*** Answering a msg posted in area FIDOTEST (FIDOTEST).
Hello Rob,
On Sunday April 02 2023 12:43, you wrote to me:
I see you took the easy way out. You removed the AAAA record from
the DNS.
For now. No point advertising an incorrect address.
Indeed. For the BBS it may even annoy the users. With the IPv6 address in place a user that is running an IPv6 capable terminal program may have to wait a minute or so for his software to realize that IPv6 is not working and fall back to IPv4.
Perhaps you should come to the IPv6 echo. That is where the
expertise is...
Will do.
So... here I am...
My ISP provided router appears to be a Sagemcom, but I don't know much more about it (I use my own wireless access points and routers for DHCP/NAT/Firewall for the other devices on my internal/private networks). The ISP router (the Sagemcom) web UI reports that the vert.synchro.net system has IPv6 address 2600:6c88:8c40:5b::f5a, but when I attempt to connect to that IPv6 address or the ::7886 address (or even just ping6 them) from a remote host, I don't have any success.
Still a bit mysterious to me with so many addresses and so little information from the ISP. Any tips are welcome,
Still a bit mysterious to me with so many addresses and so little information from the ISP. Any tips are welcome,
Assume you can ping your ip6 addresses from the inside of your network?
Your router is probably blocking IPv6 traffic (most I've seen do), and you'll probably need to enable ICMP and relevant traffic to hosts if you want to enable inbound ipv6.
Still a bit mysterious to me with so many addresses and so little information from the ISP. Any tips are welcome,
First thing would be to figure out if you have a static subnet, and what it is. Most folks that I've spoken with get a /60 or /56 from their ISP. Business customers may get a /48. From your prefix (2600:6c88:8c40:5b::), its not easy to figure out what addresses you got - and it my be a /64 (which would be unusual). And if you got a /60 or /56, its strange that your router is handing out ...:5b::.
I dont know Sagemcom so dont know if it is a business router (which probably gives you some control over handing out addresses), or consumer router (which would mean its probably useless for ip6).
Still a bit mysterious to me with so many addresses and so little information from the ISP. Any tips are welcome,
Most OSes switch ip6 addresses regularly (hence the "temporary ones"), so dont be surprised if the ip6 address chanes often - you can turn it off to have a consistent one, or assign a static address.
I've never used the ISP's router's port blocking/forwarding/NAT/gateway features before (for IPv4), so now I'm looking what it supports. It does have DHCPv6 and DHCP-PD was disabled, so I've enabled that and expecting for it to hand out addresses in the range:
2600:6c88:8c40:5b::1 to ::1000 (according to its default configuration)
I haven't seen that happen yet. I'm guessing this means I have been allocated a /64 (?).
Looks like I have control: https://1drv.ms/i/s!ApZPvWcrEaRQ5_wrKOnYR4bZu_jJ3Q?e=8f5cy5
I can answer that:
- 04 Apr 14:08:27 [30668] incoming from 2600:6c88:8c40:5b:b126:a220:6909:9e27 (53589) + 04 Apr 14:08:38
[25170] incoming session with 2600-6c88-8c40-005b-b126-a220-6909-9e27.biz6.spectrum.com [2600:6c88:8c40:5b:b126:a220:6909:9e27]
I can answer that:
- 04 Apr 14:08:27 [30668] incoming from
2600:6c88:8c40:5b:b126:a220:6909:9e27 (53589) + 04 Apr 14:08:38
[25170] incoming session with
2600-6c88-8c40-005b-b126-a220-6909-9e27.biz6.spectrum.com
[2600:6c88:8c40:5b:b126:a220:6909:9e27]
When I search back in my binkd log, the first one was:
- 09 Mar 03:57:21 [14000] incoming from 2600:6c88:8c40:5b:a4c4:c9ce:e0ea:71ea (58374)
(The last 64 bits of his IPv6 address change at least once a day. So
the privacy extensions seem to be enabled on his system)
When I search back in my binkd log, the first one was:
- 09 Mar 03:57:21 [14000] incoming from
2600:6c88:8c40:5b:a4c4:c9ce:e0ea:71ea (58374)
(The last 64 bits of his IPv6 address change at least once a day. So
the privacy extensions seem to be enabled on his system)
How about outgoing connections? Have you made an outgoing IPv6 binkp connect yet? Feel free to try to connect to my system for testing.
