#soylent | Logs for 2026-10-16
« return
[01:01:12] -!- Loggie [Loggie!Loggie@Soylent/BotArmy] has joined #soylent
[07:52:10] <Ingar> AlwaysNever: that's my general impression: IPv6 was over-engineered in an age were privacy wasn't much of an issue
[07:52:44] <Ingar> and it does too much magik stuff
[07:53:08] <Ingar> magic self-addressing, magic routing
[09:47:53] <fab23> I do have a routet "internal" IPv6 subnet, behind a firewall which does only allow traffic from the inside out.
[10:50:27] <fab23> https://ai-circular-economy.com (out of https://unixdigest.com)
[10:50:28] <systemd> ^ 0303Is there an AI bubble?
[10:50:30] <systemd> 05Error: HTTP 404 for https://unixdigest.com)
[16:41:49] <Ingar> fab23: ULA?
[16:42:09] <Ingar> or that that thing with 'subnet nat'
[16:43:11] <fab23> Ingar: no, with a /64 out of my /48, no NAT or such, access to the IPs is just blocked from outside (through OPNsense)
[16:46:17] <Ingar> so just public address with some firewall rules ;)
[16:46:22] <fab23> yes
[16:46:29] <Ingar> is exactly what I was doing
[16:46:51] <Ingar> I get a /57, dhcp assigns a /64 to each of my three subnets
[16:48:11] <Ingar> fab23: I'm going to look at it again this weekend, but I'm going to remove firewall rules and do some tcpdumping
[16:48:29] <Ingar> and try to find an answer on hte question wether or not I need to run rtsold
[16:49:33] <fab23> a long time ago when it was behind a host with IPFW, I had simple rules, allowed TCP from inside out (and established back in) and I did let UDP through in and out
[16:51:27] <Ingar> I had the habit if using a lot of network/netmask based rules
[16:51:36] <Ingar> it totally fucks with ipv6's multiple addresses
[16:52:28] <Ingar> e.g. blabla from self doesn't do local link
[16:53:34] <fab23> are you using pf?
[16:54:29] <Ingar> evidently :)
[16:55:18] <fab23> I only have a few simple rules on my macOS boxes, the more complex stuff so far I have done with OPNsense in WebGUI
[16:56:11] <fab23> but with pf it is always the traffic on an interface into the box, which makes some thinking difficult
[16:56:26] <fab23> either allow or block/drop
[16:56:58] <Ingar> I allow in what I want and then drop quick anything else
[16:57:08] <Ingar> for incoming connectiosn to the host itself, that is
[16:57:25] <fab23> in some cases even this helps: pass in quick proto tcp from { <own> } to any port 22 keep state
[16:57:59] <fab23> table <own> persist { 192.168.1.0/24, 10.1.2.0/24 }
[16:58:11] <fab23> the table command should be before in the pf.conf
[16:58:30] <Ingar> I use $interface:network
[16:58:36] <fab23> and then eg. this two lines:
[16:58:39] <fab23> pass in quick proto tcp from { <own> } to any port 22 keep state
[16:58:41] <fab23> block return in quick proto tcp from { 0.0.0.0/0 } to any port 22
[16:58:42] <Ingar> no messing with a ddresses
[16:59:17] <fab23> that depends :)
[16:59:50] <Ingar> also, some of my subnets shouldn't crosstalk and self rules allows traffic to ALL addresses on all interfaces
[16:59:55] <Ingar> which is not what I want
[22:54:45] <AlwaysNever> massive IPv6-induced headache
[22:56:34] <AlwaysNever> meanwhile, my IPv4-based NATed LAN with private IPs lives a happy life - no matter how badly configured my router may get, it will remain unreachable to outsiders