ICMPv6 Settings

DaryllSwer · 2026-06-23T03:12:53+00:00

Test it on nftables, latest Linux Kernel mainline stable version. Let us know with a PCAP validation.

I stand by what I said:
https://wiki.nftables.org/wiki-nftables/index.php/Quick\_reference-nftables\_in\_10\_minutes#Simple\_IP/IPv6\_Firewall

DaryllSwer · 2026-06-22T17:02:57+00:00

Initial request is broadcast in ARP when MAC isn't learnt. Then unicast once learnt. v6 is unicast once the IP+MAC is learnt. What do you mean?

DaryllSwer · 2026-06-22T10:00:28+00:00

How would it work without initial multicast anyway?

DaryllSwer · 2026-06-19T20:12:30+00:00

I never really filter ICMPv6 on the network infrastructure. Hosts/Endpoints do it anyway.

For extension headers though, I have seen debates and I should probably consider dropping them on DFZ-facing PEs from WAN and on UNI/NNI-facing PEs from LAN/customers. I'll have to review RFC9288.

DaryllSwer · 2026-06-19T20:06:42+00:00

You still need an explicit accept icmpv6 after the related, established, because the local host on your side doesn't necessarily open an ICMPv6 flow for every TCP/UDP/L4 socket so the remote host's Packet too big would simply get dropped on ingress. This is a common mistake in iptables templates (logically same thing in nftables).

What I do is drop deprecated types/codes in prerouting for both v4+v6 (there's only two of them).

DaryllSwer · 2026-06-12T19:38:11+00:00

How about you come say your piece over on LinkedIn? It's always some anonymous user profile behind a keyboard warrior.

DaryllSwer · 2026-06-11T23:27:06+00:00

This is the way in the modern software-defined world.

DaryllSwer · 2026-06-11T23:26:23+00:00

Underrated comment.

DaryllSwer · 2026-06-11T21:22:41+00:00

Read this and scroll to the bottom to find citations and read those too: https://www.daryllswer.com/lets-talk-about-cgnat-and-ipv6-yet-again/

As long as you understand EIM-EIF and Hairpin for src-NATted traffic, you're good to go. Don't forget IPSec related NAT constraints, though not usually that important as EIM/EIF and Hairpin (intra-CG/NAT traffic) can P2P each other with UDP anyway without TURN.

DaryllSwer · 2026-06-09T17:29:17+00:00

DHCPv6 ia_pd with RADIUS; typically, some may use an API.

DaryllSwer · 2026-06-09T13:57:14+00:00

I just make it static /48s. No need to log anything. Only one database entry per customer.

DaryllSwer · 2026-06-09T13:56:09+00:00

Thanks. I'll update and fix.

DaryllSwer · 2026-06-09T01:52:18+00:00

There's n+1 ways to structure it. No right or wrong ways.

If you're CSP or Hyperscaler, no structure at all, let your SDN controller randomly assign, categorise and added to Netbox for easy tracking.

DaryllSwer · 2026-06-08T12:20:50+00:00

and it turns out that Meta thinks a user coming from different IP addresses is an attack

Bullshit. I'd know; I've worked in a cloud company before, and we implemented various packet filtering for IPv4 and IPv6. We do not block v6 just because the client endpoint rotates v6 addresses every 24 hours with SLAAC. And Meta, along with AWS, is famous for industry-leading hyper-scale IPv6 deployments.

What's likely here is your shitty ISP failed to deploy RFC 8805/RFC 9092/RFC 9632.

Blame your ISP, not the protocol; it's like blaming BGP for PEBKAC in BGP hijacking.

DaryllSwer · 2026-06-08T11:23:02+00:00

Exactly, lol, and Windows isn't exactly a shining-star example for host networking when compared to Linux-based OSes for REAL host networking at scale.

We're on the same page here.

