Update SLAAC ipv6 in DNS

In my experience (reinforced VERY recently as I’m currently in the progress of making some changes to the network :slight_smile: ) multi-homing is simply asking for trouble. Let everyone do what they do best - let the servers serve, and leave routing to the routers! :slight_smile:

Besides, it’s easier to control/filter/forward if it all passes through one central point.

BTW, I didn’t quite understand what you said: If I had three interfaces on the TrueNAS, wouldn’t I need three different link-local addresses for them? If so, how would I enter that into DNS without risking failures two out of three on each request?

No, you can have the same address on all interfaces. That’s why they are link (= interface) local.

I don’t follow the above. I guess it comes down to network complexity but getting my Mikrotiks and Piholes to take care of DNS and DHCP seems worlds easier in IP4 than IP6.

I don’t allow IP6 traffic on my network due to the added complexities associated with IP6 firewalling. I read about it once, decided it wasn’t worth the trouble for the time being and turned off IP6.

Every device here and at remote sites has its unique FQDN, IP4 address, and stuff just works, including firing off jobs to remote IP4 printers. To each his or her own, I guess.

It’s also entirely possible that other network stacks (ubiquiti, Cisco, whoever) make IP6 internal and external routing / firewalling / etc. implementation much easier. I’m sticking with MikroTik for now because it’s secure, stable, and does what I need without a fuss at a price point i like.

Just a simple comparison on how to get a static IPv4 and how to get a static (none routable) IPv6. Way easier and smoother for IPv6. Hence why your printer probably uses it by default.

To me the opposite. On OPNsense, IPv6 works out of the box (thanks RA), while for IPv4 I need a DHCP so devices even can get an IP.

I don’t know what should be more complicated about firewalling in IPv6 than in IPv4.
On the contrary, you don’t have to bother with NAT.

But yeah, since not everybody supports IPv6 yet, you basically have to go with dual stack for anything public, which in return results in you now handling both. I think it is fun, but I get if it is not for anyone.

IMHO TrueNAS and other appliances (Proxmox, Loxone) come with very obscure network configurations. I don’t get the strange fixation on static IPv4, strong focus on IPv4, DHCP only on one interface, no privacy extension enabled by default and so on. I don’t really understand why they don’t just simply use interfaces or netplan.

Either way, this is getting really off topic, since OP wants to run IPv6.

Just to make this clear: I am not in the “nobody needs IPv6 camp”. Au contraire - my company is running data centres 100% dual stack for more than a decade.

I am only arguing the DNS and fixed addresses part for clients. SLAAC, default gateway, get out to resources on the Internet - done.

I run almost all my services through a single reverse proxy for IPv4 and IPv6 including SSL termination and since I need to configure the backend manually, anyway, I prefer IPv4 for that. FreeBSD jails, TrueNAS CE apps, VMs … they all have IPv6 for egress, but I use IPv4 for ingress, almost exclusively. Apart from that proxy which most of my clients contact via IPv6, of course due to happy eyeballs.

I don’t see a static DHCP reservation as an extra burden. Central location - way better than manually configuring memorisable link local addresses on each single device.

I don’t bother with DNS e.g. reverse mapping for IPv4 for clients, either.

Oh, now I get it: The link-local address is only unique together with its scope id anyway, so it’s no problem to have the same IP on more than one interface, right?

That’s downright ingenious! :laughing:

Maybe OPNsense defaults make this painless, as does UFW on Linux. They take care of ICMPv6 requirements out of the box, otherwise I can see there being some pain to get RA working correctly without opening up too much.

Maybe Mikrotik does this too. I don’t know.

Yes, and yes it is :grinning_face_with_smiling_eyes:

Interesting thread. I’ve been experimenting with two approaches here…

Let hosts RA/SLAAC their Internet connectivity while simultaneously leasing a ULA from DHCP. I have only one gateway – my Internet router – and no internal subnets/VLANs (for now) so it’s a simple setup. One would think all this multihoming is a disaster but once configured it seems to do the right thing at all times.

Relevant Windows knobs:

Get-NetIPv6Protocol | select RandomizeIdentifiers,UseTemporaryAddresses

Get-NetIPInterface -ifIndex <x> -AddressFamily IPv6 | fl Dhcp,RouterDiscovery,ManagedAddressConfiguration,OtherStatefulConfiguration

What’s messing with this approach: some of my Windows hosts are perfectly happy with Dhcp,RouterDiscovery,ManagedAddressConfiguration,OtherStatefulConfiguration all enabled simultaneously. Other hosts insist upon mutual exclusivity across 1-2 of these and will reset the offenders after a restart. I’m pulling my hair out trying to find the source of the inconsistencies.

I’ve started looking at a second approach which is to fully overlap my ISP-assigned prefix delegation with my own DHCP. No ULAs involved.

Everything winds up with two GUAs in the same subnet; one SLAAC-formed and the other as a DHCP lease. My own DNS servers are assigned by DHCP and running on a pair of domain controllers, forwarding to the outside for anything not local. Default gateway assignment is SLAAC-composed.

Again it sounds like a trainwreck of traffic going out the wrong IP half the time… but somehow it works. DC discovery is fine, SRV records for AD services are registered with no issue.

It hasn’t been much fun. If it weren’t for my ISP forcing this due to their broken PTR delegation on the public Interest I’d not have bothered.