SLAAC seems to introduce insane churn in the IPv6 of end user devices.
SLAAC (vs DHCPv6) seems to struggle in fully configuring an end user device (think DNS servers etc.
As someone who has beat my head on the IPv6 thing for a bit before giving up (I tried to go all IPv6), what is the "proper" way to setup a home IPv6 network with SLAAC and not DHCPv6?
If DHCPv6 for some reason is essentially always required, why not let subsume SLAAC for IP address assignments?
> SLAAC seems to introduce insane churn in the IPv6 of end user devices.
By "insane churn" do you mean "devices generate and allocate new IP addresses for themselves periodically (maybe daily, maybe more frequently)"? If you do, then that's not SLAAC, that's the head-assed thing sometimes known as "IPv6 Privacy Addresses". From what I've seen on Windows, OSX, and Linux, this makes it so that there's one IP that remains constant, and a parade of addresses that get assigned as time marches on. You can disable it on Windows, OSX, and Linux, and I would recommend doing so.
> SLAAC (vs DHCPv6) seems to struggle in fully configuring an end user device (think DNS servers etc.
Yeah, if you're interested in only using SLAAC, then the best you can do is set the `RDNSS` option [0] in your Router Advertisements and pray that the network configurator in the OS you're using has bothered to pay attention to it.
[0] <https://www.rfc-editor.org/rfc/rfc8106#section-5.1> (Do note that despite the date on this RFC, this option was first specified in 2007, and first specified in a non-experimental RFC in 2010... so, it's not like it's new.)
Always learning something, RDNSS - cool. It always felt silly to have this whole system, and STILL need DHCP to do basic stuff. Glad to hear the ipv6 purists CAN avoid the DHCP server. Practically I think it's here to stay for a bit.
I think privacy extensions are unavoidable - they default on in many places. So I'm leaving them. Some devices actually rotate more often (ie, when connecting to different wifi points even if underlying network is the same, apple seems to generate another new IP). But compared to ipv4 (where you can almost immediately trace from an IP you have in a log to device) -> you need more support in your tooling to do that with IPv6 and privacy extensions.
> But compared to ipv4 (where you can almost immediately trace from an IP you have in a log to device...
Honestly, given that the vast majority of the sites that use v6 "privacy addresses" are going to be end-users at their home, and that most of those folks are going to be either using web browsers, and/or already logged into the servers that are servicing their requests, there are so very, _very_ many powerful ways that folks can be tracked that have absolutely nothing to do with their IP address.
"Privacy addresses" are just a nuisance.
> Some devices actually rotate more often (ie, when connecting to different wifi points even if underlying network is the same, apple seems to generate another new IP).
I'm not sure _exactly_ the setup you're talking about. If "connecting to different wifi points" means "disconnecting from one SSID and connecting to another SSID but still being on the same physical network", then I think that this is OSX randomizing your MAC address and/or OSX generating a new DUID when connecting to a different SSID.
Any sane home router should make it Just Work. All the router has to do is advertise which address prefix your ISP gave you, and your device just chooses an address under that prefix. It couldn't really be simpler - even DHCP is more complex.
However, it only handles your address. Apparently there's an extension to make it also provide DNS addresses and so on. If you don't have that, then I guess you configure DNS manually. Or use 8.8.8.8.
It's not like your router is doing some magic DNS auto-discovery, by the way. It just tells devices the addresses that someone typed into its own configuration page.
First of all, can you point me in the direction where I can get a static IPv6 block from AT&T easily so it will "just work"? Or maybe google fiber for IPv6? [1]
There is currently more of a shortage of IPv6 (!!) in terms of getting a static block then there is with IPv4 in my experience.
I'm really tired of hearing it will "Just work" - that's proven to be a lie over and over. But I would love to be shown where these major players do their static blocks for ipv6 (having fought this fight for a while).
Are you using comcast? I think they only DYNAMICALLY assign you a 64 - so you can only create ONE subnet on your entire network. Again illustrating the shortage and difficulty in using IPv6. I'd thought /48 would be minimum PD, but that is not the case. Or even a /60? No go. There are workarounds I'm aware of, but this stuff absolutely DOES NOT "just work".
Really hoping you come back and read this comment, but perhaps I am too late:
> Are you using comcast? I think they only DYNAMICALLY assign you a 64...
In my experience here in San Francisco with both IPv4 and IPv6 service (and IPv4 service elsewhere in the US years and years ago) Comcast will give you a v4 IP (or v6 subnet) for as long as the same edge device (or an edge device with the same MAC address (or DUID for v6)) continues to renew the lease. So, yeah, it's dynamic in theory, but static in practice.
> Or even a /60 [via DHCPv6-PD]?
Weird. Configuring my DHCPv6 server to do Prefix Delegation and request a /60 always worked just fine for me. I was disappointed that I couldn't get a /56 or /48, but was okay with the /60 that they gave me. Again, this was in San Francisco, so maybe other parts of the country are managed _way_ differently. Maybe.
Alternatively, are you _sure_ that the DHCP-PD request was refused and that that you didn't -say- fail to configure your system to actually assign slices of the /60 to your LAN?
...
Actually, now that I'm thinking about it, I seem to recall a problem like you're describing.
If I'm not misremembering that I had this sort of problem, then, maybe, try configuring your edge device to ask for a /60, change the DUID that it will use to make the request, and then bounce the WAN interface (or reboot the device, or do whatever is required to apply the changes). My memory is absolute shit (and likes to hallucinate things that never happened), so this might not do anything useful. But it's usually a pretty easy thing to try.
SLAAC seems to introduce insane churn in the IPv6 of end user devices. SLAAC (vs DHCPv6) seems to struggle in fully configuring an end user device (think DNS servers etc.
As someone who has beat my head on the IPv6 thing for a bit before giving up (I tried to go all IPv6), what is the "proper" way to setup a home IPv6 network with SLAAC and not DHCPv6?
If DHCPv6 for some reason is essentially always required, why not let subsume SLAAC for IP address assignments?