Is it worth me adopting IPv6 yet at home?

Hardware Hub Networking
1

Alternative title to complement the IPv6 only in 2026 thread:

IPv4 only in 2027

My ISP offers IPv6 and IPv4. The latter uses CGNAT, but via a free support ticket you can opt out and get a traditional dynamic IPv4 address, so I did.

At the moment my home uses only IPv4. Things work fine. (Possibly I’ve ran into a rare small site that hasn’t worked, but not enough to care as to why it hasn’t worked, there’s always a 10 more search engine hits I click instead..).

If I move to only IPv6 I gather I’ll have some problems as major things like GitHub apparently need IPv4. I also note I might have trouble with Valheim :frowning:

So that leaves running dualstack IPv4/IPv6 as I think the common thing people do.

Which seems like twice as much IP related faff to me, with twice as much opportunity for security misconfiguration.

The main benefit of avoiding NAT seems a bit moot in practice to me. Outgoing connections work fine with NAT. Incoming need a port forwarding rule. I don’t have many rules. Switch to IPv6 and I don’t need the port forwarding rule. Instead I need an allow rule. In either case I have to add a line to the firewall ruleset so it’s about the same amount of work.

There is likely some privacy benefit to NAT, including CGNAT. But I think many feel privacy is so far gone via things further up the stack that is moot.

Tailscale users would presumably notice the difference even less, as one of it’s major features is handling NAT traversal for you.

A perhaps trivial note is that OpenBSD has had to two remote root exploits in the default install - one in ssh and one in the IPv6 stack. Windows much more recently had an RCE in the IPv6 stack.

Am I missing out on anything major? I hear IPv6 traffic has better routing.

It’s work for me to switch over to dualstack, but I’m not sure of the ROI.

1 Like
2

ipv6 makes sense only for large networks or for the ISPs themselves. NAT has a performance impact, but that matters only if you are NATting large amounts of traffic (i.e. if you are running an ISP or backbone internet infrastructure)

In a home network where you will have less than 250 devices and a random crappy embedded device can NAT and firewall at wire speed it’s completely pointless besides nerd points.

For the sake of fairness and showing both sides, here is a video from ipv6 evangelist extraordinaire apalard. If he does not convert you to ipv6 probably nobody can

6 Likes
3

Matter and I believe some other smart home protocols require at least internal IPv6 network. Doesn’t require ISP IPv6 tho. If that matters

4

That was a compelling video. Though personally the main points I think would be somewhat negated by my fondness for doing everything over wireguard.

@zez77 - Ah that is interesting. I mostly have ZigBee, but there’s some new matter over thread as I buy from IKEA. I have yet to actually utilise any of it but I will get around to it one day. Being smarthome stuff it’ll be very segregated from the rest of the home network(s).

5

On the security worry, the part that actually changes with dual stack is inbound. Behind NAT a device is unreachable by accident; with IPv6 it has a global address and only the router’s v6 firewall stands in front of it. Most consumer routers and OpenWrt drop unsolicited inbound v6 by default, but it’s worth proving rather than assuming: scan one of your devices’ global v6 addresses from outside (a VPS with nmap -6 works) and see that nothing answers.

The second place is host firewalls. Some only cover IPv4 unless told otherwise (ufw has IPV6=yes in /etc/default/ufw, which is the default on current Debian and Ubuntu but not on every older install).

1 Like
6

I like running IPv6 at home. I’ve been doing it for a while. I wrote this guide:

I’m not sure if there’s a huge advantage. I just want to be prepared. A lot of people don’t think about the dual firewall rules that have been mentioned in this thread.

I’m not sure if we’ll ever get to the point where IPv4 is a tiny percentage of the Internet and everything is on IPv6. IPv6 does have a lot of usability issues, and was made in that era when people wanted more direct peer-to-peer.

There also weren’t any great dashboards that showed IPv4 and IPv6 availability, so I got the AI demons to write me one:

Which I have running here:

2 Likes
7

IPv6 is awesome and the “just turn ipv6 off” crowd are intellectually impaired, but ultimately the answer to this question is the same as “do you care about learning ipv6 for the inherent value of learning ipv6?”

You should only be concerned about the “security implications” of IPv6 if you are unable to configure a stateful firewall correctly, and in this scenario I would suggest disconnecting your IPv4 also.

Deploying IPv6 in my homelab helped me understand networking better. End to end routing as described in apalrd’s video is awesome.

2 Likes
8

Word of advice, that’s not a constructive approach to communicate.

That said I’m leaning towards switching parts of network provided I don’t identify any big cons, half for the sake of learning and half because of smarthome related matter over thread being exclusively IPv6. Though it’s perhaps lower down the network learning list than deploying ospfd and bgpd.

Ran across an interesting comment here:

Do you actually own that /48? The problem with using the globally routable addresses internally is that your public /48 might change in the future, and and that will force you to change a bunch of internal stuff…
– HN

Thoughts? Because that would be quite a PITA. I change home network connection more often than I’d like.

Edit: Ah I think I see, assign a private address and a public address to each IPv6 device. Private can stay stable. Public prefix might change, maybe daily depending on ISP, maybe with an upcharge can be static until I bounce ISPs. This public IPv6 dynamicism does hurt the end to end routing simplicity, solved with dynamic DNS admittedly, though writing firewall rules with DNS names has some issues.

2 Likes
9

In IPv6 world, I think ppl stop memorising their addresses but use DNS even for local domains.

Here is the interesting part, each IPv6 host on your LAN will have a pair of addresses: ULA (unique local address) and an address from DHCPv6-Prefix Delegation (assigned by your ISP and distributed by your router’s RA).

The DHCPv6-PD address is SLAAC (stateless auto address configuration). Linux is nice enough to report back to DHCP server what its SLAAC address is. Some other OSes e.g. MacOS don’t. So DHCP server like Dnsmasq won’t have a AAAA record for such hosts.

Also, it’s still like magic how Dnsmasq collects ULA address and add it to its AAAA records.

The PITA in my case was some hosts on LAN do not have AAAA records. Not so new application will have difficulty resolving a local domain e.g. zen.lan and have to wait for timeout that breaks quite a few of my applications.

So I have to disable Dnsmasq answering AAAA records unless it’s explicitly requested. Quite a gymnastics that I went through and I can’t recall how I did it.

Other than that IPv6 has been quite a smooth sailing. Not much use but good to see everything on my LAN is on dual stacks.

1 Like
10

If you are asking the question without requiring IPv6, I think you’ve answered your own question. There are no benefits other than preference at this point.

11

Yeh, no. Please do not take this as a well-informed video.

12

Going to answer this from a slightly different point of view - namely security.

I first got into network security in the late 1980s, when at a startup. Someone in management thought our new system needed “security”, and no one (myself included) knew what that meant. So went off and read research papers. Turns out, early networks landed in research labs, and so smart folk had already thought through the problems. The principles that underlie network security to this day were written down then.

In the 1980s and 1990s we had USENET, and groups focused on networks and security, so lots of folk exchanging what they learned.

When IPv6 was first announced, sounded like a cool/new technology, and I was not sure that it made sense. If you do not consider security, having all network devices in the same space is an elegant solution.

If you care at all about security, having all network devices in the same space has always looked like a fantastically bad idea!

One principal in security is to deny by default. Only permit access where it is needed, and only after careful study. Most folk are not careful.

Do we need 4-billion(-ish) public IP addresses? Probably not.

For a while, the cost of (smart) routing from public to private address was a fair argument, but in present compute is cheap, so that argument became unconvincing.

Do we need 4-billion public websites with unique IP addresses on a planet of 8-billion humans? Nope.

Will 4-billion(-ish) carefully locked down and monitored gateways prove vastly more than adequate for a mere 8-billion humans (and their devices)? Almost certainly.

I am sure that IPv6 is “better” in a technical sense (after all, it was designed later).

But I am still looking for a more compelling argument.

2 Likes
13

we ran out of public IPv4 addresses in 2010-ish btw.
The only way everything is still working is by adding clowncars on top of clowncars with NAT and having hundreds or thousands of users share the same IP.

Or for websites, by using DNS to work around the lack of IPs by having multiple domains (i.e. multiple websites) on the same IP.

And that’s the often ignored “third option” in the ipv4 vs ipv6 fight, aka add another layer of bullshit cloud-relying abstraction that lets you sidestep the issues of ipv4, so you don’t have to change “something that works”.

Which is where the “multiple domains on same IP” I said above comes in, NAT obviously is in, and overlay networks also are in.

That’s basically how all p2p/mesh VPNs work, aka the usual suspects, Nebula, Wireguard/Tailscale, Zerotier, and a sizeable cadre of businness “software defined networking” offerings like https://www.cisco.com/site/us/en/learn/topics/networking/what-is-sd-wan.html
As long as the underlying network works at all, no matter how much NAT is involved, you can have your little overlay to join all your stuff on a flat local network because there are cloud servers that relay the traffic or act as lighthouses to let you “hole punch” through the NAT you have on any connection.

Which is also OP’s choice, from what I can gather.

The choice between ipv4 and ipv6 is mostly about we want to keep using these abstractions we are using today or not, you either add more addresses at the IP protocol level or they will be added by an abstraction on top. And that already happened more than a decade ago.

And all this abstraction weights on firewalls that have to “permit access where it is needed, and only after careful study” because now IPs are meaningless and ports are also meaningless for the most part. That’s one of the reasons why deep packet inspection is a thing, again throwing more compute at the issue.

What purpose does this hypotetical serve? Nobody is locking down and monitoring gateways even now and that is unrelated to the IP technology. The security stance has been firmly “prone with a thumb up their rear” for a long time. That’s a different issue from what protocol you use. The same “throw compute at the problem” that “solves” the Ipv4 issues applies to defeating whatever semblance of safety ipv4 had.

Laundering traffic to appear from legitimate IPs is a sizeable businness, pretty much every single smart TV is part of legal botnets to launder someone else’s traffic through “residential IPs” thanks to the inclusion of proxy SDKs in smart TV apps. And more and more smart devices are either part of an actual botnet or legally laundering traffic.

