IPv6 network for WireGuard VPN
May 31
I am currently migrating a company-internal VPN from OpenVPN to WireGuard. While at it, I want to migrate it from IPv4 to IPv6. The infrastructure currently consists of one server and ~1200 clients behind DSL connections of several ISPs (customer-dependent). The amount is expected to grow and the network will be clustered at some point. I have read about ULAs and SLAAC, but I am not sure how to pick an IPv6 network that is unlikely to collide with existing IPv6 networks of the respective ISPs or with the networks of our customers. What is the recommended way to select an IPv6 network for such a VPN scenario?
1 answer
Accepted answer · original discussion
Jun 1
Get an IPv6 allocation from your ISP or RIR.
Define an address plan to cover the number of /64s you need, as far forward as you can project. The smallest you should ask for is a /48, a typical size given to one "site". Plan out all your needs, external services, VPNs, LAN, and test networks, across multiple sites if you plan to grow.
Your prefix is to with as you wish, as your ISP routes it to you. If you want to use a few /64s for VPNs, route those to the VPN server.
Unique local address is not for internet access. While ULA can be useful for LAN only resources and labs, you really want a globally routable prefix.
Generate a ULA /48 with "fd" plus 40 random bits. This is extremely likely to be unique with any other networks you may encounter. One easy way: install subnetcalc (it has a Debian package) and
subnetcalc fd00:: 48 -uniquelocal
1 question comment
Use comments to ask for clarification. Post a solution as an answer.
May 31