia SHIELD, which was working just fine with the MAC blocked from DHCP, has resorted to having a v4 address after I enabled DHCP 108. So that's disappointing but some other devices seem to be handling it well.
•
u/Masterflitzer 5d ago
that's normal, if the dhcpv4 client doesn't support option 108 it'll just ignore it and instead of disabling the ipv4 stack it'll use dhcp to get an ipv4 address, option 108 is for ipv6-mostly to support the case when clients are not ipv6 ready
note there are ipv6 supported devices that don't support option 108, so they will just use dhcpv4 normally, you may or may not want that
•
u/Leviathan_Dev 5d ago
There’s still a lot of devices that are only v4 or have preference for v4. Nintendo Switch, all of my smart home gadgets, my travel router.
We’re still at the stage where IPv4 is the assumed default, so there’s still stragglers that haven’t bothered supporting v6. Can’t remember exactly, but I know I have at least one device that will not create an IPv6 address if it does not have an IPv4 address.
•
u/Majiir 6d ago
Don't try to make the devices IPv6 only. Make the network IPv6 only. If you don't handle any IPv4 traffic at your routers, you're IPv6-only. Run a V6-only VLAN and a dual-stack VLAN if you still want some devices to have IPv4.
•
u/PineappleScanner 6d ago
Forgive me if I'm mistaken, but wouldn't disabling IPv4 on your network cut devices off from the (unfortunately large) number of external services that are ipv4-only (e.g github)?
•
u/SuperQue 6d ago
Not necessarily. This is what DNS64/NAT64 are for.
The vlan itself can be IPv6-only, but the router itself can have an IPv4 address and handle the translation to IPv4 for the clients.
This is how IPv6 was designed to be backwards-compatible with IPv4.
•
u/DaracMarjal 6d ago
Or a proxy such as squid
•
u/MrWonderfulPoop 6d ago edited 6d ago
I had no idea Squid was still a thing, I last ran it maybe 20+ years ago.
How does Squid handle SSL without acting as a MITM, or would it be acting only as a 6-4 bridge in this case?
EDIT: Ignore me. I was thinking of the old days using Squid as a caching proxy that required some SSL trickery, not as a straight proxy.
•
u/edgmnt_net 6d ago
Squid and other proxies are supposed to simply proxy SSL/TLS through the CONNECT method, effectively acting as TCP proxies.
•
u/MrWonderfulPoop 6d ago
Yeah I was thinking of its caching capabilities from way back.
•
u/edgmnt_net 6d ago
Yeah, HTTPS isn't cacheable by ordinary intermediate nodes. Proxies used to be really common some time ago, but they're rare now that a lot of stuff uses HTTPS, unless counting termination proxies or corporate traffic inspection. DNS is also shifting to be non-cacheable due to privacy reasons (DoH, DoT). Given security and privacy concerns, there's very limited leeway to implement that usefully.
•
u/yrro Guru 6d ago
Client connects to proxy and sends
CONNECT google.com:443 HTTP/1.1plus headers. Proxy reponds with a200response. From then on the proxy blindly relays bytes between the client and the server, it doesn't need to try to intercept/decode the TLS traffic.•
u/MrWonderfulPoop 6d ago
Got it. When I used Squid, it was acting as a caching proxy for ~200 users.
In the blissful ignorance of the pre-Snowden leaks days.
•
u/yrro Guru 6d ago
TBH you can configure Squid to act as a transparent proxy, intercepting TLS traffic and re-encrypting it after inspection. But it's not done in most deployments.
•
u/MrWonderfulPoop 6d ago
Yeah we looked at it, but (from memory) it requires a CA and certs on every device to avoid cert warnings in-browser.
It was an unnecessary amount of work for a thing we were using strictly as a cache to speed up some internet traffic.
•
•
•
u/trmdi 6d ago
Definitely it will be "broken" for ipv4-only services.
•
u/AtlanticPortal 6d ago
No, you can put DNS64 and NAT64 on your systems and allow an IPv6 only device to access the IPv4 world.
•
u/Majiir 6d ago
It depends on what transition mechanisms you set up on your network and your clients.
With a pure IPv6-only network, your clients lose IPv4 connectivity.
If you add a NAT64 translator to the network and announce it with PREF64, then any client with a CLAT will start using it for their IPv4 traffic. This works well, but it requires the clients to have a CLAT running. This won't even catch most desktop systems today, let alone other devices.
If you add a NAT64 translator and use DNS64 instead, then you can serve clients that don't have a CLAT. They will use IPv6, but that traffic gets translated to IPv4 unbeknownst to them. The downside is that this only works when the IPv4 address is queried through DNS. Anything that hard-codes an IPv4 address or shares it in an application-level protocol won't work. This notably includes the Steam client and many P2P protocols.
So there is really no compromise-free solution today.
•
u/Masterflitzer 5d ago
yes for ipv6 only, another option would be ipv6 mostly tho: deploy dhcpv4 option 108
•
u/Majiir 5d ago
Yes, but I've found DHCP Option 108 breaks some bugged devices.
•
u/Masterflitzer 5d ago
shouldn't be the case (do you have examples of bugged devices?)
dhcpv4 option 108 needs to be supported by the dhcp client or it'll get ignored and if it's supported then the client most definitely has a nat64 clat or at least should generally be ipv6 ready
you do need a plat tho to make ipv4 work with 464xlat and therefore deploy ipv6-mostly, otherwise ipv4 will just be disabled, which is valid if you want ipv6-only, in any case legacy devices will just continue to be dual stack or ipv4 only as they don't know what option 108 even is
•
•
u/sh_lldp_ne 6d ago
PREF64 in the RA and DHCP option 108
This is a worthwhile read - https://blog.apnic.net/2022/11/21/deploying-ipv6-mostly-access-networks/
•
•
u/Mishoniko 6d ago
I wish pfsense just let me pull up the lease list and block devices right from there. Does other router software support this?
