Understanding ipv4 & ipv6 advice needed

In the last few weeks my Zen fttp connection has been switching from ipv4 to ipv6, is this a problem?

My connection seams to be fine i just get google asking me if im who i say i am when logging into some sites because of the ip change.

In Zens router there is a setting i can untick which says " support for ipv6 " its currently set to on. If i was to remove the support for ipv6 would it cause problems?

I think the way my router is setup Zen can change settings without me having to login into the router.

I only know some basic settings.

Any advice id be greatful.

If you have ipV6 enabled your connection will always be both - However most browsers these days will by default prefer ipv6 where available.

The main problem I have is that if I have been using my laptop at work which dowesn't have ipv6 and don't reboot rather than hibernate then when I get home the browser refuses to accep that it has an ipv6 connection.

Ah i thought your connection could only be one or the other not used at the sametime, So my connection switching from 4 to 6 is normal then ?

Edited by gnt (Thu 01-Jun-23 13:35:23)

It is called dual stack meaning both IPv4 and v6 are supported at the same time. As per your other reply, browsers will try IPv6 first with any website advertising an IPv6 address (via DNS) and if no connection is possible it falls back to IPv4. IPv6 being the default try it first. So if a website doesn't support IPv6 the connection will just go via IPv4.

You might like to run this test to check all is working correctly https://test-ipv6.com

Because you will have essentially an unlimited number of IPv6 addresses, then for added security to prevent sites tracking you by your IPv6 address, most devices and PCs will use temporary throw away ones and change them every so often, it might be this causing websites to want to check you again as they see what looks like a brand new connection from an address they have never seen before.

In reply to a post by E300:

You might like to run this test to check all is working correctly https://test-ipv6.com

Interesting... I checked and as well as my fixed Zen IPv4 address it seems I have an IPv6 address. Which I did not know. Is my IPv6 address fixed as well?

What use is any of this to wo/man or beast in 2023?

If you use Chrome browser, the plugin "IPvFoo" will show you whether v4 or v6 is being used both for the main HTML page and for all of the assets fetched within the page (images, stylesheets, javascript etc)

If you have a v4/v6 capable connection then often you will see a mixture being used. Some sites like Gmail/Youtube can be fetched entirely over v6.

I have dual stack on Cerberus and I don't see the issue you're describing, but maybe it's something with a particular site you're accessing?

Or maybe your client device is intermittently losing its IPv6 address for some reason (you can check it periodically with "ipconfig /all" or equivalent)

In reply to a post by Woolwich:

Interesting... I checked and as well as my fixed Zen IPv4 address it seems I have an IPv6 address. Which I did not know. Is my IPv6 address fixed as well?

What use is any of this to wo/man or beast in 2023?

IPv6 addresses are generally not fixed as devices usually keep changing them at random for security reasons. You can fix them of course for things like web servers, but generally they keep changing.

There are two parts to an IPv6 address, the prefix and the device address. You will very likely have a static or fairly static prefix, I'm not sure what Zen do in terms of fixing that prefix to you as static or if it could change. Anything on the internet that starts with your prefix will be sent to your router, your router will then see if the device address is known to it by looking at the rest of the IPv6 address, if it is known it will forward the data on, and if not just drop the packets.

An IPv6 address is 128 bits, the first 64 bits is the prefix, the remaining 64 bits is a device address. 64 bits is a very very large number (18,446,744,073,709,551,615), so your devices usually just create temporary device addresses using random numbers, with it being very unlikely by chance it could pick something in use by another device.

IPv6 is useful as it does away with NAT, this is helpful on mobile networks and some altnets that will otherwise on IPv4 need to use CGNAT to share the limited number of IPv4 addresses left, which can cause various issues.

Edited by E300 (Thu 01-Jun-23 14:34:45)

Yes fairly normal.if ipv6 works it will tend to be used in preference, but if when the browser checks for ipv6 connectivity it will fallback to ipv4 and stick with it usually until a reboot.

I quite like the fact that when my browser decides to use ipv6 the randomized addresses in my block confuse google so they don't know where I am -it's only a minor inconvebience in googlemaps to find where tyou really are rather than the random loaction it centers on where they think you are.

In reply to a post by E300:

You will very likely have a static or fairly static prefix, I'm not sure what Zen do in terms of fixing that prefix to you as static or if it could change.

Zen assign you static addresses for both what they term a /64 ND and a /48 PD prefix (so you can have upto 65536 LANs with the usual /64 required for SLAAC). From the information they provide:

The two prefixes are described below, along with some further information on the Zen IPv6 service:

/64 Neighbour Discovery (ND) Prefix. This is used to automatically address the WAN interface of your Router, or if you are directly connected without a router, the WAN interface of that device. This can be configured using SLAAC.

/48 Delegation Prefix. This is usually provided over DHCPv6, and requires that your router acts as a requesting router for the purpose of IPv6 delegation RFC3633 - (https://tools.ietf.org/html/rfc3633). Subnets of this prefix are used by the CPE to address devices on the LAN.

We also have an IPv6 enabled DNS Resolver (2a02:8010:1::212:23:3:100), the IPv6 Address of this will be automatically advertised to routers supporting RFC3646 (https://tools.ietf.org/html/rfc3646). It can also be configured manually if required.

Routers supporting RFC7084 (https://tools.ietf.org/html/rfc7084) are expected to work without issue. Older routers, or ones that do not fully implement RFC7084 may experience issues.

Some trivial some more involved:

* Your router won't have to work quite as hard with just routing the IPv6 connections compared with routing IPv4 and NATing them. i.e. performance per watt.

