Post #2741368
2026-03-15 03:27 UTC
Replies (3)
-
@hugo@social.treehouse.systems 2026-03-15 03:31
@arichtman@eigenmagic.net @uep@timeloop.cafe @futzle@old.mermaid.town yea, but how do you inject/update site B updated GUAs into site A's peer config for site B, and vice versa? But, wait: If you're not punching a hole in the firewall to make the service at site B accessible from the public Internet, then why DDNS the address to a public DNS or against the GUA anyway? If the service should only ever be internally accessible, just pin the DNS record to the ULA and be done with it?
-
@uep@timeloop.cafe 2026-03-15 03:35
@arichtman@eigenmagic.net @futzle@old.mermaid.town @hugo@social.treehouse.systems sure, you can add whatever addresses you like to the peer's allowed set. And you'll get static routes for them through the interface, and make them inaccessible via the public path / if the tunnel is down.
-
@futzle@old.mermaid.town 2026-03-15 04:18
@arichtman@eigenmagic.net @uep@timeloop.cafe @hugo@social.treehouse.systems > ULAs. Can I at least add them *in addition* to the machine SLAAC GUAs? Yes! That is exactly what you should do. Every device should have at least three IPv6 addresses—link-local, ULA which you control, and GUA which might be ephemeral and might have MAC address privacy to boot. I’m not able to offer specific help wrt Wireguard because I am Team IPsec, but you seem to be having great help with that already.