ULAs with IPv6 Privacy Extensions

[TonyArrr]

So I’m getting IPv6 gradually enabled on my home network, Vlan by Vlan, and have run into an interesting interaction with Pirvacy extensions and ULAs

My current ISP doesn’t guarantee the same v6 prefix back if you’re disconnected for over 60 minutes (I know, I know) but churning ISPs here is also pretty normal since the fibre infrastructure is nationalised, so the ISPs actually compete and frequently offer sign-up deals, I I’ve been setting up with ULAs hanging around to keep a coherent network when the prefix changes. (My core router handling intervlan duties does not accept PDs from upstream, so I have to update the GUAs on its interfaces by hand)

In setting the GUA and ULA stack, I’ve noticed that for my systems with privacy extensions enabled, it is either enabled for both GUA and ULA, or for neither.

I’d like to have my GUAs with privacy addresses when going out to the public internet, but for comms between my servers and clients, I’d rather be using the stable ULA addresses, instead of the temp ones, to make troubleshooting issues easier (logs having IPs that no longer exist have reduced functionality).

I’m running Debian 13 with SystemD-NetworkD pretty much everywhere, but have been unable to find an option to turn off temporary addresses for ULAs, but keep them for GUAs, the closest seems to be deciding per interface. Anyone have any pointers?

 

[luckylinux]

I’d like to have my GUAs with privacy addresses when going out to the public internet, but for comms between my servers and clients, I’d rather be using the stable ULA addresses, instead of the temp ones, to make troubleshooting issues easier (logs having IPs that no longer exist have reduced functionality).

I’m running Debian 13 with SystemD-NetworkD pretty much everywhere, but have been unable to find an option to turn off temporary addresses for ULAs, but keep them for GUAs, the closest seems to be deciding per interface. Anyone have any pointers?

Maybe /etc/gai.conf ?

Google Gemini seems to suggest some hybrid SLAAC + RA (GUA) + DHCPv6 (ULA) approach, not sure if that works


Alternatively:


I have my own set of Issues with IPv6 (NPTv6 with dual WAN), absolute nightmare, since OPNSense's dpinger is stateless and thus really misbehave with NAT (and all Gateways get market as down even though they work as they should, and normal ping works).

 

[TonyArrr]

Maybe /etc/gai.conf ?

gai.conf, I think I could use that to manually wire up decision making on a case by case basis with that, but it'd be heckin' messy, that's for sure.

Google Gemini seems to suggest some hybrid SLAAC + RA (GUA) + DHCPv6 (ULA) approach

Interesting that Google's bot would suggest a solution that would not work for any Google product
For solution 2, is it basically saying to create a separate VLAN for each ULA subnet...? Seems very overkill, although it seems to be alluding to somehow filtering ULA and GUA traffic from a single L2 domain into separate VLANs on the host and back again, which is.... interesting as a concept... not sure how that would work in reality without writing my own network kernel extension....

I have my own set of Issues with IPv6 (NPTv6 with dual WAN), absolute nightmare, since OPNSense's dpinger is stateless and thus really misbehave with NAT

Yeah I gave up on PF/OPNSense a long time ago, when they stopped supporting DHCP relayed address assignment flatly it was a good hint that they have specific network setups they both were catering too and weren't to concerned with being flexible.
OpenWRT definitely seems to handle a lot of IPv6 stuff a lot better, though you kinda need to be able to read the source, cause while they write great code, their documentation skills are pretty poor..

 

[luckylinux]

OpenWRT definitely seems to handle a lot of IPv6 stuff a lot better, though you kinda need to be able to read the source, cause while they write great code, their documentation skills are pretty poor..

Not really IMHO. The seem to suggest to do NPTv6 hacked through some dynamic Scripts via iptables / nftables, but I couldn't really get it to work.

I still have lots of IPv6 Issues, let's say you are OK if you can get:
- ICMP ping working from internal network to internet
- ICMP ping working from internet to internal network (if desired)
- UDP traceroute working from internal network to internet
- UDP traceroute working from internet to internal network (if desired)
- TCP curl working from internal network to internet
- TCP curl working from internet to internal network (if desired)

I always have some Issues in one Direction and/or at least with one Protocol, there aren't easy Solutions.

Advertising all IPv6 prefixes to Clients isn't also super reliable because if the Network goes down, the Client still wants to use say GUA1 and OPNSense wanted to force it down GUA2's Gateway. All sort of weird Issues, asymmetric Routing, etc.

 

[TonyArrr]

Not really IMHO. The seem to suggest to do NPTv6 hacked through some dynamic Scripts via iptables / nftables, but I couldn't really get it to work.

I must admit I haven't done anything with NPTv6, my network is either Dual Stack or IPv4, depending on the VLAN at the moment.

I did read that Multi-homed environments weren't super well supported outside of the enterprise network stacks when I was looking up details on PCP. As much as I'd love to have a backup link for some of my self-hosted stuff, it does get my head in a bit of a spin when I look haha

I am in the process of replacing the OpenWRT VM that acts as my WAN firewall with a plain Debian install, just to simplify things and make it all more accessible since just about every network related utility is better documented than most of OpenWRT.
I did have a much better time getting it up and running than I did with the *Senses and Vyos, but just about every time I have a "niche" config issue or question, I'll find quick and easy answers for SystemD-NetworkD or ifconfig and so on, but it takes a pile of digging to find the OpenWRT route.