* Things like VoIP and some online games may be able to work a little more reliably when the source address and ports haven't been mangled on the way out.
This would really have helped older games where you can choose to host the multiplayer session and the lobby is on your device, more than the ones with a launcher and dependent on the vendor's own servers.

* If you are accessing a NAS remotely - hopefully by VPN though - you can specify that device to be reachable by selected parties without having to have them connect to the router, and without having to mess with the port numbers if you have more than one of a type of device
So say your had any number of web servers they could all be using port 443 for example and it won't try to load your router's web interface from the outside, all your phones can use port 5060 and so on.

* It becomes more practical to run a DMZ network because you can create additional subnets using addresses assigned to you (about 250 subnets on /56 or many more on a /48)
Or if you have reason to have another router layered inside your network it can request and automatically receive a pool of addresses to create one or more inner LAN subnets.

* Routers can actually handle more ongoing connections because it won't run out of source ports in the way it could with NAT.
This last one is less important unless you have > 1000 devices because that's a rule of thumb for how many you should place behind one public IP !

In reply to a post by tdw42:

From the information they provide:

Where did you find that info? Or are you extrapolating from the addresses?

I can only find 'consumer' info on the Zen help pages, nothing about IPv6. I do now know my IPv6 address, its in the account section. And I've discovered my Mac is using IPv6 on the LAN!

So what address do you need to find my router? Is it the PD part? Can I use that as I do my IPv4 address? Is that what I'd add to my domain's public DNS entry for example?

No that's wrong isn't it. Zen describe the PD as LAN and ND as WAN. So I need to add the longer ND /64 address to my DNS?

In reply to a post by Woolwich:

In reply to a post by tdw42:

From the information they provide:

Where did you find that info? Or are you extrapolating from the addresses?

When I migrated to Zen last year they were still not enabling IPv6 by default, that info was in the reply to me requesting it to be enabled.

Zen describe the PD as LAN and ND as WAN. So I need to add the longer ND /64 address to my DNS?

The /48 PD is simply a routed block of addresses which can be obtained by the router with DHCPv6-PD.
The /64 ND is used to construct the globally unique WAN address. The underlying mechanisms for IPv6 addressing are different to IPv4, there is no ARP or DHCP-provided gateway - instead there is Neighbour Discovery (ND) which comprises a number of ICMPv6 message types, the important ones in this case are Router Solicitation (RS) and Router Advertisment (RA).

The RA message from the ISP provides the /64 network (as shown in the email or control panel), this is combined with a subnet address from the router to generate the 128-bit address. There are plenty of articles on SLAAC and converting EUI-48 MAC addresses to EUI-64 to form the subnet part of the address.

For example, with a PD of 2001:DB8:A1B2:C3D4::/64 and a WAN port MAC address of 00:11:22:33:44:55 the IPv6 address would be 2001:DB8:A1B2:C3D4:211:22FF:FE33:4455 - this would be what you add to DNS as an AAAA record for the router itself.

Depends what you want to use the public DNS entry for
is it for when remotely connecting to a service running on the router itself or remotely connecting to the Mac on the LAN?

For connections from inside the LAN Your Mac will already have a private DNS entry on the Fritzbox! e.g.
hostname.fritz.box

and be discoverable by mDNS at
hostname.local

Edited by prlzx (Fri 02-Jun-23 14:23:04)

Operating system prefix routing prefers IPv6, so most software will try IPv6 first and fallback to IPv4. This is configurable.

However Chrome (and anything based on Chrome) behaves differently, they implemented happy eyeballs RFC, they will try both stacks at once, and use the one that responds first, this can give the impression of randomness or constant switching between the two stack's.

Chrome at this time has no way to control this behaviour. Firefox does honour the OS prefix table though.

Edited by Chrysalis (Fri 02-Jun-23 15:28:16)

In reply to a post by prlzx:

Depends what you want to use the public DNS entry for

Connecting to server running on the LAN from the WAN. Which I do now using IPv4 address and port forwarding on the FritzBox.

But also, now you mention it. I also access the Server from my Mac on the LAN using the server's LAN address - 192.168.178.123. Easy to remember. How would I do that with IPv6 on the LAN? Not that I think its needed, IPv4 ain't dead yet and certainly not on private LANs.

In reply to a post by Woolwich:

In reply to a post by prlzx:

Depends what you want to use the public DNS entry for

Connecting to server running on the LAN from the WAN. Which I do now using IPv4 address and port forwarding on the FritzBox.

But also, now you mention it. I also access the Server from my Mac on the LAN using the server's LAN address - 192.168.178.123. Easy to remember. How would I do that with IPv6 on the LAN? Not that I think its needed, IPv4 ain't dead yet and certainly not on private LANs.

On the LAN as per previous post you access it by name and DNS takes care of finding the IP - you don't need to memorise the addresses.
I'm a big fan of properly populated DNS and conversely, misconfigured DNS makes a bunch of things that should just work look broken.

If you are using the Zen-supplied Fritz!box and you want to allow something to reach the Mac from the outside you just allow that in the Permit Access section. The IPv6 and IPv4 addresses will be listed alongside the hostname and MAC address of the server.

Edited by prlzx (Fri 02-Jun-23 20:09:49)

In reply to a post by candlerb:

the plugin "IPvFoo"

Thanks for mentioning that- I've long wanted something that would tell me whether I'm connecting to a site over IPv4 or v6, if only out of curiosity!

It does the job beautifully