Hello Rob,
On Monday April 03 2023 10:35, you wrote to deon:
I've never used the ISP's router's port
blocking/forwarding/NAT/gateway features before (for IPv4), so now I'm looking what it supports. It does have DHCPv6 and DHCP-PD was
disabled, so I've enabled that and expecting for it to hand out addresses in the range:
2600:6c88:8c40:5b::1 to ::1000 (according to its default
configuration)
I haven't seen that happen yet.
But it has assigned 2600:6c88:8c40:5b::f5a to your Fidonet machine.
There are also options for Port Forwarding, Firewall, IPv6 Pin-holing,
Ah, so they cal it pin-holing. :)
That is what you need for incoming IPv6.
As you can see in my list of IPv6 nodes, many Fidonet sysops have assigned a ::f1d0:1:103:705 type of address for their Fidonet node.
How about outgoing connections? Have you made an outgoing IPv6 binkp connect yet? Feel free to try to connect to my system for testing.
To create a fixed address:
netsh int ipv6 add address Internet 2600:6c88:8c40:5b:f1do:1:103:705
For incoming you should create a pinhole for port 24554 and maybe port 23.
^
Again! ;-)
Hello Rob,
On Tuesday April 04 2023 15:18, you wrote to me:
netsh int ipv6 add address Internet 2600:6c88:8c40:5b:f1do:1:103:705
And your binkp server answers on that address:
+ 09:37 [3496] outgoing session with 2600:6c88:8c40:5b:f1d0:1:103:705:24554
So all you have to do to earn your 'f' in the list is update the DNS for the mew IPv6 address.
Binkd has the possibility to specify the address to use for outgoing calls. It overrides the OS preference.
bindaddr 2600:6c88:8c40:5b:f1do:1:103:705
I don't know about BinkIT.
For incoming you should create a pinhole for port 24554 and maybe
port 23.
With the DMZ set, no pin-holes needed.
I am still a bit puzzled about your setup. Do you have /any/ barrier between the big bad InterNet and your Fido Machine?
Hello Rob,
On Wednesday April 05 2023 10:08, you wrote to me:
So all you have to do to earn your 'f' in the list is update the
DNS for the mew IPv6 address.
It probably makes more sense to just create a new hostname for fido traffic and have that point to that IPv6 address.
Yes. Always a good idea to have different host names for different services. Then you have the option to split the services over different machines without having to change host names if the need arises. Most DNS providers have no limit on the number of subdomains.
Is this just a vanity address or does it have some functional puporse?
It is just vanity, it serves no technical purpose. But it is quit popular among the Fidonet IPv6 sysops. Over a third of them have such a vanity address.
Binkd has the possibility to specify the address to use for
outgoing calls. It overrides the OS preference.
bindaddr 2600:6c88:8c40:5b:f1do:1:103:705
I don't know about BinkIT.
Maybe. Outbound IPv6 interface control isn't very strong in Synchronet right now.
You can always discuss it with the author. ;-)
I am still a bit puzzled about your setup. Do you have /any/
barrier between the big bad InterNet and your Fido Machine?
Just the Windows firewall.
So you can configure it to pass ICMP6 Ping so that your binkp server address becomes pingable...
https://1drv.ms/i/s!ApZPvWcrEaRQ5_wrKOnYR4bZu_jJ3Q?e=8f5cy5
There are also options for Port Forwarding, Firewall, IPv6 Pin-holing, IPv6 DMZ, but I've never used any of those (or similar) features for
Does anyone know what software clients actually support IPv6
Pin-holing?
I would think Bittorrent clients and utilities like syncthing should (because they support UPnP for IPv4), but I guess they don't do IPv6 Pin-holing. Maybe some games?
