#dhcpv6 — Public Fediverse posts

#Kea 3.1.9 (dev) has been released ( #DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium ) https://www.isc.org/kea/

#Kea 3.1.9 (dev) has been released ( #DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium ) https://www.isc.org/kea/

Jeder, der Kunde der #DeutscheGlasfaser #DG ist, sollte bitte mal gucken, ob er zurzeit eine #IPv6 zugewiesen hat.

Wie ich von mir selbst, von Nachbarn und sogar Bekannten aus einem anderen Ortsteil weiß, ist die Zuweisung bei uns in der Gegend nämlich zurzeit gestört.

Der #DHCPv6 Server sendet folgende Antwort:

Status Code: NoAddrsAvail (2): "The server cannot assign an IPv6 address because the address pool for your network segment is completely exhausted."

[2/...]

Jeder, der Kunde der #DeutscheGlasfaser #DG ist, sollte bitte mal gucken, ob er zurzeit eine #IPv6 zugewiesen hat.

Wie ich von mir selbst, von Nachbarn und sogar Bekannten aus einem anderen Ortsteil weiß, ist die Zuweisung bei uns in der Gegend nämlich zurzeit gestört.

Der #DHCPv6 Server sendet folgende Antwort:

Status Code: NoAddrsAvail (2): "The server cannot assign an IPv6 address because the address pool for your network segment is completely exhausted."

[2/...]

RFC 9915: #DHCPv6

#IPv6 dispose de 3 mécanismes principaux pour l'allocation d'une adresse IP à une machine. L'allocation statique, « à la main », le système d'« autoconfiguration » SLAAC et #DHCP. DHCP pour IPv6 était normalisé dans le RFC 8415, que notre #RFC met à jour. Le protocole n'a guère changé, le principal changement est la suppression de certaines fonctions peu utilisées.

https://www.bortzmeyer.org/9915.html

RFC 9915: #DHCPv6

#IPv6 dispose de 3 mécanismes principaux pour l'allocation d'une adresse IP à une machine. L'allocation statique, « à la main », le système d'« autoconfiguration » SLAAC et #DHCP. DHCP pour IPv6 était normalisé dans le RFC 8415, que notre #RFC met à jour. Le protocole n'a guère changé, le principal changement est la suppression de certaines fonctions peu utilisées.

https://www.bortzmeyer.org/9915.html

Kea DHCP: Modern, open source DHCPv4 and DHCPv6 server

https://www.isc.org/kea/

#HackerNews #Kea #DHCP #open #source #DHCPv4 #DHCPv6 #server #ISC

Kea DHCP: Modern, open source DHCPv4 and DHCPv6 server

https://www.isc.org/kea/

#HackerNews #Kea #DHCP #open #source #DHCPv4 #DHCPv6 #server #ISC

About fucking time... Android finally doing proper DHCPv6. When this is live on my phone I can turn off SLAAC, and not have Windows insist on using it (yes, there's meant to be ways to stop Windows from using SLAAC, so it only uses DHCPv6, but I never saw any of them work). *I* don't want 'random' addresses, I want predictable ones for firewalling and ACLs: https://android-developers.googleblog.com/2025/09/simplifying-advanced-networking-with.html?m=1

#ipv6 #android #slaac #dhcpv6

About fucking time... Android finally doing proper DHCPv6. When this is live on my phone I can turn off SLAAC, and not have Windows insist on using it (yes, there's meant to be ways to stop Windows from using SLAAC, so it only uses DHCPv6, but I never saw any of them work). *I* don't want 'random' addresses, I want predictable ones for firewalling and ACLs: https://android-developers.googleblog.com/2025/09/simplifying-advanced-networking-with.html?m=1

#ipv6 #android #slaac #dhcpv6

[Перевод] Практическое руководство по атакам на IPv6 в локальной сети

Отключение IPv6 на шлюзе давно перестало быть надежной защитой. Протокол по умолчанию активен на большинстве клиентских машин, которые периодически отправляют в сеть служебные запросы вроде Router Solicitation. Именно эта «скрытая» активность открывает двери для целого класса атак, позволяющих перехватить трафик, подменить DNS или провести NTLM-Relay. В этой статье мы подробно, с примерами кода на Python/Scapy и командами для настройки, рассмотрим самые распространенные векторы атак на IPv6 в локальном сегменте: RA Spoofing: Как навязать себя в качестве шлюза по умолчанию. RDNSS Spoofing: Как стать DNS-сервером для современных ОС без DHCPv6. DHCPv6-атаки: Механика работы mitm6 и ее ручная реализация. Пассивный сбор данных: Как составить карту сети, просто слушая эфир. Материал будет полезен пентестерам, сетевым инженерам и системным администраторам, которые хотят понять реальные риски IPv6 и научиться им противостоять.