1 Like
14

Did we really “run out” of IP addresses? Seems like that should be a crisis. Guess I missed it. :slight_smile:

Just for grins, and as an LLM-learning-curve exercise, made an IP-telescope. One discovery along the way were large blocks of claimed-but-disused IP addresses. There is some re-allocation needed, but I do not think we are anywhere near exhaustion.

Also, for grins, used an LLM to get my homelab network setup. (Had the plan in my head for years. Using an LLM to implement saved a lot of time.) You can do a lot with a simple OpenWRT home router. There is a complete absence of cloud. :slight_smile:

Also asked an LLM to typify and isolate my LG TVs.

My last job included design and setup of networks in a larger military radar. Was very careful to isolate internal from battlefield networks (which could be hacked). So have had reason to think about this topic.

1 Like
15

The AI agents need em. How else can they scrape all the data? :upside_down_face:

I don’t actually believe this is the case. I believe it has more addresses and that’s the only advantage. I remember some discussion of the latency and computational overhead being comprable a while ago, but not sure if that’s changed.

16

Why would it be a crisis? NAT and over-allocation of domains through DNS mean we don’t need to map one device to one IP anymore. The world has been going on with “recovered address space” (i.e. addresses freed by organizations that relinquished their allocation) for a while now.

More like IP addresses that didn’t bother answering your probe, because why would they. Bots scan stuff constantly, it’s common practice to ignore traffic you don’t care about. Not everything is a webserver that expects traffic from whomever, especially nowadays.

But I have a hard time reading the results so I might have missed something.

That said I’m aware that there are some blocks of IPs that were allocated in the dawn of ipv4 and some corpos or government orgs have way too many IPs they are doing not much with because of legacy reasons.

Like wtf is the US DoD doing with 300 million public IPs anyway. Most of the others are ISPs or cloud providers (so basically ISPs as well) and it can make more sense they need a lot of IPs.

They are exhausted unless someone goes and reclaims them from the owners, yes. That’s how exhaustion works, because everything is claimed by somebody and you can’t request new ones (besides maybe from the recovered pool as someone relinquish their allocation). By the same logic I’m not poor because I can go rob a bank and get their money.

1 Like
17

Whether on IPV4 (via a service discovery protocol like Avahi, Zeroconf or Bonjour) or on IPV6 via link local addresses I have always hated this.

I can tolerate some limited automation (like DHCP for mobile clients) but other than that I have always wanted the entirety of my network to be deterministic.

Everything that is hardwired gets a manually configured static IPv4 address, and devices on the network (like my NAS, or my printers, or anyhting else) are only ever connected to manually by typing the IP address into a config file.

I don’t even use hostnames locally. I abhor this type of dumbed down networking where I don’t control the minutiae of everything. It makes me so angry when things try to scan my network to autodetect pretty much anything.

Networks should always be 100% deterministic. At least local ones.

On several occasions I have even considered going as far as to filter out all IPV4 multicast and broadcast as well as all IPV6 traffic at the switch level on every port on my network (except maybe DNS) in order to make my network static and regain control again.

I want a system where nothing ever talks to anything else without me intentionally telling it to.

I’m OK with automation, but only if I myself personally have manually set up that automation. I want my network to be completely dark until I click on something or type something to set it in motion.

I consider the modern “you have no idea what the devices on your network are actually doing behind your back” era of networking to be positively dystopian.

1 Like
18

I introduced IPv6 in my home network a couple of years ago and pondered the same questions (e.g. “how to enable IPv6 while making sure I’m not dependent on a delegation from my ISP for internal functionality”). ULAs seem like the obvious solution, but the thing is that they are, according to RFC6724, less preferred than IPv4 addresses. So if you dual-stack your ULAs will never be used - they are useless!

My solution was to let my router distribute GUA IPv6 addresses to internal clients for when they wish to reach the public internet, but to continue to use private IPv4 addresses internally.

19

Another interesting question is how to handle dual-stacked public servers. I’m running a Valheim server, and it’s currently only accessible via my public IPv4 address (over NAT) and its dynamic dns-assigned domain name. Let’s say that Valheim started to fully support IPv6 (maybe it does already, I haven’t checked lately) and I wanted to make my server available via IPv6 as well. Do I then say to my friends who want to connect: “use my-domain to connect via IPv4 and valheim.my-domain” to connect via IPv6? That makes sense technically (and, granted, my friends are tech-savvy enough to understand what this means) - but for most this is not really feasible.

Now that I write this, the solution seems obvious: use only valheim.my-domain with an A record that points to my router’s public IP, and an AAAA record that points to the server’s GUA. Simple! (But different, as is so often the case with IPv6! :slight_smile: )

20

Yep, and you can use my handy-dandy status board to ensure both are up and both records are correct!

It even publishes Prometheus metrics so you can setup Grafana to alert you if either goes down. … or you can just spec/llm code your own. That was all made by GLM-5 + Fable I think.

A lot of client libraries fallback to the A record if the AAAA fails too.

1 Like