Re: [v6ops] Scope of Unique Local IPv6 Unicast Addresses (Fwd: New Version Notification for draft-gont-6man-ipv6-ula-scope-00.txt)

[Fernando Gont <[e-mail]>]

On 6/1/21 14:10, Ted Lemon wrote:
> On Jan 6, 2021, at 11:46 AM, Fernando Gont <[e-mail] 
> <mailto:[e-mail]>> wrote:
>> I have Raspberry Pis that deploy here and there. In order to be able 
>> to access them, they use dynamic DNS to post their addresses on their DNS.
>> If I don't look at the properties of the addresses, then I end up 
>> puting crap on the DNS. One straightforward consequence is that many 
>> apps that don't do Happy Eyeballs end up having an insane 
>> connection-establishment period, if they happen to try the unusable 
>> addresses first.
>>
>> So "find all your IPv6 addresses and post them to the DNS" doesn't work.
> 
> It is of course not even obvious how to solve this, because sometimes 
> you do want ULA in DNS, and sometimes you don’t. And it depends on what 
> DNS. If you are doing split DNS, then you can scope the DNS that 
> advertises ULAs only to serve those networks where those ULAs are 
> in-scope. The DNS that is advertised globally would of course contain no 
> ULAs. How this is arranged is either a matter of local configuration or 
> an interesting topic of future work, depending on how you look at it.

What I do is set up to different names. e.g.:

node.mydomain,com  for the global addresses, and,
node-local.mydomain.com for the non-global addresses.

In the case of apps that are expected to be available only to local 
nodes (e.g., mDNS) the daemon might want to explicitly bind() a ULA, 
rather than bind() the wildcard "address". So the app gets an extra 
layer of isolation as a result of the address scope. And probably also 
gets more stability, since in most cases the ULA prefix will be 
generated by the local router and thus be stable, while the global 
prefix may end up being dynamic.


-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492