dual-stack on steroids

descr

let’s consider a DMZ or user network. we want a protection of some kind for the internal hosts not to be reachable from outside.

and in case of the a DMZ or any internal network containing servers, we also want stable IPs within (be it static or somehow persistent).

playbook flavors

therefore this playbook allows to PoC few different things:

1. protecting network segment with NAT66 (type nat4466)
2. protecting network segment with IP6 filtering (type nat4400)
3. same but using SLAAC instead of static ip6 addressen
4. same but using DHCPv9 individual address instead of static ip6 addressen

protecting network segment

see https://pub.nethence.com/network/nat4466

see https://pub.nethence.com/network/nat4400

static vs. persistent ip6 addressen

we want presistent IPs on those hosts.

we can of course consider static ip6 addresses.

otherwise SLAAC might be enough as long as network interfaces don’t change (the MAC defines the /64 interface identifier).

however DHCPv6’s DUID (client-id) is preferred as it allows to make IP persistent (though dynamic) whatever the NIC. besides, you’re not stuck to /64 and can use any prefix you like.