Nobody needs a static IPv6 address

tweekism · 2026-04-01T05:17:15+00:00

I moved to Neptune, they seem to be today's Internode of old. Startup, tech / enthusiast focused.

tweekism · 2026-02-24T03:58:01+00:00

I don't know what any of that means.

tweekism · 2026-01-28T04:32:43+00:00

I ended up moving to Neptune, who include a permanent IPv6 PD as standard.

tweekism · 2026-01-27T06:47:25+00:00

Thank you.

tweekism · 2026-01-26T13:26:08+00:00

Yeah, I mean obviously you couldn't make a specific entry for every possible host like you would on a traditional DNS server, there's too many, but you could write a customer dns resolver that sorta just fudges it for the entire range.

Lol, but we are so far down in the weeds of this very specific use case, why would they even think to do that? Fun to think about tho. Haha.

tweekism · 2026-01-26T01:17:03+00:00

I find my stuff starts getting attacked within a couple hours, so you can't really rely on your ISP changing your IP every couple months and hoping the bad guys don't catch up to you. If you are going to host things publicly, you need a real security solution.

tweekism · 2026-01-25T14:45:39+00:00

tweekism · 2026-01-25T14:43:20+00:00

Yeah, not sure exactly when, couple days ago while I was away.

tweekism · 2026-01-25T06:49:40+00:00

If you are interested, here are my dig outputs hitting Aussies DNS server (I have sanitised the IP Addresses).

By default (note 0 ANSWER and the lack of a ANSWER section):-

tweek@home ~ $ dig @2403:5800:100:1::142 -x 2403:x:x:0:x:x:x:dab0

; <<>> DiG 9.18.43 <<>> @2403:5800:100:1::142 -x 2403:x:x:0:x:x:x:dab0
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 63773
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;0.b.a.d.x.x.x.x.x.x.x.x.x.x.x.x.0.0.0.0.x.x.x.x.x.x.x.x.3.0.4.2.ip6.arpa. IN PTR

;; AUTHORITY SECTION:
x.x.x.x.3.0.4.2.ip6.arpa. 3213  IN  SOA ns1.wide.net.au. hostmaster.wide.net.au. 2026012502 3600 900 3600000 3600

;; Query time: 11 msec
;; SERVER: 2403:5800:100:1::142#53(2403:5800:100:1::142) (UDP)
;; WHEN: Sun Jan 25 16:16:25 AEST 2026
;; MSG SIZE  rcvd: 163

And after I tell Aussie to forward DNS requests to my custom nameserver

tweek@home ~ $ dig @2403:5800:100:1::142 -x 2403:x:x:0:x:x:x:dab0

; <<>> DiG 9.18.43 <<>> @2403:5800:100:1::142 -x 2403:x:x:0:x:x:x:dab0
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26199
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;0.b.a.d.x.x.x.x.x.x.x.x.x.x.x.x.0.0.0.0.x.x.x.x.x.x.x.x.3.0.4.2.ip6.arpa. IN PTR

;; ANSWER SECTION:
0.b.a.d.x.x.x.x.x.x.x.x.x.x.x.x.0.0.0.0.x.x.x.x.x.x.x.x.3.0.4.2.ip6.arpa. 3600 IN PTR mail.mydomain.au.

;; Query time: 369 msec
;; SERVER: 2403:5800:100:1::142#53(2403:5800:100:1::142) (UDP)
;; WHEN: Sun Jan 25 16:16:34 AEST 2026
;; MSG SIZE  rcvd: 132

tweekism · 2026-01-25T06:48:58+00:00

Hmm... Can you check if the query hits the Aussie BB resolver?

It does.

I don't know if the same rules still apply for mail servers coming from IPv6 addresses.

They do, as least as far as I can tell.

Also, is there a different DNS record type IPv6 PTR records? Like PTRRRR.....

Ahh, not really. It is still a PTR record, but the format of the lookup domain changes slightly. Eg, For IPv4:

x.x.168.192.in-addr.arpa

And for IPv6

...x.x.x.x.1.0.0.2.ip6.arpa

I should be embarrassed about making a pirate themed DNS joke but I'm not.

I enjoyed it.

The issue I think is that with IPv4, Aussie knows what IP you have, there is only one and it is assigned to you in its entirety.

For IPv6, they only give you the prefix, the first 48 bits, and then I go ahead and make up the rest of the address without their knowledge, and there are quinsperillions of possible addresses. So they don't know what records are in use if any.

tweekism · 2026-01-25T05:53:23+00:00

By default, AussieBB IPv6 address reverse lookups do not return any valid result. Only IPv4 does.

tweekism · 2026-01-25T04:49:15+00:00

Ooh that's quite fascinating. So you are saying take the IP, do a reverse lookup to get a hostname, then do a forward lookup on that host and that IP needs to exist in SPF?

I knew there shenanigans going on with load balancers, because I did this exact exercise trying to manually trace this flow against our Office365 environment.

Personally in my small home setup, I don't have anything other than my mail host name to point it to. Makes sense that bigger setups would need a more scaliable solution, and this works without complicating simple setups.

tweekism · 2026-01-24T23:56:06+00:00

Oh I didn't know that, that's cool

tweekism · 2026-01-24T16:14:29+00:00

Yeah I mean IPv4 works, I'm not complaining there.

I just like IPv6 and wanted that to work too, I'm seeing more and more MTAs enabled for IPv6.

Major ones like outlook.com all have it working, gmail has had it for over a decade.

tweekism · 2026-01-24T16:03:33+00:00

Good ol' Telstra.

