On: IPv6 Is Hard

[ninkendo]

I mean it’s not a great answer, but you could always set up a ULA for your guest network and use NAT. :-P

But I’m with you on prefix delegation sucking. Prefixes change, and that makes all your devices’ addresses change. ULA’s solve this. But then you start asking hard questions like “if I’m going to use a ULA anyway, why even use the GUA addresses?” And the answer is shrug.

I mean, it’s great that you can give real addresses to your devices when you want to host a service on them, but you can always just NAT your ISP-provided prefix to them anyway. You’ll probably want better addresses for them anyway, as those randomly generated host addresses aren’t easy to remember (may as well just start your public addresses at ::1 and increment from there, routing each one to the underlying ULA.)

[ndriscoll → ninkendo]

Doing stateless NAT through prefix translation is still much more pleasant than stateful port mapping.

[Borealid → ninkendo]

A static NAT is all you'd need for ULA to public 1:1.

If you have a static NAT you don't need connection tracking on the router.

[ninkendo → Borealid]

You’d need more than a /64 from your ISP if you wanted to do a separate guest network with static NAT though.

OP was saying ipv6 makes it hard to do a guest network if all you get is a /64 from your ISP, but stateful NAT can fix that.