...
Table of Contents | ||||
---|---|---|---|---|
|
Milestones
Date |
|
| ||
---|---|---|---|---|
2012-08-02 | Remote support only on IPv6 | VNC on client computers runs in IPv6 only mode. | ||
2012-01-13 | All database are running exclusively on IPv6 | Today I killed the last two instances of MySQL, which ran on our ticket system JIRA and this Confluence wiki, and replaced them with PostgreSQL. Now we only run PostgreSQL databases, that are all accessible over the network exclusively through IPv6. | ||
2011-12-20 | Axis IP camera now IPv6 only | The RTMP stream on http://www.terena.org/webcam originates from our media server media.terena.org, which is dual stack. That server pulls the stream from our AXIS Q1755 camera with host name axis.terena.org, which is now IPv6 only. Removed IPv4 address and A record, adjusted access-lists. | ||
2011-12-05 | iPhones and iPads can now use IPv6 from everywhere | Added Cisco AnyConnect mobile license to our our ASA5505, so mobile devices can have IPv6 for everywhere. | ||
2011-10-31 | Our primary file server runs Samba on IPv6 only | Removed IPv4 address 192.87.30.132 | ||
2011-04-12 | Radius communication is IPv6 | All Eduroam Radius traffic between TERENA and the Radius servers at SURFnet is done using IPv6 only. | ||
2011-03-09 | All linux servers run PostgreSQL on IPv6 only | Configure " | ||
2011-03-08 | HP Printer IPv6 only | Upgraded Laserjet 4250 with new print server, removed IPv4 address 192.87.30.138 and A record for | ||
2011-02-28 | Primary directory server | Removed IPv4 address 192.87.30.30 | ||
2011-02-07 | Nagios web interface only reachable on IPv6 | Configure | ||
2011-02-07 | SVN repository | Removed IPv4 address 192.87.30.29 and A record | ||
2011-02-01 | All linux servers run Postfix on IPv6 only (except listed MXs) | Remove IPv4 addresses from | ||
2011-01-31 | All linux servers managed by SSH via IPv6 only | Configure " | ||
2011-01-30 | All linux servers use only IPv6 resolvers | Only list IPv6 addresses in
| ||
2010-10-26 | VPN supports IPv6 | A new VPN setup: Cisco AnyConnect. Clients get an IPv4 and an IPv6 address from the office pools, so they can access all services via IPv6 |
Microsoft AutoUpdate does not work in an IPv6-only environment
2011-03-28. Upon installing a Mac with OSX 10.7 and the applications we use, I connected it to our IPv6-only network. Everything went fine, until I tried to update Microsoft Office for Mac 2011.
The update would fail:
Because the network does NAT64/DNS64, this must mean that AutoUpdate does some funky IPv4 address embedding. I will do some tcpdump debugging later.
After connecting it temporarely to the dual stack network, I did get the updates inmediately.
Ubuntu servers not ready
Trying to debug OpenDNSSEC packages on one of my IPv6-only systems but unfortunately some bumps in the way. The system keyserver.ubuntu.com does not have IPv6 connectivity, so adding GPG keys using apt-key does not work:
Code Block |
---|
root@svn:~# apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7C1A977926535DB3
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver keyserver.ubuntu.com --recv-keys 7C1A977926535DB3
gpg: requesting key 26535DB3 from hkp server keyserver.ubuntu.com
gpgkeys: HTTP fetch error 7: Failed to connect to 91.189.89.49: Network is unreachable
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0
|
Waiting for response at https://answers.launchpad.net/launchpad/+question/189094
Once manually copy/pasted they key, the next hurdle is ppa.launchpad.net:
Code Block |
---|
Reading package lists... Done
W: Failed to fetch http://ppa.launchpad.net/pkg-opendnssec/ppa/ubuntu/dists/lucid/Release.gpg Could not resolve 'ppa.launchpad.net'
W: Failed to fetch http://ppa.launchpad.net/pkg-opendnssec/ppa/ubuntu/dists/lucid/main/i18n/Translation-en_US.bz2 Could not resolve 'ppa.launchpad.net'
W: Some index files failed to download, they have been ignored, or old ones used instead.
|
Added bug https://bugs.launchpad.net/launchpad/+bug/942571 for that...
