IPv6 Questions

[Bill]

The Billion 7800N arrived (eventually- Royal Snail really lived down to their nickname ), set up OK as supplied, loaded the IPv6 beta firmware, ticked the Enable IPv6 box and away it went, no problems 

Test site is happy:

Your readiness scores:
10/10   for your IPv4 stability and readiness, when publishers offer both IPv4 and IPv6
10/10   for your IPv6 stability and readiness, when publishers are forced to go IPv6 only

I might have some problems with speed tests and latency, but they can wait. Main question is:

If I go on to any site that will report my IP address, it shows the IPv4 one as my normal IDNet one (212.69.xxx.xxx). But the reported IPv6 address is the one that belongs to this computer, not the one that belngs to the router.

As if there's no NAT going on... is this the way IPv6 is supposed to work or have I set something up wrong?

[Steve]

From the little I've read your right, no NAT so every machine is public whether you can revert to NAT not read that far.

http://ipv6.com/articles/nat/NAT-In-Depth.htm

It looks we don't need NAT due to the amount of IP addresses made available to us via the ISP

[Simon_idnet]

Hi Bill

That's the beauty of IPv6 - that there are sooo many addresses that every device has a real, routable address. Of course that also means that you must have a v6 firewall too...
S

[Bill]

First thing I did when I thought there might be no NAT was to check the firewall settings

@ Steve- useful looking link that, thanks. Lots of reading, and I might even understand some of it

[Bill]

OK, next question- I mentioned an issue with latency in the OP. I've set up a BQM for the v6 connection, it hasn't been running long but it looks pretty diabolical:



If I use tbb's reverse traceroute tool the results can be good:

Code Select Expand

# Host Sent Recvd Best Avg Worst
1 2a02:68:85a3::ffff 15 15 0ms 2ms 3ms
2 2a02:68:0:1::3 15 15 0ms 0ms 0ms
3 2001:7f8:17::30d0:1 15 15 0ms 1ms 5ms
4 2a02:390:0:ff00:204:4eff:feb3:741b 15 15 0ms 0ms 1ms
5 2a02:390:0:ff00:212:7fff:feae:411b 15 15 1ms 2ms 19ms
6 2a02:390:feed:6109:2142:4636:xxxx:xxxx 15 15 18ms 20ms 29ms

or they can be bad:

Code Select Expand

# Host Sent Recvd Best Avg Worst
1 2a02:68:85a3::ffff 15 15 0ms 2ms 8ms
2 2a02:68:0:1::3 15 15 0ms 4ms 59ms
3 2001:7f8:17::30d0:1 15 15 0ms 0ms 1ms
4 2a02:390:0:ff00:204:4eff:feb3:741b 15 15 0ms 1ms 4ms
5 2a02:390:0:ff00:212:7fff:feae:411b 15 15 1ms 25ms 343ms
6 2a02:390:feed:6109:2142:4636:xxxx:xxxx 15 15 18ms 47ms 432ms

The timings seem compatible with the BQM trace, an occasional (but regular) very long delay... Any suggestions?

[Technical Ben]

Hi Bill

That's the beauty of IPv6 - that there are sooo many addresses that every device has a real, routable address. Of course that also means that you must have a v6 firewall too...
S

It's might be helpful, but I could see some risk in this. Especially if some virus/bot/hacker thinks it's great to target you. Now they can do exactly that?

[Steve]

But I guess you could change your IP address very quickly

[Bill]

It's might be helpful, but I could see some risk in this. Especially if some virus/bot/hacker thinks it's great to target you. Now they can do exactly that?

I don't know the details, but I think IPv6 contains a lot more inherent security than IPv4.

[Steve]

Now that your an expert Bill , does the SL firewall work or does it have to be manually configured for IPv6 and also is the local NIC configuration on SL(Mac) automatic for IPv6 address?

[Bill]

To be honest I've got no idea... but it doesn't have a separate configuration area for v6.

I just made sure it was enabled, and set to allow only a (short!) list of apps to accept incoming connections. IOW, basically the default.

[dmgeurts]

I don't know the details, but I think IPv6 contains a lot more inherent security than IPv4.

IPv6 does not contain more security than IPv4. Though you can choose if you assign a machine (read subnet due to IPv6's dynamic addressing) to a subnet that has a non public network.

