undefined | Better HN

0 pointsOJFord5y ago0 comments

The 'historical quirk' per my understanding is pretty much IPv4 NAT.

At least, I couldn't figure out how to do it with IPv6 (no (need for) NAT) - I ended up dropping them if not destined for my desired DNS instead.

(NAT lets you Translate Addresses, usually to save IPv4 space, but here to redirect to a different DNS. IPv6 fixes the address space problem with more addresses, so the hack is done away with, and everything on the network can 'route itself' to everything else without any translation, as pre-NAT and as always intended.)

0 comments

toast05y ago

Transparent proxying works for IPv6 as well as IPv4. It's a little challenging to do transparent proxying on a box that's not the firewall. If the firewall and the proxy are on the same ethernet broadcast domain, you can forward the packets (i think for Linux you'd need to do policy routing on the port?, for ipfw there's a forward action, i think pf would be route-to); and if they're not, you'd need to tunnel the packets to the proxy.

NAT doesn't really have much to do with it, other than you with NAT, you certainly have a device on your network that's capable of being a transparent proxy, whereas without NAT, you could just have a unmanaged switch to share your upstream connection between multiple computers; assuming your provider is enlightened and provides ethernet or an ethernet bridge with nothing else in the way.

OJFordOP5y ago

> think for Linux you'd need to do policy routing on the port?

I think that's probably the crux of what I'm getting at - and I should say this is all from fiddling at home and not working in networking - with iptables you can `-j DNAT --destination $desired_dns_ip`, but if you don't have NAT then you're left with `-j REDIRECT --dport $portchange`, which yes, takes a destination port, not IP.

> other than you with NAT, you certainly have a device on your network that's capable of being a transparent proxy

Yes exactly, that's all I meant really. After all, the context is a home user configuring a home user's 'router' (i.e. switch, firewall, AP, ...) to send DNS requests to PiHole, right.

toast05y ago

The first part is really just a tooling issue. iptables doesn't have a -j FORWARD to pass the packet as-is to another host, but it's certainly possible to make it happen. I didn't look at nftables to see if it does either.

1 more reply

Denvercoder95y ago

Any firewall worth its salt can do this with IPv6 as well. There's nothing on a technical level preventing it.

OJFordOP5y ago

iptables?

Of course it's technically possible, it's all just packets of data that you can change, at the end of the day. I just meant that the easy way to do it (AIUI) went away with IPv6 because you were never supposed to need to do that, and with v6 you 'don't'.

It's not like the purpose of firewalls is redirection.

Reelin5y ago

I thought that iptables was the easy way to do it? (Both for IPv4 and IPv6.)

NAT66 is an experimental (10 years old IIUC!) RFC for one-to-one IPv6 mapping. While there's no RFC specifying an official method of masquerading behind a single address, AFAIK iptables "just works" (as long as you aren't running FreeBSD).

X-Istence5y ago

Create a loopback interface and assign it the IP address you want redirected, then have your DNS resolver bind to those IP's.

j / k navigate · click thread line to collapse

0 comments

toast05y ago

OJFordOP5y ago

> think for Linux you'd need to do policy routing on the port?

> other than you with NAT, you certainly have a device on your network that's capable of being a transparent proxy

Yes exactly, that's all I meant really. After all, the context is a home user configuring a home user's 'router' (i.e. switch, firewall, AP, ...) to send DNS requests to PiHole, right.

toast05y ago

1 more reply

Denvercoder95y ago

Any firewall worth its salt can do this with IPv6 as well. There's nothing on a technical level preventing it.

OJFordOP5y ago

iptables?

It's not like the purpose of firewalls is redirection.

Reelin5y ago

I thought that iptables was the easy way to do it? (Both for IPv4 and IPv6.)

X-Istence5y ago

Create a loopback interface and assign it the IP address you want redirected, then have your DNS resolver bind to those IP's.

j / k navigate · click thread line to collapse