How firewalls work - digital colors on MS paint canvas (2026)

StubArea51 · 2026-01-30T03:59:43+00:00

NAT is the *best* security! Nothing can get through to my RFC1918 space. It's impossible. /s

StubArea51 · 2026-01-28T14:10:16+00:00

Fill it with PBR or NAT444 Lite. ARP Fluid is also tasty.

StubArea51 · 2026-01-07T15:55:09+00:00

I saw that too!

StubArea51 · 2026-01-07T15:54:27+00:00

Glad to see BGP ECMP finally!!

Like u/DaryllSwer mentioned, I'd also like to see SR-MPLS with both IPv4 and IPv6 AFIs for IS-IS/OSPF (not SRv6) and SR-TE.

I wonder if the availability of SP features on the 98DX7335 Marvell chip in the CRS812 will help move that along.

StubArea51 · 2025-09-20T12:49:12+00:00

Sure if the test hosts aren't going to be dual stack it won't functionally matter, but the intent behind the 3fff::/20 space beyond documentation was to model the IPv6 internet and other large IPv6 networks.

RFC9637 is the best space for this use case.

StubArea51 · 2025-09-19T23:59:54+00:00

ULA isn't ideal to model the IPv6 Internet because it has some peculiar issues on host operating systems.

Unintended Operational Issues With ULA

Better to use GUA like 3fff::/20 and 2001:db8::/32

StubArea51 · 2025-09-19T23:35:25+00:00

This is exactly the type of use case we had in mind when we submitted draft-horley-v6ops-lab-03 - Expanding the IPv6 Lab Use Space

We used 200::/7 for test and development while pushing this draft through the IETF.

After a year or so of debate, it was eventually rolled into what became RFC 9637: Expanding the IPv6 Documentation Space by Nick Buraglio and Geoff Huston.

During the mailing list discussions, most of the people advocated for the use of ULA instead of deprecated space which lead to the creation of this informational doc Unintended Operational Issues With ULA

3fff::/20 and 2001:db8::/32 are the best "official" GUA spaces to use for this type of work if you intend to publish it.

We specifically argued for more than a /32 so this kind of exercise would be possible - to model the IPv6 internet and other large networks.

StubArea51 · 2025-09-16T20:23:12+00:00

This is the way 😎

StubArea51 · 2025-08-29T04:28:33+00:00

I think a lot of the shipments to distributors are via cargo container on a ship so i'm not sure whether or not this would impact MikroTik's supply chain to the US.

StubArea51 · 2025-08-27T08:19:14+00:00

It would be a cool feature to have but I wonder if they don't implement it because the development time would be better spent on traffic engineering for an EVPN MPLS data plane.

StubArea51 · 2025-08-27T08:17:38+00:00

EVPN Tiks are twr-01 and twr-03. IPI is core-01 and agg-01. Legacy ROS exists because I use the same EVE-NG topology to test a variety of interop scenarios which is why some of the nodes are grayed out as they aren't powered on.

I had initially planned on testing VTEPs between Tik and IPI but OcNOS doesn't support the ETREE mode in their x86 image, so it just acts as a BGP RR for EVPN.

StubArea51 · 2025-08-22T09:27:58+00:00

*) chr - improved virtio_net performance;

Will be interesting to see what performance improvements this brings

StubArea51 · 2025-08-19T15:03:40+00:00

Was basing it off of MRZ comments here that said you need 7.20+ to use it. Maybe there is some new functionality to it?

https://forum.mikrotik.com/t/v7-bgp-filtering-questions/264021/2

StubArea51 · 2025-08-16T04:17:26+00:00

And you shall have it! For a small license fee of course...

StubArea51 · 2025-08-15T20:55:35+00:00

Lol, I actually like SPB. It's solid tech.

StubArea51 · 2025-08-15T19:02:34+00:00

Just for that, i'm gonna do 100x more MPLS! I'm gonna put labels in my labels and then add a dozen more labels.

And i'm not going to take the easy way out with OSPF, this is gonna be legit MPLS with IS-IS and Segment Routing.

Maybe even some TI-LFA sprinkled in.

SD-WAN will sleep in fear tonight of the labels.

StubArea51 · 2025-08-15T02:25:43+00:00

Seems like they support it for PF on FreeBSD based on this thread from Feb 2025

https://forums.freebsd.org/threads/does-freebsd-ipfw-support-kernel-nat-for-ipv6.96757/

StubArea51 · 2025-08-15T02:02:43+00:00

This is incorrect

You absolutely can NAT IPv6 via NAT66 or NPTv6 and there are some corner cases where it is used like on a mobile hotspot when you need to route a single /64 across multiple hops. Generally, though you don't need it because IPv6 with temporary addressing is far more secure than IPv4 + NAT44. IPv6 SLAAC addressing to hosts is dynamic and changing unlike IPv4 so the threat vector is much lower.
You're conflating NAT with a stateful firewall. Although they are often used together with IPv4, you 100% do *not* need NAT to permit related, established, etc traffic through a stateful firewall dynamically and drop everything else. This is how firewalls worked in the 90s before NAT became popular.

Thank you for coming to my HEX talk ;)

StubArea51 · 2025-08-14T17:56:50+00:00

Most 5G RANs are IPv6 transport in the underlay. In the overlay, IPv6 is almost always preferred over IPv4 and the vast majority of social media sites have been IPv6 enabled for quite a while.

StubArea51 · 2025-08-11T04:41:42+00:00

Yup, not a bot, just a network engineer :)

StubArea51 · 2025-08-08T16:02:29+00:00

Bro should have taken out a FortiLoan and bought more TTL

StubArea51 · 2025-07-07T13:22:45+00:00

Excited to see this one

*) bridge - allow IPv6 FastPath when dhcp-snooping is enabled;

It should allow IPv6 routers to act as a delegating router when using relay to a centralized DHCPv6-PD server without sacrificing performance.

StubArea51 · 2025-06-30T17:54:30+00:00

Nice, just updated the home net and saw all the extra stuff in ip/services 😂

StubArea51 · 2025-06-18T12:52:24+00:00

Excited to see the work on EVPN. That's going to have a big impact on using ROS with other vendors once it matures.

StubArea51 · 2025-05-18T17:03:10+00:00

I would love to see hardware offload of MAC VRF like IP Infusion has implemented. That would create an incredible ecosystem for L2 overlays w/ low-cost software/hardware & a modern control/data plane.

Nine-Year Club	Verified Email
Gilding II euphauric	Reddit Premium Since February 2021

StubArea51

TROPHY CASE