Security will come from your firewall rule base. NAT was never designed as or intended to be a security feature.

[Bill]

IPv6 does not contain more security than IPv4.

Is this not relevant?

http://ipv6.com/articles/security/IPsec.htm

IPsec is a mandatory component for IPv6

Genuine question, I don't know.

[Adam]

Now that your an expert Bill , does the SL firewall work or does it have to be manually configured for IPv6 and also is the local NIC configuration on SL(Mac) automatic for IPv6 address?

OS X has been IPv6 compatible for a long time, and the firewall is based on FreeBSD's ipfw which also fully supports IPv6 filtering. The application firewall in System Preferences is fully configured for IPv6 filtering out of the box.

[Steve]

So as far as moving over from IPv4 to IPv6 on Mac OS X it's a fairly seamless transition?

[Adam]

So as far as moving over from IPv4 to IPv6 on Mac OS X it's a fairly seamless transition?

Pretty much, auto-configuration is one of the stated benefits of IPv6 and OS X has everything covered. Any configuration is usually done at the router and some (most?) IPv6 routers include an IPv6 firewall for added protection.

[Bill]

So as far as moving over from IPv4 to IPv6 on Mac OS X it's a fairly seamless transition?

Yup, dead easy.

In Network Prefs, just go into "Advanced" on your connection type (Ethernet, Airport), in the Configure IPv6 drop-down select "Automatically", click OK and Apply.

That's it!

The 7800N is just as easy- under WAN, check the IPv6 Enable box and click "Apply".

[Steve]

Does the Billion 7800N have a IPv6 firewall? Is the beta software available in the UK or does one use the one available on the Aussie site?

[Adam]

Does the Billion 7800N have a IPv6 firewall? Is the beta software available in the UK or does one use the one available on the Aussie site?

No idea if the Billion SPI firewall also supports IPv6, one would think it should. The IPv6 firmware is now available from the Billion UK site now though.

[Bill]

The various pages under "Firewall" all seem to have independent v6 and v4 settings, so far I've left them at default.

@ Adam- are you sure about the IPv6 firmware being on the site? I got mine today via email, as per Simon's post here:

http://www.idnetters.co.uk/forums/index.php/topic,25325.msg603394.html#msg603394

[Steve]

The version showing is 1.06c on the UK and Australian sites.

[Bill]

The version showing is 1.06c on the UK and Australian sites.

That doesn't support IPv6... even if it says it does in the release notes. In the tbb thread I linked to earlier (http://forums.thinkbroadband.com/dslrouter/t/3983589-is-the-billion-bipac-7800n-ipv6-ready.html) there's a post from baby_frogmella:

Oh deary me  just called up billion support and asked why there isnt a setting for ipv6 in 1.06c. Was told this firmware does NOT support ipv6 and the mention of it in the release notes was an error. Was assured next fw release will definitely enable ipv6. Sorry for getting everyone excited

You have to get the beta.

[Steve]

Thanks Bill, although reading that thread is a tad confusing but a post by nicotine http://forums.thinkbroadband.com/dslrouter/t/3990875-is-the-billion-bipac-7800n-ipv6-ready.html suggest a firmware of 1.06c.dc1 is the beta firmware and that is also available for download.

[Bill]

suggest a firmware of 1.06c.dc1 is the beta firmware and that is also available for download.

The version is right, that's what I've got, but he doesn't say you can download it:

beta firmware 1.06c.dc1 for testing only is availalble by request via sales@billion.uk.com

[Adam]

That's a shame, I had thought it was available on the website. If anyone has a copy you can attach it to a post (should be able to anyway), or if you drop me a PM I will give you my email and host a copy for download.

[Steve]

Unless I'm being stupid which is entirely possible it's available here  http://www.billion.uk.com/esupport/

http://www.billion.uk.com/esupport/index.php?_m=downloads&_a=viewdownload&downloaditemid=277

[Bill]

That looks like the one...

I did a search for that when I found the version number- not found.

I've just tried again- still not found

[Bill]

Belay that... the file I've got is UKBillion7800NV6_1.06c.dc1.afw.

Adam- PM me your email and I'll send a copy.

