Gfrktyl

Let me start by asking to skip dual-stack discussions at this time. Any device that can only handle IPV4 only is stuck there and I'll worry about it later, if I need to. So this discussion is just about IPV6.

I am using an Ubiquiti Firewall/router and it's currently setup for IPv4 with NAT (I want to keep that). I'm looking to setup IPV6 but I have a lot of questions. I've played with IPv6 tunnels a few years back it it seemed to work well. But I'm no longer using it. Now I want to get the IPV6 from my ISP (/60), split it at the FW/router (/64, Int 1 and Int 2) and have a separate server run the DHCP/DNS (dnsmasq, for local DNS). I'm not exactly sure where to start. I think I have a config for my FW/router (still checking it) but I'm uncertain how to get the network assignment to the DHCP server. I'm running dnsmasq on a Linux sever (but I can switch to some other software). I'm not as concerned with how to configure the DHCP/DNS as I am about what technologies (RFCs) I should understand. Does anyone have any pointers?

PS: My network is actually more complicated with redundant services but I'll simplify to just the FW/router, the one network and dnsmasq.

Now I want to get the IPV6 from my ISP (/60)

With most ISPs on a standard consumer plan, your WAN router will need to run a DHCPv6-PD client on the WAN side, to request a "prefix delegation" (IA_PD) of the desired size.

Smaller and/or business-oriented ISPs might also perform manual prefix assignments, e.g. via support ticket. This works like it does in IPv4. It doesn't require any software on your router's WAN side, just static address/route configuration.

Finally, if you have a multi-homed network (and a /48 at minimum), you might have to advertise your prefix using BGP to all your ISPs. This also works exactly the same way as it does in IPv4. But I suspect this is irrelevant to your current network.

split it at the FW/router (/64, Int 1 and Int 2)

If the ISP has statically routed a /60 to you, then just manually pick two /64's out of it and assign corresponding addresses to the router's LAN interfaces.

But when using DHCPv6-PD, it depends on the ISP as to how dynamic the delegated prefix actually is – if you're lucky, you'll keep the same prefix forever (or at least as long as your router keeps the same DHCPv6 DUID/IAID, I think); if you're unlucky, the prefix can even change daily.

This means that once the DHCPv6-PD client has received a prefix delegation lease, it needs to use some internal scripts or 'hooks' to automatically configure that prefix elsewhere on the system (that is, to assign subnets on the router's LAN interfaces and put them in your dnsmasq.conf or radvd.conf).

I assume Ubiquiti router firmware would do this automatically. If using dhclient, everything would be done through dhclient-exit-hooks.d.

have a separate server run the DHCP/DNS (dnsmasq, for local DNS)

DHCPv6 is a secondary autoconfiguration protocol in IPv6 – the primary method is through ICMPv6 Neighbour Discovery Protocol, specifically the Router Advertisement packets (which can be sent by radvd, dnsmasq, or bird).

• All systems can autoconfigure their own address from ICMPv6 RA (i.e. SLAAC), but only some support doing so from DHCPv6.




• Obtaining the DNS server address is even more mixed – some systems can only use DHCPv6 for this, others only use ICMPv6 RA (i.e. RDNSS), some support both, and some support neither.




• You can move most DHCPv6 and ICMPv6 RA features to a separate server, but – as far as I know – the router must still send its own RAs to advertise itself as the "default gateway".




• From what I know, there is no "DHCP Relay" equivalent to ICMPv6 RA – the advertisements must be sent directly within the target subnet.