[Tutorial] How to not waste your time

[Kets_One]

Thanks. I didnt express myself clearly which is important with these complicated matters ;)
So far the following is updated and working:

- Created virtual IPv6 address f777::1 instead of fd07::1 to prevent IPv4 preference as described in your first post.
- Setup of NAT66 to translate all routable addresses of LAN devices (other than the servers) to a virtual IPv6 routable address based on /64 prefix from ISP. Suffix is not based on a MAC address. Does it matter what suffix i choose? Just the first address in the range (::1) or last or aything?
I think it would be good to regularly rotate the address. Is there a way to do this automatically?
- Setup of floating FW block rules for the f000/4 address space.

I plan to see how this works for a while.
PS: Please explain why traffic to multicast addresses like ff::/8 need to be allowed to WAN as in your example. These addresses are normally not forwarded to WAN.

[millerwissen]

pfsense is better after all

[bimbar]

Let me be clear that you should do none of those things.

There are solutions to these problems, but not those.

There are even problems where NPTv6 is a legitimate solution (small site multihoming, for example), but not that one.

But maybe I don't understand, so, tell me, what problem does all of that actually solve?

EDIT: If you really want to know how to do IPv6 in your local network, I would advise you to read https://forum.opnsense.org/index.php?topic=45822.0 .

[millerwissen]

yep

[Patrick M. Hausen]

Globally unique addresses everywhere, not necessarily globally reachable. That's exactly what firewalls are for.

And a common prefix size of /56 for an individual or /48 for a company is more than enough room for "hierarchy and complex site-to-site intranets". Even more so, because you will never have address conflicts.

[millerwissen]

waste

[Maurice]

Definitely one of the more bizarre threads around here.

Just as a PSA for newbies stumbling over this: Do whatever you want in your own private networks, but the ideas presented here are pretty fringe and in no way best practice or widely accepted.

(First and only comment.)

Cheers
Maurice

[Kets_One]

Indeed may seem pretty 'fringe' haha.
Im not understanding everything, but the things i do get and agree with i have implemented.
My goal is to see how this works for some time.

I'm especially fascinated by replacing the suffix of the IPv6 address for all devices on LAN by some random address using Outbound NAT.
For now i have created ~20 random suffixes and loaded these in an alias. These are used round-robin (sticky).
Since i have a fixed IPv6 prefix, i don't need to worry about that changing. I plan to rotate these random suffixes regularly, but would love to see a more automatic solution.

Thanks Millerwissen for your time and ideas.

[meyergru]

I'm especially fascinated by replacing the suffix of the IPv6 address for all devices on LAN by some random address using Outbound NAT.
For now i have created ~20 random suffixes and loaded these in an alias. These are used round-robin (sticky).

Why bother? IPv6 privacy extensions do that for free when you use SLAAC.

[millerwissen]

so long

[millerwissen]

waste time

[bimbar]

Ok, the way to do this by the book:

- use GUA internally to reach the internet
- use ULA (as secondary address) and/or IPv4 addresses for internal addressing, primarily if you have internal servers that need static addresses
- firewall using the above addresses you assigned. OPNsense has the functionality to support this using dynamic IPv6 address objects or interface address objects

Let me stress that NAT is not a security feature - firewalling is used for that. NAT is only relevant if there is a routing / addressing issue that can not be solved in any other way. Using reserved addresses is never a good idea - renumbering of static networks is potentially a huge hassle and you may be forced to if those addresses are used in the future.

The only reason I can see for NPTv6 is if you have a small site with dynamic IPv6 addresses that is multihomed. In that case in my opinion it is necessary to NPTv6 the secondary uplink in order to solve some problems regarding source address selection on the client.