Re: [Libvir] [PATCH] Add a default network

On Wed, 2007-03-07 at 18:15 +0000, Daniel P. Berrange wrote: > Do link-local addreses > let the guest communicate with outside world, or is only enablling the > VM-to-VM and VM-to-Host communications ? link-local addresses are only valid on the local link, so e.g. a router won't forward such packets. So, my point is that link-local addresses gives you offline support, since domains can reach one another. How useful in practice that is, I don't know. You don't go typing in IPv6 addresses, so I guess it's only really useful if you can look up the guest's address in DNS or mDNS even when offline.

> > The question, though, is how to make IPv6 available to guests which are > > connected to a virtual network out of a need for e.g. offline support. > > You still want NAT etc. for IPv4, but what to do about IPv6? > > > > The analogy, I think, is what would happen if your DSL provider > > statically allocated an IPv6 prefix to you while still also dynamically > > allocating an IPv4 address to you. You want to NAT IPv4 traffic using > > the IPv4 address, but you want your IPv6 traffic to be bridged to the > > IPv6 over PPP link in order to e.g. get router advertisements from the > > ISP end. > > I don;t know of any DSL providers or DSL routers which do IPv6, but I'd > expect that all my machines on my LAN magically get an IPv6 address and > that they can access the outside world. I'd still expect incoming traffic > to be restricted by the DSL router firewalling as per IPv4 incoming. It's not clear to me how e.g. netgear would implement that in their routers. The obvious, but lame way to do it would be for your machines to only have link-local addresses and outgoing traffic gets NATed. That would suck, and you can't even do NAT with IPv6 apparently.

Another way you could imagine would be for the your router to act as an IPv6 router for a delegated prefix, but I'm not sure how the ISP would communicate what that prefix should be to the router. Same with our situation, I'm not sure how a Dom0 acting as an IPv6 router would figure out what prefix has been delegated to it for its guests.

Oh, yeah - the firewall issue. Your firewall on a DSL router falls naturally out of the fact that it's doing NAT, but it'd need to actual IP filtering as it's bridging your IPv6 traffic for you to have the same firewall rules for IPv6. Uggh.