On Sun, Feb 10, 2019 at 2:34 PM Michael Richardson <m...@sandelman.ca> wrote: > > > Dave Taht <d...@taht.net> wrote: > >> systems having DualStack with NAT44. > > > I'm under the impression various ipv6 -> ipv4 nat tools are working much > > better now. I can't bring myself to care much about ipv6 until I too can > > get a static IPv6 allocation. I'm so fed up with the deployment that > > I've been working on adding ips to ipv4.... > > Well, you can get a static IPv6 allocation for a fee, you just need an ISP > that > you can speak BGP to. That's really what your issue is more than the > allocation.
Comcast is my only choice. > >> The naming "se00" vs "ethXX" gets in the way. I have weird problems > >> where > >> machines behind the gateway can ping 8.8.8.8, but I can't ping it from > >> the > >> gateway. The details don't matter. I'm mostly writing this for future > >> people > >> googling. I spent another two hours today trying to debug (the first > >> time, I > >> had no working uplink, and I was missing tcpdump on the new unit. I > >> was > >> convinced my ISP had dropped my static routes)... > >> > >> So I will be starting again from scratch (total factory reset), get it > >> going, and then add my custom configuration. > > > I generally prototype by having a second router entirely take over the > > functions of the network. Much like you added a pure wifi router, in > > your case I'd have got another router entirely, flashed openwrt, and > > tried to get each feature you needed working that way. > > The problem with trying to make it all work in a test bench is that > it has to work with the v6 prefixes that matter, and those are in use. > So I guess I could put two routes in series and move things over VLAN by > VLAN. I have the untagged traffic out of the router go into VLAN3800 > on the switch, which I can see from my desktop. At least the replacement > router has a serial console, which I never added to the original. > > > I do wish cerowrt's stateless firewall idea had been adopted by openwrt, > > it leads to much less complicated rules to just pattern match for s+, > > g+, etc. > > Hmm. I am not sure I understand your point. > It all looks the same to me, but perhaps I'm running into this differences > under the hood which is screwing me up. From early benchmarks, doing more and more complicated firewall configurations, was far more efficient when I was using the pattern match syntax. Otherwise openwrt needs one rule per interface to launch it down the ipchains. "+" is iptables pattern match character. In cerowrt all you had to do was establish your "zones" and add a new interface to a zone, by renaming the interface appropriately. You never needed to reload the firewall rules once established. openwrt holds the concept of zone entirely seperately. I forget how many rules this saved (but it was a lot) in cerowrt's fully routed design. https://www.bufferbloat.net/projects/cerowrt/wiki/CeroWall/ has all the doc on it I ever wrote... the actual implementation worked for a lot of people. I have no idea how much more efficient nft is. > > -- > ] Never tell me the odds! | ipv6 mesh networks [ > ] Michael Richardson, Sandelman Software Works | IoT architect [ > ] m...@sandelman.ca http://www.sandelman.ca/ | ruby on rails > [ > > > > > _______________________________________________ > Cerowrt-devel mailing list > Cerowrt-devel@lists.bufferbloat.net > https://lists.bufferbloat.net/listinfo/cerowrt-devel -- Dave Täht CTO, TekLibre, LLC http://www.teklibre.com Tel: 1-831-205-9740 _______________________________________________ Cerowrt-devel mailing list Cerowrt-devel@lists.bufferbloat.net https://lists.bufferbloat.net/listinfo/cerowrt-devel
