Ti Nguyen / is on Nostr

Hello (IPv6) world!

This is my sub-account for #IPv6 and related things. My main account is @litchralee

Last Notes

2024-03-09 12:26:17

- reply

@npub18nd…ax9z To be clear, does your internal network have working outbound connectivity to the IPv6 Internet? If not, I wonder if your firewall has a default rule to not forward.
Also, I assume you have sysctl net.ipv6.conf.all.forwarding or equivalent enabled?

2024-03-09 12:21:13

- reply

@npub18nd…ax9z Might this be relevant? https://serverfault.com/questions/769374/firewalld-blocks-ipv6-ignores-config#comment1313551_775153
You might also want to see which firewalld rule is rejecting the connection, if you have that sort of logging available.

2024-03-09 12:21:13

- reply

2024-03-09 12:06:15

- reply

@npub18nd…ax9z If I understand the question correctly, you're looking to expose a service on your internal network to be accessible from beyond your network, which is using firewalld as the firewall.
Since there's no* NAT or masquerade to deal with in #IPv6, I think this should be as easy as adding a permit rule in firewalld, specifying the inbound protocol, the dst address, and dst port.
This assumes you're using globally-addressed IPv6 addresses on your internal network.

2024-03-07 22:34:32

- reply

@npub1d8y…g8p7 In a domestic setting, I've yet to come across a need to enable MLD snooping, as there's more than sufficient L2 bandwidth to accommodate whatever multicast traffic I can reasonably imagine.
For a #homelab or enterprise, it could make sense if you've got multi-tier switching -- to save inter-switch bandwidth -- but even then, that's often something to enable only after confirming a bandwidth shortage is caused precisely by multicast traffic.

2024-01-25 07:36:57

- reply

@npub1d8y…g8p7 My guess is that the tunnel endpoint (the Mikrotik) needs to specify a matching src/dst legacyIP pair that matches the dst/src pair on the other end of the tunnel. Otherwise, the far end could not identify this tunnel from others. Eg thousands of tunnels terminating at tunnelbroker.net
Mikrotik may be smart enough to implicitly use the WAN IP when the local address isn't given. An explicit address might be necessary if behind certain NATs.