ocserv + ipv6

[David Woodhouse]

On Thu, 2015-05-07 at 15:09 +0200, Nikos Mavrogiannopoulos wrote:
> Hello,
>  With this mail I bring up a discussion made on the irc channel here.
> As it is now ocserv, for IPv6 provides an IP address from the
> configured pool using a dummy prefix length, the same way as we do for
> IPv4. However, since in IPv6 the number of addresses are pretty much
> unlimited it makes sense to provide a real subnet to the client. That
> will not have much impact on the clients which handle the provided
> address as a point-to-point one, but will allow future clients to use
> multiple addresses from the VPN. Do you see any issues with that
> approach, or have an idea to improve it?

No recollection of this. Did I respond? I'm trawling my list archive
because I *know* someone sent me a patch to fix the Juniper multiple
DNS search domain issue.

I'd take a look at IPv6 Prefix Delegation as handled in PPP and DHCPv6.
It hands out subnets to the client and the client can then run RA on
its *other* interfaces (and hand them out further, perhaps).

I think it's normally done as a *separate* configuration item to the
main IPv6 address. Yes, there are plenty but there's no reason to be
entirely profligate with them. You can have a /127 for the point-to
-point link, and multiple /64s for the subnets you want to route to.

-- 
dwmw2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5691 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20150806/38767080/attachment.bin>