I have received an IPv6 network from my provider, say it's 2001:db8:1::/48. I did not get delegated prefix from them.
I would like to use the IPv6 addresses on different networks behind a firewall (Sophos UTM)
So I assign the address 2001:db8:1::1 to the Internet port of the firewall with the prefix length being 48 as communicated by the provider. The provider's address was said to be 2001:db8:1::2. This connection seems to work fine.
Now I want to use several networks behind this firewall. Which ones could that be? I do not want to use things like NAT, as there are many addresses available and NAT should not be needed anymore with IPv6...
I decided to use the subnet 2001:db8:1:1::/64 (S1) and 2001:db8:1:2::/64 (S2) on two interfaces of the firewall. But now, the same IPv6 addresses are used on two interfaces and I am not sure if this it's correct. Also, it does not work at all.
I think I also understand, why:
Let's say a client in one subnet wants to connect to a client on the other subnet:
2001:db8:1:1:100 wants to connect to 2001:db8:1:2:200.
But on which network should the host 2001:db8:1:2:200 be? The IPv6 addresses both belongs to the network on the Internet interface (2001:db8:1::/48) and to the network S2 (2001:db8:1:2::/64) I fully understand that the firewall does not know where to route the packets...
But how to solve this? What would be the solution to this problem? Do I really net NAT? How to use all the many IPv6 addresses the provider allowed me to use? Maybe I didn't fully get some principles for IPv6, but all the other networks where the provider delegated a subnet to me, are working great.
So, can anyone explain to me how to configure my network to make my setup work?
/127
, but many ISPs do not support that. For the most part, IPv6 needs/64
networks, or you can break IPv6 features, so the ISPs just use that. The exceptions are/127
for point-to-point links, and/128
for loopback addresses. Using other size networks can cause problems. IPv6 is designed to waste addresses (get out of the IPv4 address conservation way of thinking), and address conservation is actually detrimental. You get 65,536/64
networks (each with 18,446,744,073,709,551,616 addresses) from your `/48 prefix. – Ron Maupin Jun 07 '22 at 14:06ipv6
. – Ron Maupin Jun 07 '22 at 14:24