Ok penny dropping when you said its for the network between provider and mikrotik. Gotcha.
Is the new ipv6 firewall NAT in mikrotik not helpful with ability to masquerade? Could I not create an ipv6 LAN and share it via NAT? This would at least get ipv6 compatible devices a connection
No, there is no “masquerade” in IPv6 NAT. It is more like “netmap”: it translates a whole network 1:1 into another network address.
It can e.g. be used when your ISP gives you a dynamic address but you want a static address on your LAN, or when you have 2 ISPs with failover and want the LAN addresses to remain the same when failover occurs.
Um…
/ipv6/firewall/nat> add action=
accept add-dst-to-address-list add-src-to-address-list dst-nat jump log masquerade netmap passthrough redirect return
Well, this is just fine if ISPs assume that customers will use ISP provided gear … which many users do. But it’s not fine in case of advanced customers who want to use their own routers as border device and/or who want to split their LAN to two or more parts. I can imagine that there are ISPs who by default hand out single /64 prefix via SLAAC but offer shorter prefix (e.g. /56) via DHCPv6 prefix delegation upon request (possibly backed up with certain sum of money). And I can also imagine that some users fail to request shorter and/or static prefix from their ISP and then bitch about how stupid their ISP is.
Masquerade def seems to work.
Ping to cloudflare DNS sourced from GUA that’s not publicly routable.
[zuul@rtr-edge-02.jan1.us.ipa] > ping 2606:4700:4700::1111 src-address=200:c01d:c01a:beef::7ac0
SEQ HOST SIZE TTL TIME STATUS
0 2606:4700:4700::1111 56 57 14ms634us echo reply
1 2606:4700:4700::1111 56 57 16ms903us echo reply
2 2606:4700:4700::1111 56 57 14ms934us echo reply
3 2606:4700:4700::1111 56 57 14ms126us echo reply
4 2606:4700:4700::1111 56 57 16ms241us echo reply
5 2606:4700:4700::1111 56 57 16ms212us echo reply
6 2606:4700:4700::1111 56 57 15ms7us echo reply
7 2606:4700:4700::1111 56 57 15ms624us echo reply
sent=8 received=8 packet-loss=0% min-rtt=14ms126us avg-rtt=15ms460us max-rtt=16ms903us
NAT config
/ipv6 firewall nat
add action=masquerade chain=srcnat dst-address=2000::/3 src-address=\
200:c01d:c01a:beef::7ac0/128 to-address=2603:XXXX:XXXX:XXXX::2/128
Connection table entry
[zuul@rtr-edge-02.jan1.us.ipa] > ipv6/firewall/connection/print
Flags: S - SEEN REPLY
Columns: PROTOCOL, SRC-ADDRESS, DST-ADDRESS, TCP-STATE, TIMEOUT
# PROTOC SRC-ADDRESS DST-ADDRESS TCP-STATE TIMEO
4 S icmpv6 200:c01d:c01a:beef::7ac0 2606:4700:4700::1111 29s
This is very cool. So Even a mobile /64 address could be utilised to get internal IPv6 capable devices connected.
Haha, Bet the designers of IPv6 have veins popping out of their heads finding out this is how it will be used.
What I dont understand is why the designers of IPv6 built in such colossal waste since a /64 is the smallest subnet, each time a /64 is assigned that space is 99% wasted.
There’s nothing wrong with using masquerade on IPv6 when you have to, for instance things like VPN services where you might just get a single IPv6 but connect that to a router. It is better to have NAT-ed IPv6 than no IPv6 at all.
What you shouldn’t do is enable masquerade for security or privacy - lots of people have this misguided notion that NAT provides security and that is false.
It’s probably better to think of IPv6 as a 64-bit global address concatenated with a 64-bit local address. Calling the local address part “wasted” would really only be fair if it served no purpose beyond manual numbering. I guarantee the IETF working group was not under some illusion that any LAN would have 2^64 hosts on it. The ability to use an existing link-layer address (48-bit MAC in the case of Ethernet) to derive a unique address completely statelessly is a feature that relies on having at least that many bits free that aren’t being used for topology information. Furthermore, even absent some practical considerations like ND cache exhaustion, having IPv6 hosts allocated dynamically and sparsely across 64 bits is a security feature. Scanning IP address space relies on the relatively small size of IPv4 to be a tractable problem.
