The Register says: AWS claims ‘monumental step forward’ with optional IPv6-only networks
I was reading their howto yesterday and it seems they are only allocating a /64? Why?
I guess I just don't get the point of the VPC in the first place. I get the firewall aspect but it seem to be more than that.
Mike
That's a /64 *per subnet*...
But the size of a VPC's IPv6 CIDR block does seem to be fixed at /56.
Would have been nice to see /48 instead.
Regards, K.
It’s a /56 per VPC, and a /64 per subnet.
Seems reasonable to me.
https://docs.aws.amazon.com/vpc/latest/userguide/get-started-ipv6.html
Dave
Ah ok, I must have missed that.
Mike
Hi Karl,
To what purpose? You can't alter the VPC routing of any of the IP
addresses (v4 or v6) assigned to an AWS VPC. If you try, for example,
to assign a /64 to an instance you get a funky error: "Route
destination doesn't match any subnet CIDR blocks." You can only assign
the block's IP addresses to subnets or not and then assign addresses
from the subnet to the instances. You can't have more than 256 subnets
in a VPC so why would you need more than a /56 of IPv6 addresses?
Regards,
Bill Herrin
I was reading their howto yesterday and it seems they are only
allocating a /64? Why?That’s a /64 per subnet…
But the size of a VPC’s IPv6 CIDR block does seem to be fixed at /56.
Would have been nice to see /48 instead.Hi Karl,
To what purpose? You can’t alter the VPC routing of any of the IP
addresses (v4 or v6) assigned to an AWS VPC. If you try, for example,
to assign a /64 to an instance you get a funky error: “Route
destination doesn’t match any subnet CIDR blocks.” You can only assign
the block’s IP addresses to subnets or not and then assign addresses
from the subnet to the instances. You can’t have more than 256 subnets
in a VPC so why would you need more than a /56 of IPv6 addresses?
Agreed, those limits align and are reasonable. If you BYO, then you can bring up to 5 /48’s per account, but only use one per region. The limit of a /56 per VPC remains, but you can create multiple VPCs per region and most companies use multiple accounts. There are some other limitations but some of these may change over time:
-
The most specific IPv6 address range that you can bring is /48 for CIDRs that are publicly advertised, and /56 for CIDRs that are not publicly advertised.
-
You can bring each address range to one Region at a time.
-
You can bring a total of five IPv4 and IPv6 address ranges per Region to your AWS account.
-
You cannot share your IP address range with other accounts using AWS Resource Access Manager (AWS RAM).
Which is, fundamentally, half the problem with IPv6 in AWS. I'd have much
preferred that they'd added the ability to do actually-useful IPv6 routing
rather than IPv6-only subnets, which strikes me as more of a toy than
something *actually* useful.
- Matt
Maybe they're future proofing themselves until they can figure out how to put a meter on it for more $$$?
Mike
Yeah, they don't even have a practical way to implement a firewall
instance for IPv6. Unless you want to mirror 1:many NAT for IPv6 like
you do IPv4. You just can't route an IPv6 block to an instance. And
with 1:many NAT you wouldn't want public IP addresses inside but AWS
doesn't let you assign ULA addresses inside the subnet, only global
addresses.
Regards,
Bill Herrin
I stand corrected on this.
This technique does in fact work for IPv6, allowing you to insert a
firewall at the edge. Interestingly though, it won't receive IPv6
packets for an address that isn't attached to a running instance in
the interior subnet.
Regards,
Bill Herrin
That sounds remarkably sensible given that the AWS customer base will be
dipping their toes into the world of IPv6 very cautiously.
(No good for a honeypot, but we have many other means for that.)