I’ve mostly stuck with IPv4 in my LAN, but ive been wanting more and more to more to move to IPv6, if only for the learning experience. Since my ISP only uses 6rd and so I can’t get a static IP much less a GUA subnet to use, I’m trying to decide strategy for setting up the network, NAT, etc. And I know it’s probably not worth the effort, but again at this point it’s more a learning exercise.
I have an OpnSense router and use Unbound on it for DNS, Kea for DHCP, and Caddy for reverse proxy, so I am pretty flexible. What strategies have others employed? I use static addresses assigned at the router’s Kea DHCP service for IPv4 for all known devices. I have 4 VLANS for guest, mostly trusted devices like my phone and laptop, private stuff like my NAS, Home Assistant server, and Kubernetes cluster, and IoT for stuff that is private but I don’t have as much control over like light switches, cameras, and the TV. I use a pihole on the VLAN my personal devices are on to allow for ad, tracking, and malicious site blocking. And I use Pangolin for external access to some private services. And I have a domain dedicated to LAN devices and another for externally hosted VPS servers. Though I dont host much externally now that I finally got access to fiber and no more asymmetric, slow up speeds from Cable service.
I use static IPv4 addresses in Kea DHCP, mostly to assign devices to VLANs and give devices domain names. I’m guessing that will still be necessary. I rarely use the IP addresses in service setup or browsing to services if I can help it, just domain names. What other concerns should I consider?
Any experiences or advice for similar IPv4 to IPv6 LAN conversions would be greatly appreciated, so I can plan ahead.
I’m about the learning aspect. It is possible to have local IPV6 connectivity between devices, but only IPV4 for ingress and egress (IPv6-only LAN with IPv4-only WAN). Your router or access point will assign the IPv6 addresses to your devices usually via SLAAC or DHCPv6 and manages local IPv6 routing. Since there is no IPv6 route to the internet, it falls back to IPv4 if the application supports dual-stack or simply uses IPv4 if the OS is configured to prefer it. The router then translates or routes this traffic out via its IPv4 interface.
This is how I have configured my network. Not because my ISP doesn’t give me an IPV6 address, but because my commercial VPN does not support IPV6. In that scenario, there is a possibility of IPV6 ‘leaks’ outside of the VPN tunnel. I’m not sure about OpnSense, but pFsense has an option to enable IPv6 over IPv4 tunneling.
ETA: Did a little checking on OpnSense and it seems you can do IPV6 to IPV4 via a plugin called
os-6in4.What do you get out of IPv6 for lan routing vs just sticking to IPv4 for everything?
Off the top of my head you would gain some things like superior P2P between devices like NAS because IPV6 doesn’t need NAT traversal. Better plug 'n play for devices, no ip conflicts as the probability of two devices generating the same IPv6 address is statistically zero. I guess you could throw in ‘future proofing’ your network so that when the rest of the world catches up, you’ll already be set up for it.
I mean, I don’t have NAT traversal between my NAS and devices on my lan now, they are routed because they are different VLANs but that would happen anyway.
Do people have problem with ip conflicts? I guess if I wasn’t running DHCP that would be possible.
Right now NAT is my main firewall between most devices and the wider internet, but I do still run pfsense and have firewall rules in place.
Switching over to IPv6 seems like it would be extra work for very little actual benefit.
I mean, that’s a decision only you can make. I did it, well… because I could. LOL
You’d typically see LAN IPV6/WAN IPV4 in an office situation where there are a large number of devices and WAN IPV6 isn’t available.
That is a very valid reason. I could see setting it up to learn more about how IPv6 works. I just wanted to see if I could get any actual advantages with it.
That would make sense as a place to have it. Having a large number of devices where each having an external IP would be handy. My environment really only needs one or two devices having direct external access.