Use case: from Complector / db-A-001 / db-B-001, connect to a resource in IPv6.
Plan:
| rOPS Nasqueron Operations | |||
| D3081 | rOPSb982f802d065 Assign IPv6 to router-001 | ||
We need f998535a66b9 to work around ND discovery as the gateway doesn't belong to our prefix.
The same configuration through OVH gateway 2001:41d0:303:d9ff:ff:ff:ff:ff/64 (NetBox):
Also:
$ freebsd-update fetch [...] No updates needed to update system to 13.1-RELEASE-p7. WARNING: FreeBSD 13.1-RELEASE-p3 is approaching its End-of-Life date. It is strongly recommended that you upgrade to a newer release within the next 2 months.
Upgrade to FreeBSD 13.2 ongoing:
root@router-001:~ # freebsd-update install Creating snapshot of existing boot environment... done. Installing updates... Kernel updates have been installed. Please reboot and run "/usr/sbin/freebsd-update install" again to finish installing updates.
We need a maintenance window as the reboot will disrupt access to databases and Vault.
To avoid that, we should provision router-002 and use blue/green deployment for this.
Or immutable artifacts and prepare router-0xx.
Okay, update works.
IPv6 configuration works too locally:
$ ifconfig vmx0 inet6 2001:41d0:303:d971::6a7e prefixlen 64 $ route -6 add 2001:41d0:0303:d9ff:00ff:00ff:00ff:00ff -iface vmx0 add host 2001:41d0:0303:d9ff:00ff:00ff:00ff:00ff: gateway vmx0 $ ping 2001:41d0:0303:d9ff:00ff:00ff:00ff:00ff PING6(56=40+8+8 bytes) 2001:41d0:303:d971::6a7e --> 2001:41d0:303:d9ff:ff:ff:ff:ff 16 bytes from 2001:41d0:303:d9ff:ff:ff:ff:ff, icmp_seq=0 hlim=64 time=1.810 ms 16 bytes from 2001:41d0:303:d9ff:ff:ff:ff:ff, icmp_seq=1 hlim=64 time=0.830 ms ^C $ route -6 add default 2001:41d0:0303:d9ff:00ff:00ff:00ff:00ff add net default: gateway 2001:41d0:0303:d9ff:00ff:00ff:00ff:00ff $ ping ipv6.google.com PING6(56=40+8+8 bytes) 2001:41d0:303:d971::6a7e --> 2a00:1450:400e:803::200e 16 bytes from 2a00:1450:400e:803::200e, icmp_seq=5 hlim=114 time=9.962 ms 16 bytes from 2a00:1450:400e:803::200e, icmp_seq=6 hlim=114 time=9.972 ms 16 bytes from 2a00:1450:400e:803::200e, icmp_seq=7 hlim=114 time=9.907 ms 16 bytes from 2a00:1450:400e:803::200e, icmp_seq=8 hlim=114 time=9.953 ms 16 bytes from 2a00:1450:400e:803::200e, icmp_seq=9 hlim=114 time=9.956 ms ^C --- ipv6.l.google.com ping6 statistics --- 10 packets transmitted, 5 packets received, 50.0% packet loss round-trip min/avg/max/std-dev = 9.907/9.950/9.972/0.023 ms $ ping ipv6.google.com PING6(56=40+8+8 bytes) 2001:41d0:303:d971::6a7e --> 2a00:1450:4007:80c::200e 16 bytes from 2a00:1450:4007:80c::200e, icmp_seq=0 hlim=115 time=5.040 ms 16 bytes from 2a00:1450:4007:80c::200e, icmp_seq=1 hlim=115 time=5.006 ms 16 bytes from 2a00:1450:4007:80c::200e, icmp_seq=2 hlim=115 time=5.017 ms 16 bytes from 2a00:1450:4007:80c::200e, icmp_seq=3 hlim=115 time=5.020 ms 16 bytes from 2a00:1450:4007:80c::200e, icmp_seq=4 hlim=115 time=5.010 ms 16 bytes from 2a00:1450:4007:80c::200e, icmp_seq=5 hlim=115 time=4.965 ms 16 bytes from 2a00:1450:4007:80c::200e, icmp_seq=6 hlim=115 time=5.000 ms ^C --- ipv6.l.google.com ping6 statistics --- 7 packets transmitted, 7 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 4.965/5.008/5.040/0.021 ms
Decreasing priority as we've assigned a direct IP to web-001 without any need to use router-001.
router-001 IPv6
router-001 has a correct IPv6 and so can:
Outgoing IPv6 for other VMs
We currently aren't comfortable with the ideas behind IPv6.
The topology "a private IPv4 network for services" mostly prevent us from bruteforce attacks.
IPv6 wants to supersede that with "just firewall it" (ok, scan IPv6 ranges will be complicated),
and this is not something we want to explore at that stage.
Also, it's a YAGNI: complector/db-A-001/db-B-001/web-001 are happy to use IPv4 to get packages and other files.
When there is a need there, we can reopen this task and firewall them.