No. Your ISP or tunnel broker gives you a network prefix. Then you configure SLAAC to use that prefix and hand out addresses within it. Job done.

For example, the prefix might look like 2001:470:e904::/48. Your computers can use any addresses you want as long as they start with that prefix. Since you don’t want to manually hand out addresses to every computer, you configure a router to hand out addresses via SLAAC. Your computers will use SLAAC to discover the prefix from the router, then fill in the bottom 64 bits of the address with a random number. They then ask the local network if anyone is using that full address. If not then they are done and have a working address. If somehow someone is using that address then they try again with a different random number. Servers that want a fixed address will just use their network card’s MAC address (or anything similar, if you want) instead of a random number. The protocol is the same either way.

Notice that this actually gives you some bits of your own to play with, if you want. The full address is 128 bits long. The first 48 were used by the prefix and the bottom 64 by the individual devices, leaving 16 bits in the middle. You could tell your router that the prefix for SLAAC is 2001:470:e904:42::/64, for example, and then use the other subnets for other purposes. Maybe 2001:470:e904:beef::/64 is a special subnet just for your meat freezer and associated monitoring equipment. I don't know, you get to make these things up for yourself. Maybe you manage a corporate network that has a separate VLAN for phones than for normal PCs, and a third VLAN for the guest WiFi. You can give them each a different prefix by embedding the VLAN id into the prefix you advertise via SLAAC.

There’s also DHCPv6 if you want even more control over which addresses are handed out, or you want to subdivide your network even more finely. Or if ISPs ever start handing out smaller prefixes.

> If your ISP gives you a static IPv6. Unfortunately in Germany none of the ISP for private users does (last I checked).

Sure, that’s true. But they probably don’t hand out static addresses for IPv4 either. Not without paying extra, that’s for sure. Either way if you want some static identifier for your computer(s) then the solution is the same: DNS.

Of course if you _are_ running a corporate network with a bunch of VLANS like that then you should actually get your own prefix from your RIR rather than from your ISP. Then you purchase IP transit services from your ISP rather than consumer internet access. You can then advertise your prefix(es) via BGP. Again, this is exactly what you would do for IPv4. Same software, same configuration, just longer addresses. The main advantage of this extra work is that you can keep your addresses static even if you move to an entirely different ISP. You can also use the same addresses over multiple connections to multiple ISPs for better redundancy.

I did give the answer: SLAAC.

> If your ISP gives you a static IPv6. Unfortunately in Germany none of the ISP for private users does (last I checked).

Weird, here in the UK all the ones I've had have given me a static /56. Still, the same answer for that (DDNS) exist as for dynamic IPv4 addresses, you still get the advantage of not having to deal with NAT.

Use MAC as the key for firewall and monitoring. Then you don't have multiple rules per device.

Works great for me.

But more generally, I think times have changed enough for per device billing not being a viable approach anymore.

IPv4 also has a similar, though rarely documented or utilized, shortcut system. Try `ping 1.1` for example. It expands to 1.0.0.1.

That becomes 2001:0c2d:4308::/48 instead

After that you just need to remember the subnet number and the host number. If you remember 12.45.67.8 maps to 192.168.13.7 you might have

2001:0c2d:4308:13::7

So subnet “13” and host “7”

It’s not much different to remebering 12.45.67.8>192.168.13.7

IPv4 was not designed as such, but as an academic exercise. It was an experiment. An experiment that "escape the lab". This is per Vint Cerf:

* https://www.pcmag.com/news/north-america-exhausts-ipv4-addre...

And if you think there wasn't politics in iPv4 you're dead wrong:

* https://spectrum.ieee.org/vint-cerf-mistakes

> IPv6 was designed by political process.

Only if by "political process" you mean a bunch of people got together (physically and virtually) and debated the options and chose what they thought was best. The criteria for choosing IPng were documented:

* https://datatracker.ietf.org/doc/html/rfc1726

There were a number of proposals, and three finalists, with SIPP being chosen:

* https://datatracker.ietf.org/doc/html/rfc1752

> I firmly believe that if they had adopted any other strategy where addresses could be meaningfully understood and worked with by the least skilled network operators, we would have had "IPv6" adoption 10 years ago.

The primary reason for IPng was >32 bits of address space. The only way to make them shorter is to have fewer bits, which completely defeats the purpose of the endeavour.

There was no way to move from 32-bits to >32-bits without every network stack of every device element (host, gateway, firewall, application, etc) getting new code. Anything that changed the type and size of sockaddr->sa_family (plus things like new DNS resource record types: A is 32-bit only; see addrinfo->ai_family) would require new code.

And what's wrong with a newer version of a thing solving all the problems people had with it...?

There are more people than IPv4 addresses, so the pigeonhole principle says you can't give every person an IPv4 address, never mind when you add servers as well. Expanding the address space by 6% does absolute nothing to solve anything and I'm confused about why you think it would.

"Modern" tooling in the consumer space is pretty dire for IPv6 support too. The best you can reasonably get is an IPv6 on the WAN side and then just IPv4 for everything local. At least from the popular routers I've experienced lately.

Privacy extensions are worthless because there are just sooooo many ways to fingerprint and track you. If you are not at least using a VPN and a jailed privacy mode browser at a bare minimum, you are toast. If you’re serious about privacy you have to use stuff like Tor.

V6 privacy extensions are like the GDPR cookie nonsense: ineffective countermeasures with annoying side effects.

SLAAC sucks too. They should have left assignment up to admins or higher level protocols like with V4. It’s better that way.

* https://en.wikipedia.org/wiki/IPv4_shared_address_space

They're probably using CG-NAT, though IP changes that often is a bit aggressive.

Your website will load faster on cellphones if it supports IPv6. This is because the packets take more direct routes (because they don't go to the central CGNAT server) and because less processing is applied to them. Almost all mobile networks are now IPv6-only, with IPv4 traffic tunneled and CGNATted. Apparently T-Mobile is the rare exception.

I am suggesting the ER7212PC is not a home network device, and thus having the two functions glommed together is an anti-feature in its design. The tagline of Omada is "Networks Empower Business":

* https://www.omadanetworks.com

Expecting that a router to not-route IPv6 by default is to misunderstand its purpose.

Except the ER7212PC, nor anything else under the Omada (sub-)brand, is not a consumer / household device. The tagline of Omada is "Networks Empower Business":

* https://www.omadanetworks.com

If you want to haul your boat buy an F-150 pickup and don't complain that your Golf doesn't have enough towing capacity: buy the tool that you need for the problem/job you have. If you want an all-in-one then buy an AiO and not a router.

>> And no, I'm not being pedantic

> You very much are.

Expecting a router to not-route IPv6 is the unreasonable thought.

Then buy a device that does default NATing and other consumer-y if you want that. Don't complain that a generic routing system routes IP—whether IPv4 or IPv6—by default.

If you want a firewall buy a firewall. If you want an all-in-one firewall/gateway/AP/whatever, buy it.

In this particular case the "problem" is not in the device but in purchasing the wrong tool for the job at hand. If you want to haul lumber buy a cargo van or pickup truck, not a VW Golf.

The ER7212PC, nor anything else in the Omada line, is not for residential consumers which is what RFC 6092—"Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service"—refers to.

And RFC 7084 has two instances of the word "firewall", one (§3.1) in reference to IPv4 NAT:

    A typical IPv4 NAT deployment by default blocks all incoming
    connections.  Opening of ports is typically allowed using a Universal
    Plug and Play Internet Gateway Device (UPnP IGD) [UPnP-IGD] or some
    other firewall control protocol.

    S-3:  If the IPv6 CE router firewall is configured to filter incoming
          tunneled data, the firewall SHOULD provide the capability to
          filter decapsulated packets from a tunnel.

Also... the ability for people to deterministically reach out to a specific device on your network is the exact same ability you use to deterministically reach out to specific devices on their networks, just viewed from the opposite side. If the Internet wasn't a place where people could decide to run services on their networks and connect to services that other people ran on their networks, what would the point even be?

IPv6 supports customer-controlled prefix rotation. You can select how often it happens by configuring your router to periodically change its DUID. Of course, your ISP can ignore this signal and always assign the same prefix anyway, but you can hardly blame that on IPv6.

You can share that IP address by putting multiple hosts on the same local network and using parts of the transport later. NAT was invented because of lacking enough addresses.

Using Openwrt which pretty much all home routers are built on, all I have to do is tell my router which offset to give my subnets from the prefix and it does the rest.

Both for subdividing up the prefix from the ISP and my ULA prefix I use for internal devices.

