Articles
Navigation
User login
Elsewhere
IPv6 Source Address Selection on Linux
May 11, 2009 by davidc
Sometimes it is desirable to have the outgoing IPv6 address on an interface selected deterministically. All else being equal, Linux will default to using the latest address added to the interface as the source address. This is generally not what you would expect or want. This article describes how to influence the source address selection under Linux.
Selection algorithm
Linux implements RFC 3484, "Default Address Selection for Internet Protocol version 6 (IPv6). Briefly, the algorithm involves building a candidate list of potential source addresses, then following these rules in order:
- Prefer same address. (i.e. destination is local machine)
- Prefer appropriate scope. (i.e. smallest scope shared with the destination)
- Avoid deprecated addresses.
- Prefer home addresses.
- Prefer outgoing interface. (i.e. prefer an address on the interface we're sending out of)
- Prefer matching label.
- Prefer public addresses.
- Use longest matching prefix.
"If the eight rules fail to choose a single address, some unspecified tie-breaker should be used." Linux chooses to use the latest address added.
Influencing the algorithm
It is necessary therefore to break any tie by influencing one of these rules. The solution is to mark unwanted source addresses as "deprecated", causing them to fail rule 3.
The method to implement this under Linux is to set preferred_lft to 0, thus causing the address to be marked as deprecated. Note that deprecation doesn't make the address invalid, so you can still receive packets destined for that address, but it just won't be used as source adddres.
Changing an existing address
For an address already added to the interface, use ip addr change. See the example below.
root@netman1:~# ip -6 addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
inet6 2a01:550:8000::11/128 scope global
valid_lft forever preferred_lft forever
inet6 2a01:550:8000:10a::1/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::221:5aff:fe45:9956/64 scope link
valid_lft forever preferred_lft forever
root@netman1:~# lynx -dump 'http://www.ipv6.org/' | grep "You are using"
You are using IPv6 from 2a01:550:8000::11
root@netman1:~# ip -6 addr change 2a01:550:8000::11/128 dev eth0 preferred_lft 0
root@netman1:~# ip -6 addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
inet6 2a01:550:8000::11/128 scope global deprecated
valid_lft forever preferred_lft forever
inet6 2a01:550:8000:10a::1/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::221:5aff:fe45:9956/64 scope link
valid_lft forever preferred_lft forever
root@netman1:~# lynx -dump 'http://www.ipv6.org/' | grep "You are using"
You are using IPv6 from 2a01:550:8000:10a::1
root@netman1:~#Adding a new address
Simply set preferred_lft when adding your address, e.g.:
ip addr add 2a01:550:8000::11 dev eth0 preferred_lft 0
Example use in Debian interfaces file:
iface eth0 inet6 static
address 2a01:550:8000:10a::1
netmask 64
gateway 2a01:550:8000:10a::ff
up ip addr add 2a01:550:8000::11 dev eth0 preferred_lft 0Example in Gentoo configuration file:
config_eth0=(
"10.1.1.1/24" "2001:0db8::1/64"
"10.1.1.2/24" "2001:0db8::2/64 preferred 0"
)Credit
This page is based on a mailing list post by Chris Caputo to ipv6-ops:
from: Chris Caputo
to: ipv6-ops
date: 29 April 2009 05:08
subject: linux source address selection solution
Here's a little linux tip. Hopefully it is of use to others. Apologies
if obvious.
Recent linux kernels follow RFC 3484 "Default Address Selection for
Internet Protocol version 6 (IPv6)".
In the case of a tie (ie., source address not decided by destination
subnet or other mechanisms), if you have multiple IPv6 addresses on an
interface, linux tends to use the last address added.
I prefer to have my source v6 address not be dependent on addition order,
but rather be more deterministic.
A way to do so is to set "preferred_lft" to zero, while "valid_lft" is
non-zero or "forever". Doing so results in the source address being
marked as deprecated, which means it won't be used if there are
alternatives on the interface, or a loopback address if not.
Loopback address is great for routers connected to exchange points because
it means you can deprecate your v6 exchange point address on the physical
interface and use a loopback as the source for any v6 connections. (no
more broken registry queries due to unrouted exchange point address
space!)
To experiment with this try on addresses you don't want to be selected as
a source:
ip addr change <ADDR> dev <DEV> preferred_lft 0
"ip -6 addr" should now show the address as being deprecated and
non-deprecated address(es) will be favored. To revert do "preferred_lft
forever" instead.
On Gentoo I found that the network startup scripts did not like the "_lft"
in "preferred_lft". Fortunately "ip addr add" allows you to drop that and
just use "preferred 0", ala:
config_eth0=(
"10.1.1.1/24" "2001:0db8::1/64"
"10.1.1.2/24" "2001:0db8::2/64 preferred 0"
)
Cheers,
Chris
Comments
There are abundant
January 4, 2016 by scalett, 1 day 12 hours ago
Comment: 197
There are abundant http://www.jafonline.co.uk on the bazaar online every individual day. Fastest are absent added about than not and they're paying ample amounts for these acceptable aloft fakes. How do we abstain acceptable allocation of this crowd? The basal band is they may admission absolute photos not abandoned banal photos. Should you acquaintance them for added pictures accurately able to yield some attainable for you. Antecedent footfall is education! Learn the casting in and out. The blush of red wine is constant http://www.mygifthandags.com to bolt your eyes if you accent carefully. This affectionate of blush stands for adroitness and peace.
jusqu'à ip addr ajouter 2A01:
December 21, 2015 by Scalettll20, 2 weeks 1 day ago
Comment: 194
jusqu'à ip addr ajouter 2A01: 550: 8000 :: 11 dev eth0 preferred_lft 0
replique montre