[Bill]

Downloaded the one from the site, just for the hell of it... it's about 25Kbytes bigger than the beta that supports IPv6

[Bill]

I indicated earlier in this thread that I didn't like the look of the latency I'm seeing on my IPv6 BQM, so I've been doing a few more tests, graph attached.

What I did- collected an hour's worth of pings (at 10-second intervals) to various IPv6 websites and graphed them.

Also did the same for one IPv4 site (tbb) for comparison, it's shown as x10 to get it out of the "floors" of the other traces.

It's not a set of results that gives me a warm, fuzzy feeling...

I know nothing about how IPv6 is routed, so it could be something to do with IDNet or just a general effect of shunting IPv6 packets around a network that isn't really ready for them...

I'd appeciate comments from anyone knowledgable, especially SimonD

[Steve]

Any tips to getting the BQM working on IPv6? i'm using the routers wan IP address and ping is enabled 100% packet loss at the moment.

[Bill]

If you're using the right address I can't see why it shouldn't work... but if you use the address that it suggests when you create the BQM then it won't- that's the IP address of the computer.

That's what I did first and got solid red, but when I copy/pasted the IP address from the router opening status page it worked straight away.

If it won't work, if you want to PM me your router's v6 address and I'll see if I can ping it from here.

[Steve]

I spotted the first error but it's still no go with IPv6 BQM for me


It does appear to respond to ping though

IPv6 Ping Output:
PING 2a02:0390:feed:6598:c993:2cc7:xxx:xxxx:32 data bytes
40 bytes from 2a02:390:feed:6598:c993:2cc7:xxx:xxxx: icmp_seq=0 ttl=57 time=30.9 ms
40 bytes from 2a02:390:feed:6598:c993:2cc7:xxx:xxxx: icmp_seq=1 ttl=57 time=30.1 ms
40 bytes from 2a02:390:feed:6598:c993:2cc7:xxx:xxxx:icmp_seq=2 ttl=57 time=32.5 ms
40 bytes from 2a02:390:feed:6598:c993:2cc7:xxx:xxxx: icmp_seq=3 ttl=57 time=32.9 ms

http://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-ping.php

I'll take up the offer Bill

[Bill]

That's a useful website, bookmarked

It works for me both on my IP and on the address you gave me, but I can't ping you directly on that IP... I just get a request timeout

And traceroute comes up "nodename nor servname provided, or not known".

There's something weird going on, but I've no idea what it is

[Steve]

Thanks Bill,Neither have I  The reverse traceroute finds it on TBB tools though.

[Bill]

Forget what I said about traceroute- finger trouble at this end

But it still doesn't work- times out on hop 3.

[Bill]

I've just had a thought... when I first tried IPv6 through a tunnel, I set up a BQM which wouldn't work- that turned out to be a bug in the pingbox code.

More to the point, Seb couldn't ping me either, just as I can't ping you. After day or so, he could ping me. Maybe IPv6 addresses take time to propagate or something, if that's the case your BQM may start working at some point for no obvious reason

Just leave it for a few days to see what happens.

[Steve]

I was thinking similar Bill,however another surprise I've just rebooted the router and I've been allocated a different IPv6 address according to the router status page

[Bill]

That's not good news

I knew they weren't static IPs, but I'd hoped they'd be pretty sticky.

I think we need SimonD in on this (and maybe an IPv6 forum? )

[Technical Ben]

You can get entire blocks of IP6 for yourself now though.

[pctech]

I was thinking similar Bill,however another surprise I've just rebooted the router and I've been allocated a different IPv6 address according to the router status page

Maybe they are randomly allocated by RADIUS at the minute but will eventually be static but of course that depends on SimonD's configuration.

Does sound like the routing info hadn't propagated Bill.

[mchunt_idnet]

We allocate users a /64 block that can be used by your router and then a /48 block that your router can dish out to your end devices.

IPv6 Prefix: 2A02:390:FEED:####::/64
IPv6 Delegated: 2A02:390:####::/48

#### (hex value we uniquely allocate to each user)

The initial part of your routers ip6 address will always start with your ipv6 prefix, the end part is autoconfigured by your router [unless you have statically configured your router].

