ungleich Blog

There's virtually nothing on this, I guess nobody cares enough about IPv6 to spend time to actively remove IPv4 on their home. I did it, mostly for fun and because I hate managing a dual stack: I have been running a 100% IPv6-only network at home for a couple of years, now.

It works by having several IPv6-only subnets and a dual stack router (running openwrt) that performs stateful NAT64 [1] using Jool.
This allows to access both the IPv4 internet and local IPv4 islands[2] (basically old devices like printers).

There's no DHCP or NAPT involved: the router gets a /56 prefix from the ISP and performs prefix delegation, so every device does SLAAC and assigns itself a fully routable IPv6 address.

For DNS I use dnscrypt-proxy2: it's very easy to set up and it can do DNS64 and static hostnames mapping. Since prefix is stable, I just assign names to the stable EUI-64 addresses of the hosts I care about. Alternatively you can use bind for DNS64 and mDNS if you don't like manually assigning names. There's also a script to automatically assigns names based on ICMPv6 neighbours discovery [3].

I also host some services on the IPv4 internet from IPv6-only hosts: for this you need the NAT64 equivalent of port forwarding, which is setting up static BIB entries [4].

[1]: https://nicmx.github.io/Jool/en/intro-xlat.html#stateful-nat64

[2]: https://ungleich.ch/u/blog/managing-ipv4-islands-with-jool-and-openwrt/

[3]: https://github.com/AndreBL/ip6neigh/

[4]:…

>Windows will try to auto configure with a 169.254 link local if DHCP is unavailable. Not sure if anyone is actually using them for LAN. They come up sometimes in point to point or for other shenanigans (commonly on cloud or virtualized networks for special services)

I've seen it done few times for niche devices and I've done it a few times when I needed a really quick network operational and didn't want to bother setting up any supporting infrastructure such as a DHCP server. Never for any production environment though.

I've toyed around with an IPv6 link local only environment but browsers don't support adding the zone identifier[1] for link local addresses. There's workarounds but in most cases for a fully isolated network it's about the same effort to setup a small DHCP server somewhere.

That said it's not a comprehensive solution, Android AFAIK still won't support DHCPv6. To get that to work AFAIK requires router advertisements and some more odd finagling if privacy extensions are enabled on the device.

[1]https://ungleich.ch/u/blog/ipv6-link-local-support-in-browsers/

I don't see a benefit of the built in DoH in firefox since it is shifting the trust from my existing DNS provider to cloudflare[1] (based in the US).

Today I discovered that I couldn't just kill the disqus.com requests with my usual method by sink-holing them in /etc/hosts because for some reason firefox ignored the /etc/hosts file. While Chrome seemed to work fine and local dig requests also returned

disqus.com. 0 IN A 0.0.0.0

I was left dumbstruck.

I was able to override this in the about:config as described in [1].

I really don't like how mozilla ignors what is defined in /etc/nsswitsch.conf because this breaks all the blacklisting rules a user had set up themselves. At least they should have produced a huge warning telling users that this ignores any local blacklists that are in place.

[1] https://ungleich.ch/en-us/cms/blog/2019/09/11/turn-off-doh-firefox/

But that does not make his solution any less valid. Or does it?

In fact, keeping something preloaded and ready to go is quite common, these two examples are off the top of my head:

- The Emacs server way - https://ungleich.ch/u/blog/emacs-server-the-smart-way/

- SSH connection reuse.