Hello Victor,
On Thursday April 06 2023 18:30, you wrote to Rob Swindell:
Does anyone know what software clients actually support IPv6
Pin-holing?
I am not sure what you mean by "software clients" in this context.
IPv6 pin-holing is something that is applied to a firewall. Firewalls
are found in routers and OSs.
I would think Bittorrent clients and utilities like syncthing
should (because they support UPnP for IPv4), but I guess they
don't do IPv6 Pin-holing. Maybe some games?
Does anyone know what software clients actually support IPv6
Pin-holing?
I am not sure what you mean by "software clients" in this context.
IPv6 pin-holing is something that is applied to a firewall. Firewalls
are found in routers and OSs.
I would think Bittorrent clients and utilities like syncthing
should (because they support UPnP for IPv4), but I guess they
don't do IPv6 Pin-holing. Maybe some games?
Please eleborate...
Does anyone know what software clients actually support IPv6
Pin-holing?
I am not sure what you mean by "software clients" in this context.
IPv6 pin-holing is something that is applied to a firewall.
Firewalls are found in routers and OSs.
I would think Bittorrent clients and utilities like syncthing
should (because they support UPnP for IPv4), but I guess they
don't do IPv6 Pin-holing. Maybe some games?
I think he means software that uses uphp to open ports on a firewall
as and when they are needed, and the firewalls that respond to
such requests by opening the port. Therefore the app is poking a
pinhole through the firewall.
Please eleborate...
The Transmission torrent client, and the syncthing file
synchronization utility can use the UPnP protocol to request a
firewall to pass *IPv4* incoming traffic (and create a port
porwarding for IPv4 NAT). They cannot however (at least to my
knowledge) use UPnP or any other protocol to request a router to
open a hole for incoming traffic in an *IPv6* firewall.
I see. Or so I think. You ask for some kind of "IPv6 equivalent" for
UPnP. But why would you want that? UpNP is a questionable idea anyway.
For IPv4 it creates an entry in de NAT table and as a side effect
creates a hole in the firewall.
But why would you need that for IPv6?
For IPv6 there (normally) is no NAT, so no need to create an entry in
a NAT table.
In IPv6 avery device has a Unique Global Address, so one
can simply create pinholes in advance as needed for the address in question.
Please eleborate...
The Transmission torrent client, and the syncthing file
synchronization utility can use the UPnP protocol to request a
firewall to pass *IPv4* incoming traffic (and create a port
porwarding for IPv4 NAT). They cannot however (at least to my
knowledge) use UPnP or any other protocol to request a router to
open a hole for incoming traffic in an *IPv6* firewall.
I see. Or so I think. You ask for
for some kind of "IPv6 equivalent" for
UPnP. But why would you want that? UpNP is a questionable idea anyway.
For IPv4 it creates an entry in de NAT table and as a side effect
creates a hole in the firewall.
But why would you need that for IPv6?
For IPv6 there (normally) is no NAT, so no need to create an entry in
a NAT table.
In IPv6 avery device has a Unique Global Address, so one
can simply create pinholes in advance as needed for the address in question.
Hello Rob,
Wednesday April 05 2023 23:22, I wrote to you:
Next up, the Fidonet nodelist.
We will see in a day or two...
Hmmm.... it seems to take a bit longer than just a couple of days. Almost two weeks later and still no binkp.synchro.net in the nodelist for 1:103/705. :(
In IPv6 avery device has a Unique Global Address, so one
can simply create pinholes in advance as needed for the address
in question.
Only when you know the IPv6 address and port beforehand.
When runing servers you normally do...
Usually an IPv6 address on the home LAN is dynamic (SLAAC),
No. SLAAC addresses are not dynamic. They are derived from the MAC address.
and the port in peer-to-peer applications, VoIP applications etc
is often dynamic too.
VOIP normally uses standard ports.
The situation is different of course when you are hosting an IPv6
web-server or something like that. It would have a fixed IPv6
address and port anyway, so there is no need for punch-holing the
firewall.
Indeed.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 508 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 230:15:35 |
| Calls: | 9,982 |
| Files: | 13,833 |
| Messages: | 6,359,673 |