Dual Stack home network pros and cons

[dave14305]

Does it increase the workload by increasing the blocklist size when IPv6 is enabled? It was @dave14305 observation in previous discussion.

It doubles the size of the blockinglist. On my old AC68U, I must have been using a larger than normal block list.

Since you keep alluding to comments from my younger, dumber self, this is the thread in question:

Pros/Cons of enabling IPv6

Guess that will depend on if he has an IPv6 connection to test with. Worst case, we'll do the testing for him :)

www.snbforums.com

 

[Tech9]

Nothing I would be worried about.

If someone is currently using the Large list, >1M entries, with IPv6 enabled it will be >2M entries. I expect my test AC1900P to hang.

 

[heysoundude]

Confirmed on non-HND router, RT-AC1900P. Must be HND related.

Here is my guinea pig certificate:

People need to understand how important having a FQDN hostname is -
IF I recall correctly, by fully qualifying a domain name with A/AAAA records, you also (must?) get an SSL cert and that gets you toeing the DNSSEC/IPSEC line(s).

What we really need around here is someone with some Cisco Certification behind them to swoop in and tell us what we're doing wrong rather than the FUD/suppositional arguing going on. I don't think anyone with any security credentials at all spends any time here...and that's a shame. right?

 

[thelonelycoder]

Well, @RMerlin and @thelonelycoder ISP's don't support IPv6. Skynet does nothing with IPv6. OpenVPN was IPv4 only yesterday. You are the one to test.

This to me sounds like IPv6 just came out of hiding and suddenly appeared in the Asus router WebUI.
When In fact Diversion and it’s predecessor AB-Solution had it supported for about five years now. And so has Asuswrt-Merlin - for much longer.
It works on my end, and very likely on a high number of installations, without a complaint.

 

[thelonelycoder]

If someone is currently using the Large list, >1M entries, with IPv6 enabled it will be >2M entries. I expect my test AC1900P to hang.

That’s what the swap file is for.

 

[dave14305]

I don't think anyone with any security credentials at all spends any time here...and that's a shame. right?

It is a shame that the forum seems to attract more “askers” than “answerers.” That may be the nature of forums, of course, but this thread is a good example of everyone looking at each other, sharing incomplete information.

If you want answers nowadays, you need to learn how to read the source code for yourself.

 

[Tech9]

rather than the FUD/suppositional arguing going on

You personally have no good explanation why you have enabled IPv6 on your network. You also demonstrate no good understanding how IPv6 works on your network. Better stop categorizing other's opinion. I'm spending time to test things on two different platform routers at the moment.

That’s what the swap file is for.

I tested the Large blocklist before. I'll let you know for how long the router is unresponsive with >2M. Let me finish with IPv6 XXX first.

 

[Tech9]

If you want answers nowadays, you need to learn how to read the source code for yourself.

Well, only a few can read source code in this thread. >90% of this forum content is questions from people who need answers. I don't like when people who can read the source code don't take questions seriously. Your own serious thread 2 years ago produced similar results. What's different now?

 

[heysoundude]

It is a shame that the forum seems to attract more “askers” than “answerers.” That may be the nature of forums, of course, but this thread is a good example of everyone looking at each other, sharing incomplete information.

If you want answers nowadays, you need to learn how to read the source code for yourself.

This is the savage truth!

 

[heysoundude]

You personally have no good explanation why you have enabled IPv6 on your network. You also demonstrate no good understanding how IPv6 works on your network. Better stop categorizing other's opinion. I'm spending time to test things on two different platform routers at the moment.

I'm sorry that "because I can" isn't acceptable to you...but that's a "you problem."

 

[Christos]

I believe the most important part, after security of course, is how big is the amount of servers on the internet that use IPv6.
Because if it is only Google and FB, then maybe it's not worth it.
One way to test this is to remove IPv4 from your pc and leave only IPv6 with a v6 DNS. Can you reach all the sites you need?

 

[Tech9]

I'm sorry that "because I can" isn't acceptable to you

You can disable the firewall in GUI as well, @heysoundude. Just don't recommend it to others. This is my point, not a problem.

Because if it is only Google and FB, then maybe it's not worth it.

From what I see so far, very few other than Google/Facebook services use IPv6. I'm having difficulties finding IPv6 test sites for Parental Controls.

 

[Christos]

I'm having difficulties finding IPv6 test sites for Parental Controls

Parental Controls are based on domain lists, so they still work when the sites use IPv6 or dynamic IPv4 that changes frequently.

 

[dave14305]

I don't like when people who can read the source code don't take questions seriously. Your own serious thread 2 years ago produced similar results. What's different now?

Who can give you a satisfactory answer to your questions? The lone firmware developer without a native IPv6 connection? The putz QoS guy who doesn’t run the firmware anymore?

2 years ago I didn’t have a strong starting position in my head when I started my thread. This thread seems to have started with some bias. But welcome to the internet!

 

[Tech9]

Who can give you a satisfactory answer to your questions?

The thread is open for everyone. Let's see if we know more about IPv6 after 2 years, as a community. I find the two threads very similar, with very similar answers and conclusions. I don't think we know more. There is only more enthusiasm to test IPv6. I'll change the thread title to "... 2022", if you like.

 

[Tech9]

A strange effect after enabling IPv6 - NordVPN site loads in Chinese:

Location got messed up, I guess.

 

[Frank Monroe]

Well, @RMerlin and @thelonelycoder ISP's don't support IPv6. Skynet does nothing with IPv6. OpenVPN was IPv4 only yesterday. You are the one to test.

I don't. know if this helps or not. But, even if his ISP doesn't support IPv6, he can go to Hurricane Electric and sign-up and use their IPv6 tunnel broker. They will assign you up to five delegated prefixes/subnets that are fully routable on the internet. The subnets are delegated and clients can be assigned via SLAAC or DHCPv6 running on your internal network. The service has been around for years and is still free.

 

[dave14305]

RFC 7707: Network Reconnaissance in IPv6 Networks

IPv6 offers a much larger address space than that of its IPv4 counterpart. An IPv6 subnet of size /64 can (in theory) accommodate approximately 1.844 * 10^19 hosts, thus resulting in a much lower host density (#hosts/#addresses) than is typical in IPv4 networks, where a site typically has 65,000...

datatracker.ietf.org

Just started reading this. Don’t spoil the ending.

 

[Tech9]

The service has been around for years and is still free.

Tunnels, Native and Passthrough are different. I don't know if they produce the same results. Security approach is different for sure.

Just started reading this.

LOL, I'm somewhere in the middle of it. Exactly the same document.

 

[Christos]

Location got messed up

Also EDNS Client Subnet has problems with IPv6 and DNS servers send you to servers far away.
Check this post from Adguard DNS https://adguard.com/en/blog/dns-google-domains-fixed.html

You see, AdGuard DNS servers have several IP addresses — IPv6 as well as IPv4. And it seems Google failed to detect the IP address location properly when IPv6 was in use. They were serving records for China instead of the records for AdGuard DNS servers location.