https://habr.com/ru/articles/930526/

#ipv6 #пентест #RA_Spoofing #RDNSS #DHCPv6 #Scapy #MITM #Kali_Linux #информационная_безопасность #infosec

I've published the -00 for a new IETF draft: #DHCPv6 Recommended #IPv6 Address Option"

https://datatracker.ietf.org/doc/html/draft-nygren-dhc-recommended-ipv6-address-00

The primary use-case for this is hosting, datacenter, and cloud environments that want to assign a /64 per host but which also want to ensure the host configures one or more addresses (such as for management and running services). Operators configuring servers in these environments want to be able to ensure that a host will be available on a given /128 (for ssh'ing into, putting into DNS as a service endpoint, etc) while DHCPv6-PD also means that the host is free to use the rest of the /64 for its own purposes (eg, containers, K8s pods, temporary addresses, etc).

I'd also be happy to add a co-author if someone else is interested in seeing this through.

I've published the -00 for a new IETF draft: #DHCPv6 Recommended #IPv6 Address Option"

https://datatracker.ietf.org/doc/html/draft-nygren-dhc-recommended-ipv6-address-00

The primary use-case for this is hosting, datacenter, and cloud environments that want to assign a /64 per host but which also want to ensure the host configures one or more addresses (such as for management and running services). Operators configuring servers in these environments want to be able to ensure that a host will be available on a given /128 (for ssh'ing into, putting into DNS as a service endpoint, etc) while DHCPv6-PD also means that the host is free to use the rest of the /64 for its own purposes (eg, containers, K8s pods, temporary addresses, etc).

I'd also be happy to add a co-author if someone else is interested in seeing this through.

What software do you use for #dhcpv6 ?

What software do you use for #dhcpv6 ?

For those who specialize in DHCPv6 and systemd: Is there a way to tell the DHCPv6 server "If this IP is available, just give me it, don't give me anything else", or at least get systemd to do that? I'm trying to make an oracle cloud instance running Arch+systemd-networkd that uses DHCPv6 for IP configuration only use one of two IPs assigned to the oracle instance, but leave the other one unused so I can do NDP proxying and route it to my laptop over wireguard, giving my laptop a public IPv6 address as a result, but it appears that oracle is forcing my VPS to use both IPv6 addresses, which is not what I want.
Redacted logs, for context:

Jun 18 06:08:27 somewhere systemd-networkd[-1]: eth0: DHCPv6 address 2000::4201/128 (valid for 1d 5
9min 59s, preferred for 23h 59min 59s)
Jun 18 06:08:27 somewhere systemd-networkd[-1]: eth0: DHCPv6 address 2000::1337/128 (valid for 1d 5
9min 59s, preferred for 23h 59min 59s)

Feel free to boost this for increased visibility if you wish, and if you know of any mailing lists or IRC channels I should ask on, please let me know.
Relevant tags to try to help people who might know something see this:
#dhcp #ipv6 #systemd #oracle #dhcpv6 #networking #systemdnetworkd #systemd-networkd

For those who specialize in DHCPv6 and systemd: Is there a way to tell the DHCPv6 server "If this IP is available, just give me it, don't give me anything else", or at least get systemd to do that? I'm trying to make an oracle cloud instance running Arch+systemd-networkd that uses DHCPv6 for IP configuration only use one of two IPs assigned to the oracle instance, but leave the other one unused so I can do NDP proxying and route it to my laptop over wireguard, giving my laptop a public IPv6 address as a result, but it appears that oracle is forcing my VPS to use both IPv6 addresses, which is not what I want.
Redacted logs, for context:

Jun 18 06:08:27 somewhere systemd-networkd[-1]: eth0: DHCPv6 address 2000::4201/128 (valid for 1d 5
9min 59s, preferred for 23h 59min 59s)
Jun 18 06:08:27 somewhere systemd-networkd[-1]: eth0: DHCPv6 address 2000::1337/128 (valid for 1d 5
9min 59s, preferred for 23h 59min 59s)

Feel free to boost this for increased visibility if you wish, and if you know of any mailing lists or IRC channels I should ask on, please let me know.
Relevant tags to try to help people who might know something see this:
#dhcp #ipv6 #systemd #oracle #dhcpv6 #networking #systemdnetworkd #systemd-networkd

#Kea 2.7.9 (dev) has been released (#DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium) https://www.isc.org/kea/

#Kea 2.7.9 (dev) has been released (#DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium) https://www.isc.org/kea/

#Kea 2.4.2 (old stable) has been released (#DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium) https://www.isc.org/kea/

#Kea 2.4.2 (old stable) has been released (#DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium) https://www.isc.org/kea/

#Kea 2.6.3 (stable) has been released (#DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium) https://www.isc.org/kea/

#Kea 2.6.3 (stable) has been released (#DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium) https://www.isc.org/kea/

#DHCPv6 isch au e Wüsseschaft für sich 😄
Aber die knack ich scho no, schwör!