You can do this in OpenWrt. Create a DHCP reservation for a host but set the IP address to "ignore" and it will effectively block DHCP service to the host. You can put a hostname in and the name will appear anywhere the MAC does.
Some folks have touched on it, but there are security concerns with allowing IPv4 to run unmanaged. The same issues exist for unmanaged IPv6 in legacy IPv4 networks. These issues are bigger problems for corporate networks than for home networks.
- Hosts that want DHCPv4 and don't find it may configure APIPA addresses, which allows link-local communication over IPv4. Self-assembled like this, they can use mDNS to find similarly configured devices.
- With no sanctioned DHCPv4 server, there is little stopping someone from standing up their own rogue DHCPv4 server and routing IPv4 traffic where they like. Not necessarily a new problem, usually solved with switch security features.
•
u/pdp10 Internetwork Engineer (former SP) 5d ago
These are called "First-Hop attacks". How important they are to mitigate, depends mostly on the rest of the architecture. Microsoft ADDS with legacy NTLM hashes is extremely vulnerable to first-hop attacks. Within Microsoft-centric sites that have no IPv6 configured, an IPv6 first-hop attack against NTLM hashes frequently leads to ADDS "global admin" compromise -- a very showy demo for tiger teams looking for signed contracts from spooked decision-makers.
•
u/AtlanticPortal 6d ago
The right way depends if you control their network configuration or not. If you do, disable the TCP/IP stack entirely. If you don’t just don’t enable it on their gateway. They will be literally locked to a useless static IP or on to a failed DHCPv4 and thus in APIPA.
•
u/michaelpaoli 6d ago
Highly depends on the device, and one may not necessarily have the access/control to change that on the device. But if one has the relevant network control, notably router(s), applicable server(s) and/or firewalls, well, one can make the network IPv6 only (or at least mostly so).
Most notably routers - no IPv4 routing, so that will generally limit things to [v]LAN(s)/subnet(s) for IPv4. No DHCPv4 servers - that then mostly also stops clients from using IPv4, but not quite 100%, as there might still be (mis)configured clients with static IPv4 address(es), or clients with longer IPv4 leases (possibly even ones recently joining the network that came from other networks). Also doesn't stop APIPA. But firewalls can also put a stop to or quite limit that. Can also do likewise for ARP/RARP that's for IPv4 or related - firewalls to prevent the traffic from even getting far on the network.
In any case, most of it can be prevented at the router, but that doesn't necessarily stop all local IPv4 traffic. In any case, if one controls the router(s), then it won't get beyond at least logically quite local. And controlling server(s), having relevant firewall(s), etc., can further cut that way back.
But it's not always feasible to control all devices that might access the network.
•
u/rankinrez 6d ago
I’ll just be an asshole and say if you have clatd running then there is a whole heap of IPv4 going on on your machine.
On a more serious note can you not just disable the DHCPv4 server? If you need it for some hosts still then filtering based on MAC isn’t a bad idea, or a separate vlan for hosts that need direct IPv4 vs those that don’t.
•
u/burajin 6d ago
In a perfect world yes but stuff like the Nintendo Switch, wife's Kobo, PS5 etc don't behave correctly without IPv4, sadly.
•
u/pdp10 Internetwork Engineer (former SP) 5d ago
For the record, Nintendo Switch 2 supports IPv6, and PS5 has IPv6 support so one might investigate if NAT64+DNS64 aren't already sending that traffic over IPv6. The game servers likely don't support IPv6, but again, that should still let NAT64 do it instead.
Kobos seem to wholly lack IPv6 support for the last 13 years. :(
•
u/_ahrs 4d ago
The Switch 2 does prefer AAAA records if they're present. I've confirmed that myself, so it will use NAT64+DNS64.
Since I like having clean DNS for my games consoles (no tracking blocking, etc) I actually configured an LXC container running Alpine with dnsmasq and gave it the IP address 192.168.0.64 and <GUA>::64 with a simple dnsmasq stub config pointing at Google and Cloudflare's DNS64 so now if I want a device to have clean / unfiltered DNS64 I can just point it at that stub:
# Listen only on the loopback interface for local queries listen-address=192.168.0.64 listen-address=<GUA>::64 listen-address=127.0.0.53 bind-interfaces # Do not read /etc/hosts or poll for changes if you only want pure forwarding/caching no-resolv # Set your upstream public DNS servers (e.g., Cloudflare and Google) server=2606:4700:4700::64 server=2606:4700:4700::6400 server=2001:4860:4860::64 server=2001:4860:4860::6464 # Increase cache size from the default cache-size=10000 # align with the 2020 DNS flag day recommendation, avoids # fragmentation-related resolution failures over UDP edns-packet-max=1232
•
u/AutoModerator 6d ago
Hello there, /u/burajin! Welcome to /r/ipv6.
We are here to discuss Internet Protocol and the technology around it. Regardless of what your opinion is, do not make it personal. Only argue with the facts and remember that it is perfectly fine to be proven wrong. None of us is as smart as all of us. Please review our community rules and report any violations to the mods.
If you need help with IPv6 in general, feel free to see our FAQ page for some quick answers. If that does not help, share as much unidentifiable information as you can about what you observe to be the problem, so that others can understand the situation better and provide a quick response.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.