Samba
Our servers run Ubuntu 10.04 LTS, which ships with Samba 3.4.7, and this has proper IPv6 support. There is no global switch to make it listen to a specific IP version, but is not difficult to make it listen to IPV6 only.
You need to tell it to only bind to a specific (hard coded) interface address in smb.conf
:
Code Block |
---|
bind interfaces only = yes
interfaces = 2001:610:148:beef::132/64
|
This machine is a server but sits in the Office network, so it was needed to disable autoconfiguration to prevent is from accumulating multiple IPv6 addresses (which is not good for a server).
Contrary to what you would expect, setting /proc/sys/net/ipv6/conf/eth0/autoconf
to 0 does not do the trick. You have to explicitly state the interface. So I ended up with this /etc/network/interfaces
:
Tinyproxy
Some of our systems have extra "security needs", and they are not allowed to initiate outgoing connections by default. This means that IP ACLs are used so that they can only reach neccessary services (SMTP gateway, DNS resolvers, NTP etc).
Because those hosts do need access to some web sites (mostly for software updates), we use a proxy server to allow them access to those domains.
If you have an IPv6-only host that only needs access to some outside HTTP resources, then this approach kills two birds with one stone:
- Many services are run on CDNs such as Akamai, which renders IP ACLs into a nightmare. A proxy solves this by allowing domains/URLs.
- Some services are only accessible via IPv4 (Microsoft Update, hostupdate.vmware.com, Secunia.com). A dual stack proxy does the protocol translation. If those web sites were the only problems on the IPv6-only system, this is just what you need, and you can avoid using additional complex systems such as NAT64/DNS64.
Because we do not need any caching, but only the access restriction part, I choose tinyproxy because it is very light weight and simple.
The only downside is that the tinyproxy that sits in Ubuntu 12.04 does not listen on both IPv4 and IPv6 at the same time
2013-01-04 Shame on me... I didn't test properly , but tinyproxy does work on both protocols
I assumed that this result:
netstat -tlnpvw | grep tinyproxy
tcp6 0 0 :::8888 :::* LISTEN 3946/tinyproxy
meant that it didn't listen on v4... but I was wrong.
Listen ::
#This will accept connections on IPv6, but also on IPv4: IPv4-mapped IPv6 addresses are used:
#CONNECT Jan 04 15:29:13 [23566]: Connect (file descriptor 6): host.terena.org [::ffff:192.87.30.2]
Listen 0.0.0.0
# This will listen on IPv4 only
Listen 2001:610:148:dead::666
# This will listen only on the specified IPv6 address. Not nice, but workable.
Coda 2 drops support for IPv6
One of my users that joined our company recently needed to do some web editing stuff on her Apple computer. Other users have good experience with the Coda editor from panic.com. So I ordered and installed it from the Apple Store. Hadn't done this earlier but seems convenient. It was the new version 2 - whatever, let's go.
For some reason she could not connect to our web server. "Could not connect to server", "Not connected.":
Checked what was wrong and found out that version 2 dropped support for IPv6 , which renders it useless in our IPv6 only environment.
Copied the latest old version (1.7.5) and that works just fine. Questions about this on the Coda support list confirmed by fears.
Hopefully they add back IPv6 support, perhaps with a configuration switch. Until that time we won't upgrade.
As of December 2012, Coda is at version 2.0.7, and still no IPv6 support.
Remote support with IPv6-only VNC
While looking for a cross-platfrom remote support solution that does IPv6, I ended up using commercial software this time: RealVNC Enterprise Edition. This does some other handy things as well, such as AES encryption, system authentication, and an Accept/Reject dialog on the client.
By default it listens on both IPv4 and IPv6 but it can be easily configured to listen only on IPv6:
I use this to remotely support people. One important issue: you do have to know the network address before you can connect to it . There are two possibilties:
- In the office. All our computers autoconfigure themselves with the modified EUI64 interface identifier, which is based on the interface's MAC address. This works out of the box for Mac OSX 10.7/10.8, but on Windows you have to manually configure this (once). Note that this does not have to clash with privacy extensions; those can (and should, IMHO) still be disabled. This means that computers will have a(n extra) predictable address in the office, so you can assign easy to remember hostname to them, such as 'laptop-alice-wifi', 'laptop-alice-wired', etc. Note that this does not have to interfere with.
