Post #2741360
2026-03-15 02:43 UTC
@arichtman@eigenmagic.net I'd argue against using global IPv6 addresses in your VPN at all, if they're not stable. Use ULA addresses everywhere, including DNS for your well-known services, and the risk of you connecting over the public Internet from Global IPv6 at Site1 to Global IPv6 at Site2 is almost nil.
If your ISP is already at risk of changing your global IPv6 prefix then you must already have a scripted way to update public DNS when one of your servers changes its prefix? Piggyback on that.
Replies (1)
-
@arichtman@eigenmagic.net 2026-03-15 02:47
@futzle@old.mermaid.town Yea OPNsense has a DDNS feature that keeps the public address up-to-date. I'm not using GUAs at all in the VPN config but I wanted to split tunnel my v6 delegated prefix over the LAN so I don't have to open the firewall. I'll see if AllowedIPs supports DNS addresses but I'm not optimistic