I have changed ISPs I think 3 times with no ill effects. Plus it works when my ISP occasionally gives me a new prefix.

The only tweaking I had to do was when I went from an ISP that game me a /48 to one that only gave me a /56. I had been greedy and was handing a /56 to my internal router. I changed that to a /60 and updates it's expectations about which subnets it could hand out and all was good.

But I expect two layers of home routers without NAT is a bit of an exception.

(same for ping)

> To control which link the traffic uses, you just assign router priority in the router advertisement (these are all standard settings in radvd.conf).

Have you done this? Did it actually work for you?

When I tried it, clients would regularly send to router B with an address from router A, and often ignore the priorities. As I understand the RFCs/client behavior, the router priority field is only relevant if multiple prefixes are in a single advertisement, otherwise most recent advertisement wins.

Once you need to aggregate the advertisements, you may as well NAT66, cause it will be easier.

Hyper scalers != cloud computing.

Interestingly, if I pay for their IPTV service the internet side becomes a bare ethernet port over which I can do DHCP for the upstream interface and number the downstream subnet out of my /28.

I have debated paying for TV service as a sanity fee.

I bet OP has already blocked at least 3 of them. Private browsing is only a partial solution, blocking/unblocking domains, scripts, etc. on a case-by-case basis is a more reliable way to defend your right to privacy against abusive practices (I'm talking about fine grained adblockers such as uMatrix/uBlockOrigin) daily.

I admit it can be a hassle sometimes, in particular if one explores the net every day, but staying away from bad actors (such as some of those 4) is one way to maybe eventually stop them - even if "vote with your clicks" feels as pointless as "vote with your feet" when you're just one in many millions.

To be fair about fingerprinting, there's no such thing as "bulletproof", but I do have a pretty robust setup. DNS level ad and tracker blocking, browser extension level ad and tracker blocking, LibreWolf's extensive anti-fingerprinting measures, kernel-level measures like kloak, I block all third party JS by default, etc. My goal isn't to become invisible and untraceable to nation states (which is essentially impossible when 90%+ of all global ISPs can and do sell netflow metadata, enabling timing and packet size correlation even across multiple hops, even with background traffic forgery / traffic pattern obfuscation), but rather to frustrate lower-level tracking efforts, and mostly to reduce attack surface for security reasons, and to reduce the total amount of information I'm sending to adversaries, even if it technically increases uniqueness. For instance, WebGL, JS JIT, WASM, WebRTC, and even SVG rendering are similarly disabled by default on my browsers, and I may very selectively enable them on a case-by-case basis depending on how important I feel the web property I'm trying to access actually is. I'll spoof my UA, my screen dimensions, and use residential SOCKS5 proxies, one by one, to identify which fingerprinting measures are being used to block me with YouTube, for instance, without enabling JIT compilation or SVG rendering. This approach absolutely does make me more distinctly identifiable (less anonymous), but doesn't necessarily make me less private, nor less secure, if e.g. ad network JS never even runs on my box in the first place. Security is the base of the pyramid, it is the prerequisite for privacy, but doesn't guarantee it. Privacy is the middle layer, it is the prerequisite for anonymity, but doesn't guarantee it. I'm aggressively climbing that pyramid where I can while accepting some tradeoffs where the net benefit is positive to me. I don't think of any of these - security, privacy, or anonymity - as binary properties, but rather a unified journey I am on to enhance gradually and iteratively over time. Switching to IPv6 would greatly complicate and regress my path through much of the journey I've already completed.

If I could leave you with a couple questions: What tangible benefits have you reaped from IPv6 that simply weren't possible on IPv4? Has the ROI for you on going dual stack outweighed the costs on your time, attention, and configuration work required for securely handling edge cases, dealing with weird or unexpected routing issues, for straying from the happy path?

Exactly. I randomly try to "upgrade" to ipv6 in my home once in a while and i always give up because I'd have to do the whole enterprisey setup for no good reason.

Edit:

Basically ipv6 is too complex and automated to hold your home network's whole configuration in your head without effort.

So the techies don't set it up at home unless they have a fetish for overcomplicated setups. They're not familiar with it so they don't push for it at work either.

Adoption is solely driven by ipv4 address space exhaustion. There is no "new toy!" feeling involved.