Jedefalls: Persönleche Iidruck bishär isch, das falsch alles, was me so a Router überchund, sich mal hauptsächlech (au Feature-Mässig) uf IPv4 fokussiert, so das me praktisch zwunge isch, Dual Stack z fahre.
Ich glaube darum, NAT isch cho, um z bliibe - für immer 🙃

IPv6-only, anyone? 😅

#Dnsmasq 2.91 has been released (#DNS / #AAAA / #CNAME / #PTR / #DNSSEC / #DHCP / #DHCPv4 / #DHCPv6 / #BOOTP / #TFTP / #PXE) https://thekelleys.org.uk/dnsmasq/doc.html

#Dnsmasq 2.91 has been released (#DNS / #AAAA / #CNAME / #PTR / #DNSSEC / #DHCP / #DHCPv4 / #DHCPv6 / #BOOTP / #TFTP / #PXE) https://thekelleys.org.uk/dnsmasq/doc.html

[Update: yes, at least on Launtel]

#IPv6 experts, is #DHCPv6 *required* for Prefix Delegation?

My ISP seems to send Router Advertisements with a single address out of a /64 (should that be a /128?), but OpenWrt is sending a DHCPv6 request to get my normal /48

#AskFedi

[Update: yes, at least on Launtel]

#IPv6 experts, is #DHCPv6 *required* for Prefix Delegation?

My ISP seems to send Router Advertisements with a single address out of a /64 (should that be a /128?), but OpenWrt is sending a DHCPv6 request to get my normal /48

#AskFedi

Ha! Great news from #MikroTik #RouterOS changelog. Looks like somebody finally tried to use #DHCPv6 Relay and figured out it was completely useless for DHCP-PD.

7.18
*) dhcpv6-relay - added option to create routes for bindings passing through relay;
7.18.1
*) dhcpv6-relay - clear saved routes on DHCP release;

https://mikrotik.com/download/changelogs

Ha! Great news from #MikroTik #RouterOS changelog. Looks like somebody finally tried to use #DHCPv6 Relay and figured out it was completely useless for DHCP-PD.

7.18
*) dhcpv6-relay - added option to create routes for bindings passing through relay;
7.18.1
*) dhcpv6-relay - clear saved routes on DHCP release;

https://mikrotik.com/download/changelogs

**IPv6 connectivity and Synology Router**

Read it on my blog, it has a nicer image/text layout.

I’m writing this blog post for other users of Telekom SI who wonder ‘How to establish IPv6 connection on Synology RT6600ax router‘?

The issue: which IPv6 mode?

Maybe it is obvious how to setup IPv6 connection for networking professionals, for me it wasn’t. It took me few days before I managed to connect to IPv6.

The story went like this.

1. Firstly I connected Synology router to the Innobox G92 modem and Telekom support put it in bridge mode (more about wifi mesh issues).
2. I activated a static IPv4 and IPv6 address in ‘Moj Telekom’ portal.
   • I got IPv6 address in the form of: xxxx:xxx:xxxx:xxxx:0:0:0:0/56
3. I wanted to activate IPv6 connection (Network center / Internet / IPv6 setup). There were 8 possibilities (Auto, Manual, 6in4, 6to4, DHCPv6-PD, IPv6 relay and FLET’s IPv6 service)

1. I was puzzled and called Telekom SI support. They had no clue and said it should work automatically. ‘Auto‘ mode in IPv6 setup didn’t work.
2. I tried to activate it by using ‘Manual‘ mode. I entered the following:
   • IPv6 address: I tried xxxx:xxx:xxxx:xxxx:0:0:0:0 and xxxx:xxx:xxxx:xxxx:0:0:0:1
   • Prefix length: 64
   • Gateway: the number was filled automatically (local modem address I think) fe80: ….
   • Preferred DNS server: left as it was
   • Prefix: I entered the address I got in the form xxxx:xxx:xxxx:xxxx:: (double semicolons at the end) /56

And it worked! But not for long. Next day, modem showed it was connected, but when I checked my IP (https://whatismyipaddress.com/), it didn’t show my IPv6 address and the network behaved strangely. I clicked DHCPv6-PD and then back to ‘manual’ and it worked again. But every day the connection broke and I have to repeat the procedure.

The solution – DHCPv6-PD

Then I read some German and Polish forums and found out they use DHCPv6-PD mode.

I tried it and it works! The SRM user interface behaves very strange – when I switch mode (IPv6 Setup pulldown) to DHPv6 I can not set prefix, DNS server etc. The solution was that I switched to ‘manual’ first, clicked OK, opened the setup again and switched to DHCPv6-PD. Then it worked.

The IPv6 connection is now stable.