- Out of the office. People working from remote need to set up their Cisco AnyConnect VPN connection. Once that is done, they have IPv6 connectivity, bypassing any NAT boxes they might be behind. They either need to tell me their network address, or I can look it up on our VPN server.
An alternative for locating machines would be dynamic DNS, but I have not found an end-user-friendly and easy-to-administer cross platform solution for that - yet.
Microsoft AutoUpdate does not work in an IPv6-only environment
2011-03-28. Upon installing a Mac with OSX 10.7 and the applications we use, I connected it to our IPv6-only network. Everything went fine, until I tried to update Microsoft Office for Mac 2011:
Because the network does NAT64/DNS64, this must mean that AutoUpdate does some weird IPv4-only stuff. After connecting it temporarily to the dual stack network, I did get the updates immediately.
I created a couple of tcpdumps, and it looks like the AutoUpdate tool has some hardcoded logic that makes it only use A records for download.microsoft.com, which of course fail:
Interestingly, had the tool queried for a AAAA record, it would have worked:
Code Block |
---|
administrators-macbook-pro:~ root# host -t aaaa download.microsoft.com
download.microsoft.com is an alias for download.microsoft.com.nsatc.net.
download.microsoft.com.nsatc.net is an alias for main.dl.ms.akadns.net.
main.dl.ms.akadns.net is an alias for intl.dl.ms.akadns.net.
intl.dl.ms.akadns.net is an alias for dl.ms.georedirector.akadns.net.
dl.ms.georedirector.akadns.net is an alias for a767.ms.akamai.net.
a767.ms.akamai.net has IPv6 address 2001:610:148:ffff:b0b0::58dd:d830
a767.ms.akamai.net has IPv6 address 2001:610:148:ffff:b0b0::58dd:d83a |
Boo!!!
Ubuntu servers not ready
Trying to debug OpenDNSSEC packages on one of my IPv6-only systems but unfortunately some bumps in the way. The system keyserver.ubuntu.com does not have IPv6 connectivity, so adding GPG keys using apt-key does not work:
Code Block |
---|
root@svn:~# apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7C1A977926535DB3
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver keyserver.ubuntu.com --recv-keys 7C1A977926535DB3
gpg: requesting key 26535DB3 from hkp server keyserver.ubuntu.com
gpgkeys: HTTP fetch error 7: Failed to connect to 91.189.89.49: Network is unreachable
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0
|
Waiting for response at https://answers.launchpad.net/launchpad/+question/189094
Once manually copy/pasted they key, the next hurdle is ppa.launchpad.net:
Code Block |
---|
Reading package lists... Done
W: Failed to fetch http://ppa.launchpad.net/pkg-opendnssec/ppa/ubuntu/dists/lucid/Release.gpg Could not resolve 'ppa.launchpad.net'
W: Failed to fetch http://ppa.launchpad.net/pkg-opendnssec/ppa/ubuntu/dists/lucid/main/i18n/Translation-en_US.bz2 Could not resolve 'ppa.launchpad.net'
W: Some index files failed to download, they have been ignored, or old ones used instead.
|
Added bug https://bugs.launchpad.net/launchpad/+bug/942571 for that...
Samba
Our servers run Ubuntu 10.04 LTS, which ships with Samba 3.4.7, and this has proper IPv6 support. There is no global switch to make it listen to a specific IP version, but is not too difficult to make it listen to IPv6 only.
You need to tell it to only bind to a specific (hard coded) interface address in smb.conf
:
Code Block |
---|
bind interfaces only = yes
interfaces = 2001:610:148:beef::132/64
|
This machine is a server but sits in the Office network, so it was needed to disable autoconfiguration to prevent is from accumulating multiple IPv6 addresses (never a good idea for servers).