Some routers and devices will use the mac address in order to create the last bit but to some people this is a privacy risk and hence the device may choose a random value.  If you configure a Mac to use ipv6 via a modem it will use the Mac's mac address unless you tweak some low end system parameters, Windows 7 however will use a 'random' value by default.

It is recommended by a lot of people that firewalls, spam filters work at the /64 level due to the way addresses are generally allocated and also as working at individual ipv6 address level would be almost impossible due to the number of addresses concerned.

[pctech]

Very interesting Martin, thanks for the explanation.

I have to say I'm still just trying to get my head around IPv6.

[Bill]

Thanks Martin, I think I understood that

Does that mean that, for those of us who prefer static IPs, we can take the IPs dished out the first time we connect and use them to fix the IP of the device they are allocated to (both router and computers)?

And could you give any reason why the BQM graphs (see earlier post and sig) give such diabolical results for ping times?

ie this post: http://www.idnetters.co.uk/forums/index.php/topic,25449.msg605953.html#msg605953

[Steve]

Thanks Martin, I half understand at the most. I have tried to set a static router IPv6 address up , I may have succeeded however the netmask comes out as /128 it was 64 previously when the IPv6 address was obtained automatically. Have I done something wrong?

http://linux-sxs.org/networking/ipv6_for_beginners.html

[mchunt_idnet]

You have done nothing wrong, a /128 is a single ipv6 address which is what you need for the network interface.

Thanks Martin, I half understand at the most. I have tried to set a static router IPv6 address up , I may have succeeded however the netmask comes out as /128 it was 64 previously when the IPv6 address was obtained automatically. Have I done something wrong?

http://linux-sxs.org/networking/ipv6_for_beginners.html

[Steve]

Thanks Martin it was the change in the router reported netmask  that puzzled me from /64 to /128 going from 'automatic' to 'fixed' on the wan IP request.

[mchunt_idnet]

You can set them manually if you wish to whatever you like within the blocks allocated to you - using the first values you get may be a safer option than picking anything random. Whilst we will try to ensure you keep your current allocations it may be necessary to change something at some point - it is all a little new to everyone and testing is ongoing.

Simon [on holiday supposedly!] deals with the main routing/peering etc - personally my guess would be that either the packets are taking a different route than the ipv4 packets (a router in the best route between us and them may not be ipv6 enabled and hence a more congested or longer route is taken) or the test stack is not working as well with ipv6.

IPv6 Allocation details will appear in the customer portal at some point.

Thanks Martin, I think I understood that

Does that mean that, for those of us who prefer static IPs, we can take the IPs dished out the first time we connect and use them to fix the IP of the device they are allocated to (both router and computers)?

And could you give any reason why the BQM graphs (see earlier post and sig) give such diabolical results for ping times?

ie this post: http://www.idnetters.co.uk/forums/index.php/topic,25449.msg605953.html#msg605953

[Bill]

Thanks Martin, that gives me a bit of confidence to have a play.

Simon [on holiday supposedly!]

I didn't think there was any evidence that Simon even slept, let alone went on holiday

[Technical Ben]

So with 2¹²⁸ addresses, or roughly 3.4×10³⁸ addresses. But with an IPv6 address looking like this "2001:0db8:85a3:0000:0000:8a2e:0370:7334". It's a billion times more confusing to me.

[Gary]

I dont really care as long as it works my router gets the upgrade which it should. More important things going on for myself right now outside my window and away from computers, like the garden, sunshine generally being outside, etc.

[Bill]

One of the snags with beta firmware is that it tends to have bugs... damn thing won't let me set a static IP on v6

Bug report sent off... and like Steve, a router reboot returns a new WAN IP address. So I've dumped the BQM until I get it sorted.

[Steve]

I did manage to set a static router IP Bill I think, use the Basic interface copy the IPv6 address from status, disconnect and then paste the address into the WAN setup and then click apply. I couldn't get it to stick using the advanced web interface.

[Bill]

I hadn't thought of disconnecting first... but I still can't make it work.

Using the basic WAN interface brings up a "<192.168.1.1> Invalid IP address" error when I press Apply (I've changed it from the default IP to match my other routers, but it still fails if I put it back to 254), with the advanced interface it just doesn't stick.

That's using both Opera and Safari... I'll dig out an old Windows laptop and try it (wired) with IE.

[Bill]

Well that didn't work either, same error from IE8

[Bill]

Sorted

I hope

Seems as though you can't set a manual IPv6 address with an automatic IPv4 address... set them both manually and it works fine.

Good thing IDNet supply static IPs!!!!

[Steve]

Sorry Bill I did set the IPv4 manually as well. 

[Bill]

No problem

It meant I could send off a reasonably comprehensive bug report to Billion. Doesn't worry us of course, but if a customer of an ISP who only used dynamic IP allocation (which I think is most of 'em) wanted to fix their v6 address then they couldn't.

[Steve]

Bill, Did you get the same with the reported netmask changing from 64 to 128 going from automatic to manual?

[Bill]

Yes, I did.

The v4 netmask is now 255.255.255.255, I thought it was 255.255.255.0 before but I can't be sure.

Also changed the iMac to fixed v6 address, the Prefix length (is that the same as netmask ?) stayed at 64. I've no idea if it's right, but it still seems to work

[Steve]

I think it's the IPv6 equivalent so you get more addresses with /48 than /64

[pctech]

Yes, I did.

The v4 netmask is now 255.255.255.255, I thought it was 255.255.255.0 before but I can't be sure.

Also changed the iMac to fixed v6 address, the Prefix length (is that the same as netmask ?) stayed at 64. I've no idea if it's right, but it still seems to work

Prefix length is indeed the same as a netmask which in IPv4 can be written as dotted quad 255.255.255.0 or slash notation (255.255.255.0 would be /24)

I'm fairly certain that a router having a 255.255.255.255 or /32 prefix means it is part of the infrastructure and does not have any end nodes and is pretty much just a pass through.

When I used NAT on my router before I applied for my own allocation it had a 255.255.255.255 or /32 mask.

[Bill]

Simon [on holiday supposedly!] deals with the main routing/peering etc - personally my guess would be that either the packets are taking a different route than the ipv4 packets (a router in the best route between us and them may not be ipv6 enabled and hence a more congested or longer route is taken) or the test stack is not working as well with ipv6.

When Simon comes back, he might like to consider the two IPv6 speed tests attached... it might indicate something about peering!

The first is via thinkbroadband, the second is via here- http://ipv6-test.com/speedtest . I think it's in Roubaix, France.

[pctech]

I thought IDNet already had peering in France? Paris to be exact according to the service status.

All the probably indicates is they don't have a direct route via an Internet Exchange (nearly always the quickest way) to that host?

[Bill]

Afaik, they also peer with NetConnex... ie thinkbroadband.

[Steve]

The Thinkbroadband IPv6 speedtest still doesn't work for me, a bit like the IPv6 BQM.

[Bill]

Have you tried the tbb test?

http://ipv6-speedtest.net/

If it says you're coming in via IPv4 (sometimes does that to me- Apple bug I think), you can force it with

http://ipv6.ipv6-speedtest.net/


Oops, missed your edit

[Steve]

Thanks for the alternative address Bill , same as yours it's pants

Date   19/04/11 18:30:26
Download speed   156.96 Kbps (0.15 Mbps)
Upload speed   675.94 Kbps (0.66 Mbps)
Server Port   8095 (tcp)

[Bill]

I've thought about bringing it up with Seb, but he won't even admit there's a problem with the IPv4 test if you're using FTTC, despite the number of complaints... so I thought I'd see what IDNet have to say, 'cos that's truly abysmal

[Steve]

Well if it's down to peering it must be going a long long way round.

[Bill]

I know less about peering than I do about routing, and I know nothing about routing!

But I'm glad it's not just me getting rubbish results, we need more mugs volunteers to try IPv6.

[Bill]

@ Steve- some interesting graphs on that test page:

http://ipv6-test.com/stats/

[pctech]

I cant really throw stones as am using a Zen connection with a Teredo 6to4 setup (uses the Hurricane Electric Tunnelbroker service and routes the traffic via them so I get 1.84 for IPv4 and 1.61 via IPv6 so my packets are going a long way too.

They are in the process of preparing their network though.