Nevertheless, this setup works strange: Every day the router gets a new IPv6 address (DIFFERENT from the assigned static IPv6 range). Maybe because of security or something. But my devices have correct IPv6 addresses (from the assigned range).

Most probably, I just don’t know well enough how IPv6 works.

LAN setup

After establishing IPv6 Internet connection, I enabled IPv6 on my LAN.

Finally I could choose the prefix (xxxx:xxx:xxxx:xxx0-7::). As long as the setup on the ‘Internet’ page was wrong, I couldn’t select the prefix in LAN setup.

I’ve selected ‘Stateless DHCPv6 mode’.

I’ve also set static IPv6 addresses to my 2 Piholes and entered them here.

TL;DR

The good:

At the end, I’ve managed to setup IPv6 connection, it works and I’m already using it. I’ve noticed some minor speedups when accessing some web pages.

The bad:

ISP (Telekom SI) could explain somewhere how to connect to IPv6 in some document or FAQ. And educate its helpdesk support. Basic instructions (like – choose DHCPv6-PD) would be nice.

Synology could improve IPv6 setup menu. As it is currently designed (greyed out input fields that can be changed only when choosing ‘manual’ mode), it is completely illogical to me.

Disclaimer

1. I don’t promote any products here, neither I receive any compensation to mention them.
2. I’m no networking professional, I just throw shit at the wall and observe if anything sticks. Feel free to correct me.

Tags: #synology #innobox #ipv6 #telekomsi #DHCPv6-PD

https://blog.rozman.info/ipv6-connectivity-and-synology-router/

#DHCPv6 #innobox #ipv6 #synology #telekomsi

So … my ideal DDI solution consists of:
- #Kea #DHCPv4 #DHCPv6
- #PowerDNS Auth
- #ISC #Stork for Kea Management
- Custom application, that can
- Translate Kea Leases into a PowerDNS Remote backend
- Manipulate PowerDNS through its HTTP Api (i.e. an Admin interface)

Stork apparently got the ability to manage/configure Kea, so that's something I don't have to build.

Why not NSUpdate? Because it sucks.

#HomeLab #Network

@_elena it is interesting how #DNS and #Fediverse apps will "heal" themselves. For example if #Sidekiq goes down, when you restore it, it takes a few minutes for federation to complete

For DNS , #DNSv6 and #DHCPv6 should improve it a little bit

@_elena it is interesting how #DNS and #Fediverse apps will "heal" themselves. For example if #Sidekiq goes down, when you restore it, it takes a few minutes for federation to complete

For DNS , #DNSv6 and #DHCPv6 should improve it a little bit

@litchralee_v6 Yeah, ip security cameras can be a pain. Luckily we are almost exclusively a single camera brand that has had decent #ipv6 support for a long time. They even support #dhcpv6 which is nice.

@litchralee_v6 Yeah, ip security cameras can be a pain. Luckily we are almost exclusively a single camera brand that has had decent #ipv6 support for a long time. They even support #dhcpv6 which is nice.

Oh, that's why me KEA dhcpv6 configuration wasn't working:

1) I'd converted the configuration over from my prior isc-dhcpv6 one.
2) The configuration has some fixed address assignments, specified via duid, but these weren't working.
3) The dhcpv6 'ADVERTISE' message in this case was saying "Server could not select subnet for this client".

It turns out that the example configuration makes NO MENTION of needing an `"interface": "..."` stanza within the `"subnet6"` section. This is to tell the server the network is local and that, yes, it can reach such clients.

#isc #kea #isckea #dhcpv6 #linux

Oh, that's why me KEA dhcpv6 configuration wasn't working:

1) I'd converted the configuration over from my prior isc-dhcpv6 one.
2) The configuration has some fixed address assignments, specified via duid, but these weren't working.
3) The dhcpv6 'ADVERTISE' message in this case was saying "Server could not select subnet for this client".

It turns out that the example configuration makes NO MENTION of needing an `"interface": "..."` stanza within the `"subnet6"` section. This is to tell the server the network is local and that, yes, it can reach such clients.

#isc #kea #isckea #dhcpv6 #linux

#Kea 2.7.0 (dev) has been released (#DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium) https://www.isc.org/kea/

dhcp6leased(8) imported to -current https://www.undeadly.org/cgi?action=article;sid=20240604085042 #openbsd #ipv6 #dhcp6leased #networking #dhcpv6

#Kea 2.6.0 (stable) has been released (#DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium) https://www.isc.org/kea/

After assigning a prefix via #DHCPv6 to a client router, the #MikroTik #router with #RouterOS 7.13.5 adds a default route via the corresponding interface. Which is unfortunate, because the router already had a default route on a different interface. And RouterOS 7.14.1 (the latest version) still seems to have a broken routing setup for VRFs. Great. Not.
#WhyIsIPv6BrokenEverywhere #IPv6