Hints for use with IPv6 added

[thomasschaeferm]

There are big differences in handling ipv4 and ipv6 for remote access in residential environments(dsl,cable,fibre, maybe mobile too).
In ipv4 it was very common to use address and port forwarding. The router was the only device with a public address. So the router got a packet and translates it (address and port) to a private ip on the lan. Also the router was (mostly) responsible for getting a (nice) dns name.

With ipv6 something has changed. Depending on your isp (ds-lite(carrier grade nat) vs. dualstack) you don't get a public ipv4 address anymore.
Instead of one public ipv4 address you get a whole net with ipv6 addresses.
Your computers get one or more addresses from that net. They all are public, but usually protected by the routers firewall against unwanted incoming packets.

To use these addresses for remote access we need to do at least two things:

open the routers firewall or a particularly service/port for the device on the lan (no nat anymore)
create one dns name for that device (not for the routers ip address anymore)

opening/configuring the firewall has to be done on the router
dns updates can be managed by the device itself or by the router.

Since privacy extensions (randomizing ip addresses) are in conflict with server use, I recommend to disable privacy extensions for that use case

My examples:

web server: http://tschaefer.dynv6.net
remote desktop: xfreerdp +glyph-cache /v:raspberrypi4.zts9jt8obs8kionr.myfritz.net

ssh: both

[lurch]

@JamesH65 Any idea how widespread IPv6 networks are? Do you think they're common enough to warrant inclusion in the RPi documentation?

[thomasschaeferm]

There statistics by google, akamai, facebook and apnic.
https://www.google.de/ipv6/statistics.html
https://www.facebook.com/ipv6/?tab=ipv6_country
https://www.akamai.com/de/de/resources/our-thinking/state-of-the-internet-report/state-of-the-internet-ipv6-adoption-visualization.jsp
https://stats.labs.apnic.net/ipv6

At least in Germany they are very common. Also in Germany DS-lite by Vodafone Cable (no public IPv4 addresses anymore !) is very common.
So for millions of users IPv6 is the only possibility for remote access. My proposal is just about some general router/dns hints. The rpi itself works with IPv6 like a charm.

[JamesH65]

I like the idea, but reading it I'm still not sure what is actually happening. Can you add some stuff, won't need much, to explain specifically what this is doing?

[thomasschaeferm]

I added a description.

[JamesH65]

I am not seeing an new commit on the PR? Did you push it?

[thomasschaeferm]

I did not change the pull request itself. I think it should not be bigger.
I added a motivation and a description to the first/initial comment of this conversation.
The initial description of the pull request was empty before.
#1318 (comment)

[JamesH65]

AH, I see. I think some or all of that description does need to be in the PR text, or people will not actually know what they are doing and why, which will make for problems with support later. The more information provided the better.

[lurch]

@thomasschaeferm Starting to look much better now, thanks 👍

[JamesH65]

Everyone happy with this? Reads OK to me.

[lurch]

I wonder if @mythic-beasties might want to have a quick look at this, since IIRC he's very familiar with IPv6 ?

[mythic-beasties]

I suspect this is going to be pretty hard to make generic as life is now a lot more complicated. You've got a variety of network types,

Traditional v4 + NAT (most fixed line)
Your router has a public v4 address which every device behind it uses. You may be able to configure it to forward to a private v4 address on your Pi. Your public address may be static, may be sticky dynamic (i.e. basically never changes) or change every reconnect.

Traditional v4 with CGNAT (lots of mobile, some fixed line)
Your router has a private v4 address, the public address is somewhere in the network. Inbound traffic is prohibited.

Traditional v4 + NAT + v6 (some fixed line)
See above, but you have a static or dynamic v6 allocation. In addition to port forwarding, you can also just open up the router to allow inbound v6 connections. By default your Pi will use privacy addresses so it's v6 address will continuously change, you'll want it to have a static or hardware defined address, and you may also need external DNS if your v6 allocation keeps changing.

Traditional v4 with CGNAT + v6 (lots of mobile, newer ISPs)
The only way to have inbound traffic is via v6 as above.

v6 only with NAT64
Nobody is brave enough to do this as a residential ISP, but the Mythic Beasts PiCloud does this. IPv4 just isn't supported at all, all v4 connections get translated to v6 ones.

There's a whole bunch of implementation details about how modern networks are being rolled out, depending on if they've gone all in for IPv4 only and CGNAT (e.g. Vodafone's new 1Gbps fibre setup), or a pure v6 network with the IPv4 being provided as a compatibility layer on the top (Sky Italia).

The trend is clear though, v4 inbound is only likely to work on an expensive business only line, v6 inbound is increasingly likely to work on comon connections, if you're allowed to enable inbound connections.

However, I think general documentation from Pi Towers can only be starting point due to the variability of what's offered.

[thomasschaeferm]

Thank you for the long comment. Despite the variety of network types we should provide a path where the user can start from.

[lurch]

Thanks Pete ❤️

[JamesH65]

Whereabouts are we with this?

[JamesH65]

Sorry about the delay. This PR seems OK to me, it gives more information than before, and is a starting point. I wonder if Mythic-beasties comments should make it in to the docs somehow as well.

[aallan]

In light of #1911 is this PR still relevant? If there is supporting third-party documentation outside of this repo, and there hasn't been much recent progress I'd be inclined to close it? This feels very much non-Raspberry Pi specific material and therefore outside the scope of the more lightweight documentation set?

[thomasschaeferm]

I think it is still relevant, except you cancel the whole topic about "Access your Raspberry Pi over the internet".
Of course my original version was shorter. It was suggested to make a short introduction to IPv6. And then we did it.
(I do it that way with all the Raspberry PIs I have.)