[pctech]

I've thought about bringing it up with Seb, but he won't even admit there's a problem with the IPv4 test if you're using FTTC, despite the number of complaints... so I thought I'd see what IDNet have to say, 'cos that's truly abysmal

He'll probably not believe it until he gets FTTC himself but then again I'm still using the 21CN ADSL Max equivalent just because it works better on my line.

[Steve]

@ Steve- some interesting graphs on that test page:

http://ipv6-test.com/stats/

I guess IPv6 is the 'poor relation' at present for ISPs.

[Bill]

I guess IPv6 is the 'poor relation' at present for ISPs.

And not just ISPs- router manufacturers too, and not excluding Apple

But by the same token, whilst not too many people are using it it's a good time to sort the bugs out of it.

[pctech]

Consumer routers are driven by what ISPs are deploying whereas the large ones marketed to ISPs are driven by what technology is available and what router manufacturers want to flog as your average ISP router is upwards or three grand.

[Bill]

They're the extreme ends of the market, yes, but there's a range in the middle too- usually referred to as SOHO or geek models. Like the Billion 7800N

[Steve]

Probably why I'm struggling then

[Bill]

Probably why I'm struggling then

Me too- there's a lot of boxes in the configuration that I don't even understand the label, let alone what would happen if I filled them in


As a by-the-way, there's a post in tbb about using the "Save Config" in Flash memory and using the "restart with current settings" as opposed to the factory default ones. Easiest just to quote it:

However when upgrading the firmware, Billion strongly recommend you select "factory default settings" to avoid any potential problems. This is when its really useful to have a backup config file, as it saves you manually typing in every setting

So I've taken a file backup of my configuration settings as belt & braces

[Steve]

Probably one @ Bill but unable to get to www.thinkbroadband.com with IPv6 enabled, I've changed configuration using Draytek 120 as modem and 7800N as router with PPPOE, ping times much better 5msec on average.

[Steve]

I guess it's something to do with my current config seems to be able to connect to some IPv6 sites but not others. the IPv6 test site comes back ok,I guess the routers ok via pppoe as Bill's using it, any suggestions on an MTU setting I was using 1492

[Bill]

I don't think it's anything to do with your configuration- I think it's because you're using a Mac. There's a bug in 10.6.x (that wasn't there in 10.5.x, Apple "improved" it) that means that (sometimes) if a site returns both a v4 and a v6 address it will choose the v4 one. And if you try to force a v6 connection (eg using a v6-only address) it won't connect at all

I don't think IDNet are entirely blame-free either- at the moment I can't connect to anything via v6, but network prefs and the router both show the usual v6 addresses, the BQM isn't complaining and the test site gives me 10/10

Your MTU of 1492 is correct btw, unless you're using a 6to4 tunnel in which case <1400 is often recommended.

Re tbb- you can force a v6 connection using ipv6.thinkbroadband.com. Using "ipv6" instead of "www" works for most of the pages, but not the broadband maps or the forums.



edit- seems to be mostly OK now

[Bill]

I think I was seeing the start of the problems reported in the "Major problems" topic...

[Steve]

Is the TBB forum IPv4 only Bill? I guessing there's an issue somewhere with certain IPv6 connections using PPPOE and the Draytek 120,i.e it will connect to IPv6 google but not TBB website, it's a shame as the latency is 5 msec better on my line than the 7800N (it's not the IPv6 firmware either as I tried the official)

[Bill]

The forum page (http://forums.thinkbroadband.com) is v4 only, but the main site (http://www.thinkbroadband.com) is dual-stack (proper description?) so you should communicate with it via v6 if the computer selects v6 over v4 as it's supposed to.

I found a good article about using v6 and v4 with a Mac, and now I can't find it again But I do remember that it was mostly written for developers and, if IP protocols were involved, they strongly recommended against upgrading from 10.5 to 10.6 because its behaviour wasn't fully predictable.

THBS, mine behaves itself most of the time and selects v6 if it's available. But not every time

[Bill]

Now that's what I call a reasonable IPv6 speed test



So it can do it... now if we can only find out why the tbb IPv6 connection thinks it's on dial-up...

Detailed Results
Date   23/04/11 11:31:51
Download speed   189.33 Kbps (0.18 Mbps)
Upload speed   7415.23 Kbps (7.24 Mbps)
Server Port   8095 (tcp)