Improve IPv6 assignment to VMs

Open
#2,006 5 comments 0 reactions 1 assignee View on GitHub

Nobody has claimed this yet.

Assessment

This issue has not been assessed yet.

Description

type_feature

As it stands, nodes connected to IPv6 enabled routers are generally able to assign "public" IPv6 addresses to VMs that they host. This is a great feature for nodes that are reachable from the public internet and for VM users who want a free publicly reachable address, requiring no configuration from farmers beyond their network setup.

For nodes that are behind a firewall (hidden), IPv6 assignments carry the following caveats:

  • The addresses can't fulfill their primary purpose of providing a public entry point to the VM. Additionally, it is not possible to know with certainty before creating the VM if a node can provide publicly reachable IPv6 addresses
  • Assuming the farmer has not subnetted and appropriately firewalled their farm (most farmers can't or won't do this), the virtual interface created for the assigned IPv6 address provides a route into the farmer's LAN. While this can be a benefit for some farmers who run workloads on their own nodes, it is generally undesirable

To improve this situation, I propose limiting the ability for nodes to assign IPv6 addresses to VMs in some combination in the following ways:

  • Nodes with a public config can issue public IPV6s
  • Nodes with working dual NICs can issue public IPV6s
  • To cover the case of single interface nodes without public config that still have publicly reachable IPv6, allow farmers to optionally enable this for their nodes through some mechanism. While it could be through IPv6 only public configs (not sure if this is already supported), I think a simpler way such as a per farm flag on TF Chain is worth considering

Such a change can improve the odds that the IPv6 addresses that nodes hand out are actually publicly reachable and also improve security for farmers who don't actually want to be distributing addresses from their LAN.

Dominant language
Go
Stars
95
Forks
22
Avg merge
2m
Merged PRs (30d)
4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from threefoldtech/zos

All issues in threefoldtech/zos

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.