search

ovh / infrastructure-roadmap

37 stars 1 forks source link

[IPv6] [VPS] Assign a /64 per machine #120

Open apio-sys opened 1 year ago

apio-sys commented 1 year ago

(this is not a duplicate of #117 ).

Currently a VPS get's a (ridiculous) /128 assigned. Hence they are sitting in the same network (/64) as surrounding customers. So if you have a neighbour spamming using it's IPv6 he can get the whole /64 block blacklisted (which is normal practice, blacklisting should not occur below the /64 level) and you are taken down with him...

A VPS should get a /64 assignment and nothing lower.

As suggested in #117 , assigning a /56 or even /48 per NIC-handle would be great but will probably take a long time to implement. The real urgent problem here is not assigning /128 to any VPS anymore but only /64's. Address space is not an issue, there's more than enough of that (OVH having at least a /32 and a /31) and the service would already be a lot better.

Remaining at your disposal to discuss.

LuckyWraptor commented 1 year ago

Agreed, this should be implemented ASAP.

I'm not aware of how prefixes are delegated internally at OVH, and maybe this could require an entire infrastructural redesign. But the fact is that however this is implemented, is just unacceptable, especially considering the fact that there is no firewall capabilities for IPv6 at all I don't see why they even thought this was a decent idea.

apio-sys commented 1 year ago

I'm glad to see this issue is getting some attention. Open to help or discuss further if needed but I reckon the scope is "easy". Hope this gets priority over #117 since will be much easier to implement IMHO and will not "waste" address space.

eponier commented 11 months ago

I'm interested in this too. As discussed in the first comment, IPv6 is not usable for the moment since there is necessarily a spammer in the same /64 as me.

LuckyWraptor commented 11 months ago

After nearly a full year, I got the issue resolved.

I switched provider

apio-sys commented 11 months ago

@thieummm @jslocinski is there any ETA for this ?

apio-sys commented 11 months ago

After nearly a full year, I got the issue resolved.

I switched provider

That was probably the fastest solution indeed. A pity this isn't picked up more rapidly/seriuously. It has been much more than a year that this is an issue. @OVH Get your act together!

jslocinski commented 11 months ago

Renaming this to VPS only topic as baremetal servers are available with IPv6 /64 block by default. We're working on more general, thus flexible solution (https://github.com/ovh/infrastructure-roadmap/issues/117), where /56 block will be available to our customers without permanent attachment to a particular infrastructure.

apio-sys commented 11 months ago

I thought it was already clear from the title and the contents that it was talking about VPS only (inside the Bare Metal menu from the admin perspective). I have noticed and previously referenced #117 and it would be great to implement that. But I can imagine that will not be very fast... Hence my intermediate solution to treat VPS as dedicated servers and just assign a /64 and the problem would already be solved in a much faster manner. We can't continue to work with a /128 per VPS. OVH has at least one /32 allocation which allows to distribute 4 billion /64 networks... The important question for me here is, what is the ETA to solve this on the VPS level ? #117 would be nice to have but is not mission critical. The issue at hand is.

apio-sys commented 7 months ago

@jslocinski the more flexible solution you mentioned above seems thus to be implemented using vRack hence not compatible with bare metal VPS's. This ticket has been acknowledged, so how do you plan to solve it? Can't you just assign a /64 and this will be "solved". This has been dragging on for years now...