thanks for the elaborate reply! 

Am 12.04.20 um 19:33 schrieb Uwe Schindler:
> Hi
>> I have a setup in mind and wonder whether dnsmasq is the correct tool (since 
>> I
>> have not found the necessary functionality in the documentation yet).
>> We have a /56 IPv6 network, and plan to use pure DHCPv6 (no stateless
>> autoconfiguration) in several /64 networks.
> That's perfect. Looks much like a standard German DSL account. 😊

In our case, even better, since the prefix is completely fixed and will never 
change ;-). 

>> There are several subnets (currently NATed IPv4), such as — for example — a
>> WireGuard VPN network, or a local isolated subnet.
>> While with IPv4, the answer was the use of private addresses and NAT every
>> time, potentially using a DHCP fowarder, for IPv6, the answer should be to 
>> use
>> Global Unicast addresses everywhere (right?).
>> How do I approach this correctly?
> That's very easy because you have a /56 net.
>> Three options come to mind to handle such subnets:
>> - Use ULAs and NAT (but that does not feel like IPv6...).
> No no no, bad idea and very stupid for such a large network.

That's what I thought :-). 

>> - Delegate a prefix from the large network (where we'd use dnsmasq) to the
>> "gateway" machine, which then would be a router.
>>   However, I am not aware if dnsmasq can delegate prefixes?
> This should all be done on the central router. For each subnet you have a 
> separate dnsmasq.

Since we already have gateway nodes for IPv4, we'd rather scale the dnsmasqs 
out, but that does not seem to interfere with the proposed solution. 

>> - Use ProxyNDP (via npdpd or Linux kernel functionality). But I'm not sure if
>> that scales well to a larger number of machines?
> No need to do that (see below). ProxyNDP is only needed if you want delegate 
> some global addresses to devices that are in the same subnet but behind 
> another machine (MAC address). You don't need this. All can be done with 
> plain simple routing.

I see :-). 

>> - Use static routes on the central machine which send the /64 subnet to the
>> "gateways" and use dnsmasq on the gateways.
> That's the way to go and it will just work! Explanation:
> The provider delegates a /56 prefix to you. How this is done depends, but for 
> DSL (dynamic) or also at Hetzner (static) the whole thing works on the link 
> level addresses. For DSL you have the PPP-Daemon wo gets a link local address 
> on the end point assigned. For DSL you get a prefix delegated using DHCP-PD 
> (prefix delegation), for static roulds (e.g., Hetzner) you get all traffic 
> routed to the link-local address of your router (that's coming from the mac 
> address of router known to provider).
> On the router you just assign the subnets and their primary address (....:1) 
> to a separate interface or VLAN in portions of /64. The linux kernel will 
> then just automatically route all incoming packets from the WAN interface 
> (PPP or Ethernet) to the correct (virtual) network adaptor. On each of those 
> network adaptors you have a dnsmasq listening.

There's a slightly more special case for us: We have one central firewall 
(which gets the full /56 net on the upstream interface routed to it) and most 
gateways are separate nodes
(i.e. most VLANs are not connected to the central FW). 
So I believe in that case I just need an ip6tables rule (per /64 subnet) on the 
central firewall to redirect all traffic to the gateway for the /64 subnet, 

> Just some recommendation: I'd NOT go with DHCPv6, as no Chromebook or Android 
> device supports it. I'd go for SLAAC. Very easy. As you can setup a separate 
> /64 subnet (up to 256 of them), you have enough flexibility to handle all of 
> them in a separate network with full /64 SLAAC address space. Each of those 
> networks have firewalling on the router box and are delegate to the network 
> switch .e.g, via VLANs.

I know (while I knew about Android, good point about the Chromebooks!). Our 
main usecase is addressing of Linux servers (i.e. there will only be "DHCP 
reserved" entries). 
Indeed, for a general purpose network (one of those /64s), we need to think 
whether we'll go with DHCPv6 (and lose Android and Chromebooks) or really stay 
with DHCPv6. For now, I'll plan with DHCPv6 ;-). 

Cheers and thanks,

> If you are interested how to setup the Prefix Delegation with PPP, just ask. 
> The usual howtos seen on internet with wide-dhcpd are outdated and not very 
> modern and relying on a broken tool which should not be used anymore. The 
> correct way for that is "dhcpcd" client daemon listening on the PPP interface 
> and waiting for DHCP-PD packets. The dhcpcd config file can then 
> automatically split the delegated /56 network and assign it to various 
> real/virtual interfaces each with a /64 subnet, where a separate dnsmasq is 
> handling everything. No hacks needed, just plain routing on the bx (its 
> enough to enable ip forwarding unless you want to firewall). All on a single 
> box. I have set this up multiple times.
> Uwe

Dnsmasq-discuss mailing list

Reply via email to