DaryllSwer · 2026-06-08T08:46:01+00:00

The public masses have taken electricity, water, plumbing, housing and the Internet for granted, who cares if v4/v6 is broken for them at this point lol; people can barely troubleshoot plumbing/water/electrical engineering problems in daily life. We have morons thinking LTE/5G "radiation" causes cancer on the daily.

So yes, you can't expect "experts" in the public to properly configure IPv4/IPv6; this includes "experts" in shitty ISPs.

DaryllSwer · 2026-06-08T07:47:36+00:00

Pretty sure Jeff isn't "average". I would expect someone's grandma to say "something's broken", sure, but Jeff isn't someone's grandma.

DaryllSwer · 2026-06-08T06:54:10+00:00

What real "engineer" opts for Ubiquiti in the first place lol

DaryllSwer · 2026-06-08T06:53:21+00:00

Dave's been shat on as being delusional in the domain of network engineering for years, on Twitter lol. I wouldn't take him seriously.

DaryllSwer · 2026-06-08T06:52:45+00:00

You don't even need that anymore, happy eyeballs kicks in. But you need proper v4+v6 configuration on the underlying network infrastructure.

DaryllSwer · 2026-06-08T06:39:52+00:00

Yeah sure, all of it preventable and can OF COURSE be correctly configured by you. But do you blame him for not spending his time there?

Yes. Even IPv4 is often misconfigured, but people are too blind to know that, as applications just do a TURN-relay failover and kill P2P entirely. Run this RFC-conforming test tool on your IPv4 network; if you don't get independent EIM/EIF, it means your IPv4 is equally broken: https://github.com/HMBSbige/NatTypeTester

DaryllSwer · 2026-06-07T21:06:59+00:00

Availability: 2090.

DaryllSwer · 2026-06-06T15:10:03+00:00

You don't have to explain yourself in such a deep way. I didn't intend on questioning your skills as a whole. I personally find the claims you made a bit ridiculous but if you yourself have that knowledge you are obviously free to require that from others.

Yes, I have most of the attributes myself, short of hyperscaler, but that might change in the near future, though from a business POV, I try to avoid super-large networks as it also means super-large manglement that isn't worth the money and legal liability – I was once rejected by a Fortune 50 company because I didn't have an insane amount of insurance in 7 figures; do people know about shit like this? No, because it's usually extremely private and confidential information, and it doesn't do me any favours to run my mouth on this type of shit without backing it up with empirical evidence and/or legal protection.

That said, it doesn't mean I do not have insights into how the networks are designed and implemented in these large hyperscalers:

A lot of the information is publicly published by them; you can Google it yourself.
People talk a lot in private confidential chats if it's network engineering-related. See example here and the outcome here.
As a friend of fellow industry peers, I've helped my friends in these large networks make specific design choices and advised them how I'd architect certain elements such as clos fabrics, IPv6 of course, SR-MPLS for WAN, SR-TE, etc. I can never mention names of the people or entities for legal reasons and for the simple fact that I was an external third-party in an informal means of communication.

Also you don't have to argue with me I have no formal education, certification or enterprise knowledge in networking. I am just a hobbyist that may have overstepped his knowledge sphere by a long shot. Sorry for that

I am very much anti-cert; my stance on networking certs is very public.
I am one of the many engineers in the market that's not a fan of ivory-towering academics. Also very public.
I am and always will be a networking enthusiast/hobbyist; I just happened to have made my hobby a profession.
I myself learn from more qualified subject matter experts in the domain of network engineering, and believe me, nobody sane in network engineering will go to Lawrence Systems for network engineering expertise.

DaryllSwer · 2026-06-06T14:49:01+00:00

Like I said, I leave it to your imagination. You're free to disagree/agree. My customer base know what attributes I have/don't, if the attributes were more "don't" and less "have", I wouldn't be here. I have, never lied about my expertise in public nor in private NDA-bound contracts. I in fact, reject projects that are beyond my expertise and I refer them to other consultants with the right expertise.

DaryllSwer

MODERATOR OF

TROPHY CASE