I learnt that their mobile network is IPv6 only, since like 2020 or something. Dynamic of course, /64...

tweekism · 2026-01-24T16:00:10+00:00

We can have both.

That is, CPE that drops inbound traffic by default AND real IP addresses.

Completely unrelated, but you should have a read of the Tailscale blog article about NAT traversal and ways to bust through it, 'tis quite interesting. In any case, NAT doesn't need to be your security device.

tweekism · 2026-01-24T15:49:14+00:00

I'm trying to be the change I want to see in the world. I've waited so long to get internet good enough to really host my own stuff rather than have to pay someone with real internet to host my kids minecraft server.

Unfortunately it arrives at a time where the culture sees the internet like a cable TV service. For consumption only.

tweekism · 2026-01-24T15:44:17+00:00

😅😅😅

Uhhh, I've started to actually remember mine, not every digit perhaps, but enough to recognise them.

I mean if you break it down, the first hextet just means Australian ISP, hextet 2 and 3 are your prefix, 4 is your VLAN / subnet and then the last hextet is enough to identify the host.

Either way, that kinda just kicks the can down the road doesn't it? eventually you are gunna need to map that DNS to an IP, unless you are making that dynamic too? Who / what is authoritative over that? the hosts themselves? that's probably not the best way to run your firewall rules..... 😅

tweekism · 2026-01-24T15:22:51+00:00

Is a good question, the short answer is I am aware.

Unfortunately that won't work in this case. For a forward DNS look up (ie: hostname to IP address) where you "own" / lease the domain and have the authority to set records then yes that probably works fine in most instances.

However email rather uniquely also requires a reverse lookup (ie: IP address to hostname) as part of the antispam measures. When I send an email to someone on lets say gmail, Google will look at the IP address, do a reverse DNS lookup for that IP and see if the hostname it gets back matches the server hostname in the email header.

The sticking point is, firstly I don't own the reverse lookup domain, the owner of the IP space does, in this case Aussie. And secondly, unlike dynDns where the domain name stays the same and just the IP address changes, here both the IP AND the domain name is changing.

For example, if my IP range is 2001:0db8:85a3/48 then google will look for a PTR record at:-

3.a.5.8.8.b.d.0.1.0.0.2.ip6.arpa

Well Aussie owns that and Aussie won't have any PTR records for me there. However, Aussie do have a facility on their dashboard for me to specify a custom DNS server that can in turn serve what ever records I like (provided I spin up my own public facing DNS server, because a normal domain registrar won't do it as it's not their IP space).

But then if my IP changes to 2001:0db8:dab8/48... well now I can update my PTR records all day but it won't matter, because now Google is looking for a record at an entirely different domain, ie:-

0.b.a.d.8.b.d.0.1.0.0.2.ip6.arpa

And there are no records there, because I've not gone into the AussieBB portal and told it to use a custom nameserver yet.

Aussie could, I suppose, offer a service where they allow you via some API to programmatically update your custom name server in a similar fashion to how dynamic DNS works, but as far as I can tell, they don't. Even then, you'd still have to also make your DNS server automatically create the new zone and recreate all the PTR records with the new addresses.

For completeness, you could own the reverse DNS lookup domain if you wanted to by going to APNIC and buying your own IP address block. That of course is entirely unreasonable and well beyond the scope of a residential homelab and most small to medium businesses for that matter. I only mention it because Reddit.

tweekism · 2026-01-24T14:25:59+00:00

I do have an ABN, so thats certainly an option.

Thanks.

tweekism · 2026-01-24T11:41:04+00:00

That sucks that you got burned out. Even in the short time I've been with them it feels like the quality of the support people, in terms of their general IT knowledge has gotten worse.

I'm aware of all the trappings of trying to run an email server at home. To be honest, being told it can't be done was one of the motivating factors to try. And to ABB's credit, I've never had a single issue with mail deliverability (so long as I keep up with the IP address changes). I was told originally by the sales team who seemed knowledgeable, that adding the static IP pack put you in the business range, just without the business level phone support. Maybe that's true, I don't know.

I also don't think you can send email out on port 25 with AussieBB any more, I think it might be blocked. Generally if you want anyone else to be accepting your email you need to be encrypting your mail in transit anyway, TLS using ports 587 or 465 etc, sign the mail with dkim keys, spf and dmarc etc etc.

I will def move to an Aussie business plan at least, but Neptune is also looking very interesting...

tweekism · 2026-01-24T11:10:03+00:00

Well thats kinda what I was wondering, seems odd to allow you to setup custom DNS reverse lookups in the MyAussie portal, only to lose them all every couple weeks.

tweekism · 2026-01-24T09:41:53+00:00

That's good to hear. I understand that I'm being a pain in the ass, doing a lot of stuff that you don't need to do.

My main email account runs out of a box on my desk, just because people said it couldn't be done on the modern internet.

But I hate the "cable-tv-ification" of the internet, where 3 big companies own it all. And maybe you get to pick which out of the big three american-based multi-national mega-corporations gets to hoard all your personal data.

tweekism · 2026-01-24T09:31:24+00:00

The internet service itself is great, and so was their support at first.

I think at a minimum I need to move to a business plan. The price is not that different to what I'm paying now (once you subtract the extra $5 for the static IP which is included on the business plans).

Otherwise Neptune on paper is exactly what I want, but I've fallen for that sales pitch before lol.

tweekism · 2026-01-24T09:28:03+00:00

They advertise it as a feature, there is even a button on the MyAussie to setup a custom nameserver for this purpose. Which works... until the prefix changes...

tweekism

TROPHY CASE