# You can buy a cheap domain and use it as your home DNS (eg "router.myhome.net" -> "2003:123:4:5::1") so it works anywhere! In the home or roaming (over VPN). I don't really need to run DNS at home. My domain runs on Cloudflare DNS, my devices use NextDNS (with rebind protection disabled for my home domain).

# I run OpenWRT and preallocate DHCP addresses for all known devices. Then I shrink the DHCP pool to a blacklisted range. A script automatically creates DNS records for all preallocated devices. If a new device appears in the blacklisted DHCP pool, I can manually allocate its MAC address a proper IP.

# It's easy to get TLS certs for any service in the house using the ACME DNS01 challenge.

There is literally no difference between v4 and v6 here.

How? Why is using hex any more intuitive than binary or a md5 hash for anyone who doesn’t do networking for a living?

>If you do anything peer to peer at all, calls or file transfers or games, there's a benefit. And the typical benefit grows over time as more and more ISPs install CGNAT.

Again how? I’ve been doing all of those without issue for nearly 30 years. What measurable benefit does the user see that hasn’t been a solved problem since Windows XP?

Will my teams calls suddenly stop saying “poor network connection” on my 1000/1000 rock solid fibre connection? Will torrents suddenly find more seeds and peers? Will my games… have lower latency? Because I can’t think of another way anything networking related could be solved that wasn’t decades ago.

When you say benefit, it should probably be noticeable or measurable in some way that doesn’t involve dashboards and millions of dollars in rack mounted gear.

This only applies to /64 blocks, which are by no means standard. For instance, tunnelbroker.net will give you a /48 for free. This means IPv6 addresses are essentially free by the billions, but it's difficult to figure out how big of a block they belong to from the outside.

Ok, I'll bite. Why exactly do you not have the ability to select the address?

As a general rule, if you care about an IPv6 address enough that you have to type it in somewhere, you should be assigning it manually, and if you're doing that you can make it a lot friendlier than 2601:3c7:4f80:1a01:4d2:3b7a:9c10:6f5e. The whole second half of the address can be shortened to ::<digit>, where the length of <digit> scales logarithmically to the number of memorable addresses you want in that network.

My network at home uses ULA addresses for everything, and I just use my phone number in the first half, so the address of my router at home is e.g. fd21:2555:1212::1, my NAS is fd21:2555:1212::a, etc. The global (GUA) address is something like 2601:abc:def:1201::a, which isn't that bad.

Hell, if you don't care about the potential of conflicts if you ever merge networks with someone else, you can just use fd00:: as your ULA prefix, and your router can be fd00::1, your NAS box can be fd00::2, etc. Shorter than IPv4 addresses!

If you would like your IPv6 addresses to be more human-friendly, you could use DHCPv6 (in addition to/instead of SLAAC) and end up with addresses like 2001:db8:3c7:4f80::123. Sure, it's 5 groups of e.g. 3-4 hex digits rather than 4 groups of up to 3 digits, but I think it's much easier than your example. You might set your router to use <prefix>::1 and/or fe80::1 (see OpenWRT's ipv6 suffix/ip6ifaceid option).

DNS servers (that you might occasionally have to type into config by hand) tend to have "nice" IPv6 addresses, e.g. Quad9 apparently uses 2620:fe::fe [1].

> But I'm really not interested in maintaining public DNS for the dynamic addresses at home on my LAN.

I think dnsmasq can these days create AAAA records for local machines whose hostnames it learns via e.g. DHCP.

If you have a public server on the internet and your provider gives you a random-looking address using all 128 bits (and no /64 prefix for example) perhaps using (public) DNS is fine.

Opinions my own.

[1] https://quad9.net.

https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_tr...

They linked a whole article detailing the complexities of specifically NAT traversal.

I should think it obvious that by removing an entire leaky layer of abstraction the process would be much simpler. Yes, you still need a coordination server, but instead of having to deduce the incoming/outgoing port mappings you can just share the "external IP" of each client--which in the IPV6 case isn't "external," it's just "the IP".

Nearly every ISP uses DHCPv6-PD cause harder for manual configuration. The range is in the DHCP-PD, your router picks a subnet. The WAN address is automatic, and don't care about it cause never see it. Mine is link-local and hadn't known until I checked.

If you don't want to use the public addresses internally, then you can assign ULA addresses. If you don't want to use MAC derived addresses, assign them static host addresses.

For names, I use mDNS. I don't know the IPv6 address for my server. If I did need it, I would get it from the router.