Hacker News new | past | comments | ask | show | jobs | submit login

If you want failover-independent IPs you can keep using NAT, ie NPTv6, at the gateway level and not bother with giving public IPs to your LAN machines.



Have you implemented NPTv6 before? What routing product(s) have you implemented this with? Do you happen to have some documentation links handy?

In my experience, this capability is missing from most off-the-shelf solutions, and in the cases where it is available, the documentation of this feature is missing or incomplete.


That's possible, but my understanding is that NPTv6 is strongly discouraged. Part of the point of IPv6 is do away with NAT and the problems caused by it.

I was hoping there was a better way.


Use the GUA prefix from the main ISP. During failover, retract it and switch to the GUA prefix from the second ISP. Prefix translate any stragglers that don't switch to the new prefix for whatever reason.

For active/active you can distribute both prefixes, but you don't get much control over which network clients pick. You can do the same thing here though: NAT only the outbound connections that you specifically want to steer onto the other ISP.

This way you avoid most of the problems of NAT.


NPTv6 is different from IPv4 NAT and doesn't really have the same issues.

A different solution I've seen proposed for networks with multiple ISPs is to advertise both public prefixes to the network and let each client endpoint figure out which egress to use. This seems like a worse idea though.

The most official approach is to get your own public IPv6 prefix and work with your ISPs to BGP route that to you on both links. However, home and small business ISPs generally don't offer this.


Yes, that is correct. But not having NAT is the same as having addresses that depend on the subnet prefix.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: