u/One_Ninja_8512 — reddlx

Usually, for IPv6, /64 subnets for local use are recommended. Will there be any issues if I choose a /32 or a larger subnet?

For a container orchestrator I need to make a choice on the subnet I want the containers to use. Usually I've seen /64 subnets being recommended in this sub for general local use but it seems like the Container Network Interface (CNI) supports subnets of any size. To keep IPs of the containers short I chose a /32 subnet, i.e. fe42:42::/32 for simplicity. Containers get assigned addresses like fe42:42::2/128 correctly and the whole dual-stack setup seems to work flawlessly so far. Is there anything worth knowing when choosing a larger subnet than the usual /64 besides possible collisions with other subnets if I can be sure that there won't be any other local subnets with that prefix? I use stateful DHCPv6 so SLAAC is not an issue.

reddit.com

u/One_Ninja_8512 — 12 days ago

▲ 2 r/incus

Forwarding external traffic to a subnet defined inside an incus container

I'm trying to forward incoming traffic on my host to a subnet inside an incus container. I've tried multiple iptables configurations but I just can't make it work.

The server is listening on 172.16.0.1:443 (wireguard subnet) inside the container, this ip is also listed when I execute incus list as seen below:

+------+---------+----------------------+----------------------------------------------+-----------+-----------+
| NAME |  STATE  |         IPV4         |                     IPV6                     |   TYPE    | SNAPSHOTS |
+------+---------+----------------------+----------------------------------------------+-----------+-----------+
| 1234 | RUNNING | 172.26.64.1 (nomad)  | fd42:0000:0000:00:0000:0000:fe00:0000 (eth0) | CONTAINER | 0         |
|      |         | 172.17.0.1 (docker0) |                                              |           |           |
|      |         | 172.16.0.1 (wg0)     |                                              |           |           |
|      |         | 10.0.0.2 (eth0)      |                                              |           |           |
+------+---------+----------------------+----------------------------------------------+-----------+-----------+

Inside the container, I can reach the server with no issues:

$ curl 172.16.0.1:443
&lt;html&gt;
&lt;head&gt;&lt;title&gt;400 The plain HTTP request was sent to HTTPS port&lt;/title&gt;&lt;/head&gt;
&lt;body&gt;
&lt;center&gt;&lt;h1&gt;400 Bad Request&lt;/h1&gt;&lt;/center&gt;
&lt;center&gt;The plain HTTP request was sent to HTTPS port&lt;/center&gt;
&lt;hr&gt;&lt;center&gt;nginx&lt;/center&gt;
&lt;/body&gt;
&lt;/html&gt;

Which iptables rules do I need to apply on the host and inside the container for this to work? It works if I define a proxy via incus config device add (but not in NAT mode). The issue is that external IPs that hit nginx are hidden in this case and NAT mode does not work for some reason, so I'm trying to rawdog with iptables but without success so far.

reddit.com

u/One_Ninja_8512 — 23 days ago

▲ 0 r/debian

Did Debian official repo (trixie-backports) just got compromised or my system?

While trying to install duplicity I got the following, somewhat chilling error:

> [WARNING]: Failed to update cache after 1 retries due to W:Repositories should provide a clear-signed InRelease file, but none found at mirror+file:/etc/apt/mirrors/debian.list/dists/trixie-backports/InRelease., W:OpenPGP signature verification failed: https://deb.debian.org/debian trixie-backports Release: Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Message has been manipulated Verifying signature: Message has been manipulated, E:The repository 'mirror+file:/etc/apt/mirrors/debian.list trixie-backports Release' is no longer signed., retrying [WARNING]: Failed to update cache after 2 retries due to W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:Repositories should provide a clear-signed InRelease file, but none found at mirror+file:/etc/apt/mirrors/debian.list/dists/trixie-backports/InRelease., W:OpenPGP signature verification failed: https://deb.debian.org/debian trixie-backports Release: Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Message has been manipulated Verifying signature: Message has been manipulated, E:The repository 'mirror+file:/etc/apt/mirrors/debian.list trixie-backports Release' is no longer signed., retrying

reddit.com

u/One_Ninja_8512 — 27 days ago

▲ 7 r/ipv6

Noob questions: subnet uniqueness, routing

edit: nevermind, guys. It's not my server that I'm reaching.

I have a server with a static IPv6 address. While troubleshooting some connection issues I found out that I can reach my server over the internet with just the subnet prefix followed by ::1, i.e. the server is reachable via 2001:ab1:1234:567::1. I thought that only zero blocks can be skipped like that (the full address contains no zeros). Does it mean that the subnet prefix itself is unique which makes it reachable? Can I use this abbreviated address everywhere instead of the full one, i.e. in AAAA records? Why does it work with ::1 but not other suffixes? What is special about ::1 in this case? Can I rely on the short address staying routable as long as the full one is? ip addr on the server shows the full address only on the interface.

reddit.com

u/One_Ninja_8512 — 3 months ago