Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #166722 > unrolled thread

VPN over IPv6

Back to article view | Back to linux.debian.user

Contents

  VPN over IPv6 Philippe Clérié <philippe@gcal.net> - 2016-04-15 03:00 +0200
    Re: VPN over IPv6 John Hasler <jhasler@newsguy.com> - 2016-04-15 03:40 +0200
      Re: VPN over IPv6 Philippe Clérié <philippe@gcal.net> - 2016-04-15 05:20 +0200
        Re: VPN over IPv6 Nemeth Gyorgy <friczy@freemail.hu> - 2016-04-15 08:40 +0200
        Re: VPN over IPv6 Darac Marjal <mailinglist@darac.org.uk> - 2016-04-15 13:10 +0200
    Re: VPN over IPv6 Andy Smith <andy@strugglers.net> - 2016-04-15 03:40 +0200

#166722 — VPN over IPv6

This morning, on my Planet Debian feed, I saw a post from someone using 
OpenVPN on IPv6. I thought it somewhat strange since I believe IPv6 
essentially removes the need for VPN. So what might be a use case for 
VPN over IPv6?


-- 
Philippe

------
The trouble with common sense it that it is so uncommon.
<Anonymous>

[toc] | [next] | [standalone]

#166723

Philippe Clérié wrtes:
> I thought it somewhat strange since I believe IPv6 essentially removes
> the need for VPN.

How?

> So what might be a use case for VPN over IPv6?

The need for a Virtual Private Network.  For example I might have cash
registers in multiple stores and want them all to connect to a single
server or have employees working from home with sensitive data.
-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#166725

On 04/14/2016 08:38 PM, John Hasler wrote:
> Philippe Clérié wrtes:
>> I thought it somewhat strange since I believe IPv6 essentially removes
>> the need for VPN.
>
> How?

Well, it's just the way IPv6 works.

By now, I suspect most IPv4 networks use private addresses, i.e. 
10.0.0.0/8, 172.16.0.0/16, 192.168.0.0/24. So, it makes sense to have a 
VPN between two different networks with such addresses so that they can 
communicate.

With IPv6, every* address is routable over the internet, and there is
no equivalent set of private addresses like the above. Therefore any two 
IPv6 networks should be directly accessible to each other, obviating the 
need for VPN or NAT for that matter.

Plus IPv6 is already encrypted.

[*] There are reserved address blocks but not for private addressing.

>
>> So what might be a use case for VPN over IPv6?
>
> The need for a Virtual Private Network.  For example I might have cash
> registers in multiple stores and want them all to connect to a single
> server or have employees working from home with sensitive data.
>

It is possible to have a single block of IPv6 addresses that covers that 
example.

Say you have 10 locations, so you need 10 local networks. So you get 
something like a /60 IPv6 block that gives you 16 networks of 64 bits 
addresses. That should cover it nicely.

No need for a VPN here.

-- 
Philippe

------
The trouble with common sense it that it is so uncommon.
<Anonymous>

[toc] | [prev] | [next] | [standalone]

#166728

2016-04-15 05:09 keltezéssel, Philippe Clérié írta:
> By now, I suspect most IPv4 networks use private addresses, i.e.
> 10.0.0.0/8, 172.16.0.0/16, 192.168.0.0/24. So, it makes sense to have a
> VPN between two different networks with such addresses so that they can
> communicate.
> 
> With IPv6, every* address is routable over the internet, and there is
> no equivalent set of private addresses like the above. Therefore any two
> IPv6 networks should be directly accessible to each other, obviating the
> need for VPN or NAT for that matter.

VPN is not about private ranges.
> 
> Plus IPv6 is already encrypted.

IPv6 has encryption capabilities but not mandatory.


-- 
--- Friczy ---
'Death is not a bug, it's a feature'

[toc] | [prev] | [next] | [standalone]

#166734

[Multipart message — attachments visible in raw view] — view raw

On Thu, Apr 14, 2016 at 10:09:58PM -0500, Philippe Clérié wrote:
>On 04/14/2016 08:38 PM, John Hasler wrote:
>>Philippe Clérié wrtes:
>>>I thought it somewhat strange since I believe IPv6 essentially removes
>>>the need for VPN.
>>
>>How?
>
>Well, it's just the way IPv6 works.
>
>By now, I suspect most IPv4 networks use private addresses, i.e. 
>10.0.0.0/8, 172.16.0.0/16, 192.168.0.0/24. So, it makes sense to have 
>a VPN between two different networks with such addresses so that they 
>can communicate.
>
>With IPv6, every* address is routable over the internet, and there is
>no equivalent set of private addresses like the above. Therefore any 
>two IPv6 networks should be directly accessible to each other, 
>obviating the need for VPN or NAT for that matter.
>
>Plus IPv6 is already encrypted.

I suspect you're thinking of this 
(https://en.wikipedia.org/wiki/IPv6#Network-layer_security)
 "Internet Protocol Security (IPsec) was originally developed for IPv6, 
 but found widespread deployment first in IPv4, for which it was 
 re-engineered. IPsec was a mandatory specification of the base IPv6 
 protocol suite, but has since been made optional."

>

-- 
For more information, please reread.

[toc] | [prev] | [next] | [standalone]

#166724

Hi Philippe,

On Thu, Apr 14, 2016 at 07:42:06PM -0500, Philippe Clérié wrote:
> This morning, on my Planet Debian feed, I saw a post from someone
> using OpenVPN on IPv6. I thought it somewhat strange since I believe
> IPv6 essentially removes the need for VPN. So what might be a use
> case for VPN over IPv6?

I can't comment on the blog author's motivations as I haven't seen
the article you mention, but a VPN is useful any time you need to
join your network to another network in a secure and authenticated
manner. It doesn't really matter what protocols are in use on either
side—could even be something exotic and non-IP that you end up
running over the link.

Cheers,
Andy

-- 
http://bitfolk.com/ -- No-nonsense VPS hosting

> I'd be interested to hear any (even two word) reviews of their sofas…
Provides seating.        — Andy Davidson

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web