Post #2741363
2026-03-15 02:19 UTC
Replies (2)
-
@futzle@old.mermaid.town 2026-03-15 02:40
@arichtman@eigenmagic.net For IPv6 site-to-site VPNs, I assign a different /48 ULA to each site; it gives me plenty of scope to subnet each site and have all subnets participate in the VPN. We have 6 sites so "sequential" isn't really a factor. A bit naughty but I hand-crafted the bottom 16 bits of the ULA prefix to correspond to the site's postcode, so they're easy to recognize in logs. We use policy-based site-to-site VPNs rather than routed virtual-interface VPNs, so there isn't a specific subnet for them. We have dial-in (road warrior) IPv4 VPNs too but those just get a /24 I picked at random from the entire site's /16 and I hand-edited the routing tables because there aren't enough to bother automating. @hugo@social.treehouse.systems
-
@hugo@social.treehouse.systems 2026-03-15 02:40
@arichtman@eigenmagic.net ULA: I'd pick a discrete /48 ULA per site. Numbers are cheap; don't try to ration them. For v4: I use a supernet 10.128/16 and then slice blocks per site. I haven't extended that to multiple sites, but the intention is to keep consistency within the blocks for subnets relative to the site base. The reason for 10.128/16 is to get out of the noise of 192.168/16, but also avoid the lower parts of 10/8 that might be more common in corp networks so I don't have overlaps on eg split tunnel routes for client VPN.