The internet was built on the proud tradition of implementing things that shouldn’t be implemented and NAPT66 is one of them. I can’t deny that there are some circumstances in which you might gain some utility from having it, but I sincerely hope that IPv4 norms don’t cause IPv6 deployments to backslide into using NAPT66 with any regularity. Stateless NAT66 on whole prefixes is a whole other deal and I can see valid technical arguments for it existing (mostly centered around AS multihoming receiving DHCPv6 PD delegations from two providers’ PA blocks) but … address-overloaded NAPT66? … please no.
I don’t think this is going to happen. The only reason why people actually want to use NAPT66 is the misguided notion of it being more secure or enhancing privacy. Some people still have this misunderstanding but it is being corrected over time. The larger problem is people not using IPv6 at all and not knowing why anyone would want to use it. I work for an ISP and when I was rolling out IPv6 I dealt with the gripes of the sysadmin → we don’t need IPv6, nobody needs it, NAT is good enough.
I’m using it to give my phone IPv6 connectivity, since the other Wireguard peer has a dynamic IPv6 prefix, I’ve found it to be the only easy option.
I hope not. Who cares about designers, the ones who should be concerned are users. Main point of IPv6 was “endless” supply of public addresses for everyone. That should be the normal thing. No need for NAT anymore, except for rare special cases. It may not be big deal for things like web browsing, but if it was just that, we could have stayed with IPv4 forever.
I am waiting on the User Article from Sob.
How to Move from IPV4 to IPV6 in Really Really Slow time for the LLAMA.
A gentle fable that warmly coerces the new user to imperceptibly move into the new realm of ipv6.
Like cooking a frog in a frying pan, the right way, slowly!
Otherwise it will be ugly, kicking braying, biting, spitting and extreme flatulence!!
Forum a few day ago, an Android device doing things it should not do. I just wrote “IPv6?”. Solved…deactivating IPv6 did solved it also there.
Used IPv6 for years but since a few no IPv6 for me. NAT for IPv6 sounds good but bad memories of my earlier IPv6 time still prevails.
As of March 2022, according to Google, the IPv6 adoption rate globally is around 34%, but in the U.S. it’s at about 46%.
Nah, do it quick. Just use the pan cover (the non-transparent one) to hide the ugly details.
Microsoft does not support this for Hot/Live-mail etc. Is Microsoft then a outdated company?
@msatter
My knowledge oh Hotmail/Live is very poor so I cannot answer to those specific services … office 365 and all other Windows systems provide 100% support for ipv6 …. 90% of US government mail systems are now ipv6 …. Where MS now has a dominate position by 2023 all US government depts will be Ipv6 …. This will force everyone to convert faster because the US Goverment is the pre-emanate purchaser of goods and service … so anyone wanting to do business with the US will and must convert …. Many have converted … it’s just going to happen much faster starting in 2023.
All my TV services are ipv6 exclusively as is my cell phone service … I am 100% certain that ipv6 will become the defecto standard before long.In Canada all the major Telecoms are ipv6 … Bell Canada and all their subsidiaries will be converting their FTTH infrastucture to ipv6 in 2023.this will force Anav to convert as well 
That’s my exact thought from twenty years ago. Now I’m no longer that optimistic anymore. 
It must be also 20 years ago that I was offered it and then the time frameeas that 2012 the switch would be made to all IPv6.
https://tweakers.net/nieuws/23639/xs4all-biedt-als-eerste-nederlandse-provider-ipv6-diensten.html (Dutch language)
Ten years later all got default, an IPv6 addres:
https://tweakers.net/nieuws/82260/xs4all-gaat-nieuwe-klanten-automatisch-van-ipv6-voorzien.html (also in Dutch)
IPv6 adoptation almost stopped in September 2021:
https://www.sidn.nl/nieuws-en-blogs/verdere-adoptie-ipv6-in-nederland-nagenoeg-tot-stilstand-gekomen (also in Dutch)
Dutch Government starts adopting IPv6: December 2021
https://forumstandaardisatie.nl/nieuws/activering-ipv6-op-exchange-online-voor-nederlandse-overheid (also in Dutch)
Do you also happen to have solution for the following two common issues with IPv6 in residential deployments: