Yup indeed. That’s why it advertises both dhcp and slaac

I use openwrt on my home network which uses dnsmasq for dhcp. It can give a static suffix which just works with the global prefix on the interface and the site local / ula prefix it uses

Weird! Though I guess a lot of these would be sitting behind load balancers / reverse proxies anyway (so ipv4 is fine) and unlikely to up and change isps very often? Lol

If I had to, I’d be trying to add an extra cidr to one of the options listed at https://kubernetes.io/docs/concepts/services-networking/dual-stack/#configure-ipv4-ipv6-dual-stack But as you say, probably doesn’t work!

Indeed, that’s correct ula usage, but shouldn’t need nat rewriting. The global prefixes just need to be advertised by RA packets

Not sure on the history of that. It would make things like that easier

Even if you give it multiple ip6 cidrs to allocate?

It certainly looks like you can give it a prefix to assign out, possibly even multiples

Instead of nat and port forwards that rewrite, your firewall is set to only forward specific traffic, exactly how’d you’d configure outbound forwarding on a nat network (but opposite directions)

Open forwarding is a router, not a firewall

🧓

Also for routing table reasons. Ipv6 needs to use prefixes to do link aggregation or it just gets too bjg

Address space is so huge that iirc the only global addresses in use are 2xxx::

Its so huge that it’s not needed to use anything else is the goal as far as I see. If it starts with 2, it’s global.

Ehh, I’ve seen both. Perhaps not in a home router context though, never really bothered to check

Point is, you should be able to have them have both. Or stick a reverse proxy in front that can translate. Unless they’re somehow meant to be directly internet reachable the public addresses could be autogenerated

Full disclosure though I don’t know anything about kubernetes.

And if you want static ips either use dhcp6 or disable the randomisation of eui64 addresses

It should only be needed if your ISP is brain-dead and only gives you a /64 instead of what they should be doing and also giving you a /56 or /48 with prefix delegation (I.e it should be getting both a 64 for the wan interface, and a delegation for routing)

You router should be using that prefix and sticking just a /64 on the lan interface which it advertises appropriately (and you can route the others as you please)

Internal ipv6 should be using site-local ipv6, and if they have internet access they would have both addresses.

Fire bad, change scary