netdev - Re: IP-Aliasing for IPv6?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 May 2019 21:15:12 +0200
From:   Heiner Kallweit <hkallweit1@...il.com>
To:     "M. Buecher" <maddes+kernel@...des.net>, netdev@...r.kernel.org
Subject: Re: IP-Aliasing for IPv6?

On 14.05.2019 20:49, M. Buecher wrote:
> Preamble: I'm just a network hobbyist at home, so please bear with me if something in this mail is "stupid" from an expert's point of view.
> 
> According to the documentation [1] "IP-Aliasing" is an obsolete way to manage multiple IP[v4]-addresses/masks on an interface.
> For having multiple IP[v4]-addresses on an interface this is absolutely true.
> 
> For me "IP-Aliasing" is still a valid, good and easy way to "group" ip addresses to run multiple instances of the same service with different IPs via virtual interfaces on a single physical NIC.
> 
This sounds like you don't necessarily need additional virtual interfaces
but simply additional IP addresses at the primary interface -> ip address help

> Short story:
> I recently added IPv6 to my LAN setup and recognized that IP-Aliasing is not support by the kernel.
> Could IP-Aliasing support for IPv6 be added to the kernel?
> 
> Long story:
> I tried to find out how to do virtual network interfaces "The Right Way (tm)" nowadays.
> So I came across MACVLAN, IPVLAN and alike on the internet, mostly in conjunction with containers or VMs.
> But MACVLAN/IPVLAN do not provide the same usability as "IP-Aliasing", e.g. user needs to learn a lot about network infrastructre, sysctl settings, forwarding, etc.
> They also do not provide the same functionality, e.g. the virtual interfaces cannot reach their parent interface.
> 
> In my tests with MACVLAN (bridge)/IPVLAN (L2) pinging between parent and virtual devices with `ping -I <device> <target ip>` failed for IPv4 and IPV6.
> Pinging from outside MACVLAN worked fine for IPv4 but not IPv6, while IPVLAN failed also for pinging with IPv4 to the virtual interfaces. Pinging to outside only worked from the parent device.
> Unfortunately I could not find any source on the internet that describes how to setup MACVLAN/IPVLAN and their surroundings correctly for a single machine. It seems they are just used for containers and VMs.
> 
> If it is possible to setup MACVLAN/IPVLAN that they can reach and also can be reached from their parent device, other virtual devices and from outside, then please guide me to the right direction or provide links. Would be much appreciated.
> Otherwise I would like to see IP-Aliasing for IPv6.
> 
> Hope to stimulate further thoughts and thanks for reading
> Matthias "Maddes" Bücher
> 
> [1] https://www.kernel.org/doc/html/latest/networking/alias.html
> 
>