Post #2741365

@arichtman@eigenmagic.net For IPv6 site-to-site VPNs, I assign a different /48 ULA to each site; it gives me plenty of scope to subnet each site and have all subnets participate in the VPN. We have 6 sites so "sequential" isn't really a factor. A bit naughty but I hand-crafted the bottom 16 bits of the ULA prefix to correspond to the site's postcode, so they're easy to recognize in logs. We use policy-based site-to-site VPNs rather than routed virtual-interface VPNs, so there isn't a specific subnet for them. We have dial-in (road warrior) IPv4 VPNs too but those just get a /24 I picked at random from the entire site's /16 and I hand-edited the routing tables because there aren't enough to bother automating. @hugo@social.treehouse.systems