Contrary to what you would expect, setting /proc/sys/net/ipv6/conf/eth0/autoconf
to 0 does not do the trick. You have to explicitly state the interface. So I ended up with this /etc/network/interfaces
:
Code Block | ||||
---|---|---|---|---|
| ||||
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet6 loopback
pre-up ip addr del 127.0.0.1/8 | ||||
Code Block | ||||
bash | bash | # This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet6 loopback
pre-up ip addr del 127.0.0.1/8 dev lo
# The primary network interface
auto eth0
iface eth0 inet6 static
address 2001:610:148:beef::132
netmask 64
gateway 2001:610:148:beef::1 dev eth0
pre-up echo 0 > /proc/sys/net/ipv6/conf/eth0/autoconf
|
...
December 2011: after successful participation in the Eduroam-as-a-Service from SURFnet/Wentzo wireless, these accesspoints were not needed any more.
I donated them to the System & Network Engineering master education of the University of Amsterdam.
...
Can be configured to do IPv6, but only PING works
Investigate further.
2011-12-20 Reset the cam and started with fresh config, now works fine over IPv6.
Sharp MX-2600N printer
After enabling IPv6 on our Sharp MX2600N printer, the network stack actually works, but only a couple of services are running IPv6:
...
No Format |
---|
root@expat:~# nmap --system-dns 192.87.30.134
Starting Nmap 5.00 ( http://nmap.org ) at 2011-03-01 10:35 CET
Interesting ports on sharp-mx2600n.terena.org (192.87.30.134):
Not shown: 991 closed ports
PORT STATE SERVICE
21/tcp open ftp
23/tcp open telnet
80/tcp open http
443/tcp open https
515/tcp open printer
631/tcp open ipp
5900/tcp open vnc
9100/tcp open jetdirect
50001/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 2.37 seconds
|
Now I'm trying to find out how to print using IPP from Windows 7.
Ecdysis
Some tests indicate the Ecdysis works well.
Also, they presented at our own conference last year
Take into consideration!
PECL radius
IPv6 doesn't work. Needed for TERENA web site. Update 2011-03-01: by upgrading Pear_Auth, Pear Live_User was able to use LDAP (via IPv6), without the Radius overhead.
MySQL
...
/tcp open jetdirect
50001/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 2.37 seconds
|
Now I'm trying to find out how to print using IPP from Windows 7.
Ecdysis
Some tests indicate the Ecdysis works well.
Also, they presented at our own conference last year
Take into consideration!
PECL radius
IPv6 doesn't work. Needed for TERENA web site. Update 2011-03-01: by upgrading Pear_Auth, Pear Live_User was able to use LDAP (via IPv6), without the Radius overhead.
MySQL
MySQL at this moment does not support IPv6 connections, but the development versions seem to support it (sort of). There are tools to make it work, such as https://twiki.cern.ch/twiki/bin/view/EGEE/IPv6CARE.
Not A Problem Here: we have only one host running MySQL, and that will be phased out in the future any way.
Update 2013-03-22: We were forced to use MySQL for some stuff, but the version in Ubuntu 12.04 appears to have IPv6 support . I configured it to listen to IPv6 only:
Code Block |
---|
bind-address = '::' |
apt-get
security.ubuntu.com
does not work, so no security updates. Workaround: use local mirror nl.archive.ubuntu.com
for security updates.
Update 2013-03-12: This has been fixed : https://lists.ubuntu.com/archives/foundations-bugs/2013-March/140037.html
Pear Net_Socket
Does not like IPv6 addresses, wrote patch.
...
CyberDuck does not work with IPv6 hostnames. Use either literal IPv6 address, or IPv6-only host name godzilla.ipv6.terena.org
.
Semi-fixed in 4.0, but the default is to use IPv4 addresses when an address has both: http://trac.cyberduck.ch/ticket/2539#comment:15
So in order to use Cyberduck in TERENA, you'd have to change the defaults:
Code Block |
---|
defaults write ch.sudo.cyberduck connection.dns.ipv6 true |
To Do
- VMware ESXi, Vcenter, VCB. These SHOULD work on IPv6. Curious if they really work on IPv6 only...
- Google whitelistinng our DNS servers.
- In 2010 we moved to SURFMailFilter. This means that all our MX records point to those mailservers, and that our servers only need to accept mail from the SURFMailFilter servers. These are run by SURFnet and are almost all dual stack. Once they all run dual stack, we can stop accepting mail over IPv4.
- Reconfigure Nagios checks so that either IPv6, IPv4, or both are monitored.