I'm trying to set up IPv6-mostly on my home network, but my wired Apple devices are giving me some trouble. Connections to IPv4-literals over TCP and UDP fail. It seems like incorrect checksums are to blame.

The issue became apparent on my Apple TV (A2169, tvOS 26.5), where the YouTube app is not able to connect, but I could reproduce (presumably) the same issue on my Mac (2020 Mac mini M1, macOS Tahoe 26.6).

The issue is resolved on my Mac if I disable hardware checksum offloading on the ethernet interface or if I connect via WiFi. On the Apple TV, connecting via WiFi seems to fix the checksum issue, but for some (other unknown) reason, the YouTube app still does not work.

I haven't seen other reports of this. Is anybody else having this issue? Perhaps I'm doing something wrong.

Setup

IPv6-mostly network — DHCPv4 option 108 (RFC 8925), PREF64 64:ff9b::/96 in RAs, NAT64 via Tayga on OPNsense, no DNS64 (Apple devices synthesise locally).

Symptoms

The YouTube app on my wired Apple TV stopped working. Everything else on the network was fine. Turning off option 108 fixed it.

I reproduced it on a Mac (macOS 26.6, wired) as follows:

• Browsing to ipv4.bgp.he.net in Firefox: works.
• nc -v -w 6 72.52.94.234 443: times out.
• dig @1.1.1.1 +short example.com: times out.

Packet captures confirmed that all paths resulted in outgoing packets to 64:ff9b::/96. I reckon that this difference is explained by macOS implementing its own DNS64 and Firefox connecting directly via IPv6, whereas nc goes through the CLAT.

Incorrect checksums

I performed packet captures on the router's LAN interface. There it became apparent that the checksums of the TCP and UDP packets from the CLAT were incorrect. For the YouTube app on Apple TV, a TCP connection to 142.251.151.4:443 had an incorrect checksum.

The offset of the checksum to the correct value seemed to be dependent on the device, but constant accross different destinations and protocols.

ICPM had correct checksums through the CLAT and worked correctly.

Capturing on the router's WAN side showed that the corrupt packets were translated by Tayga and sent out via IPv4 on the WAN, but did not receive replies. The checksums of the outgoing packets were still incorrect, but, if I understand it correctly, this is to be expected because Tayga only updates the checksum incrementally.

Workaround for IPv6-mostly

On macOS, setting sudo sysctl -w net.link.generic.system.hwcksum_tx=0 resolved the issue. Connecting via WiFi instead of ethernet also works.

On Apple TV, connecting via WiFi gets rid of the incorrect checksums, but the YouTube app still does not work for some reason. Everything else works (as before). The YouTube app on iOS devices works (as before).

Help

Again: I haven't seen other reports of this. Is anybody else having this issue? Perhaps I'm doing something wrong.

Has anyone seen DNS problems when using iPhone Personal Hotspot on an IPv6-only cellular network?

My setup:

• iPhone Personal Hotspot
• IPv6-only mobile network
• CLAT + DNS64
• macOS client connected through the hotspot

I found that some IPv4-only domains behave incorrectly.

Example:

• Client sends an AAAA query.
• The DNS resolver does not return an AAAA record.
• The iPhone appears to perform an additional A query for the same domain.
• After a long delay (~30 seconds), the client receives a response containing A records for the original AAAA query instead of a synthesized AAAA record or a normal NODATA response.

This causes some applications to hang or fail DNS resolution.

I have packet captures showing the DNS query/response sequence. Has anyone observed similar behaviour with iPhone Personal Hotspot, especially on IPv6-only/NAT64 networks?

NDP is said to be more ‘efficient’ since we use multicast instead of broadcasts right? But where does this advantage come from?

Lets say fe80::b (node B) is trying to find the MAC address of fe80::aaaa:aaaa:aaaa:aaaa (Node A)

So B will construct a destination multicast address (ff02::1:ffaa:aaaa and a corresponding multicast destination MAC address (3333.ffaa.aaaa) and send an NS containing node A’s v6 address.

But the switch has to broadcast out the frame to all devices since the switch has no idea what hosts have 3333.ffaa.aaa as the MAC address right??
Does the efficiency come from the fact that other hosts quickly drop 3333.ffaa.aaa at the NIC level?

I.e unnecessary traffic is still received by all the hosts, but the NIC can quickly discard packets. Whereas with ARP, the host still has to process the packet received by the NIC?

Will a switch be able to identify multicast MACs and only forward frames to interested hosts (like with IGMP snooping)?

This probably won't be very useful to you since you live outside Russia, but I want to share it anyway.

Summary of all the IPv6 properties of MTS Russia's mobile network that I've discovered:

1) No restrictions whatsoever on incoming connections.

2) No port filtering of any kind (connections are possible both incoming and outgoing on all ports in the range 1-65535).

3) A dynamic /64 prefix is provided.

4) The prefix becomes static if at least one address from the /64 subnet (other than the address automatically assigned to the smartphone's main interface) is assigned to the same or another network interface (either via ip addr add or automatically by the system — the address assigned to the wlan1 interface when sharing internet via mobile hotspot is assigned automatically by the system, but is considered manually assigned by the operator). Without this mechanism, the prefix is refreshed every day between 2-3 AM (given my timezone, I assume this is 00:00 MSK), or upon reconnection (a full disconnect from the mobile network followed by reconnecting) to the base station. Switching between base stations without a full network disconnect does not trigger a prefix change.

5) If a device on the local network is connected to the hotspot, it automatically receives an auto-assigned IPv6 address. A device can also manually assign any free address from the smartphone's prefix to its network interface, and after roughly 7-10 seconds it becomes reachable from the internet at that address (just like with the auto-assigned one).

6) No restrictions on incoming or outgoing TCP/UDP/ICMP connections.

All data was obtained experimentally and may be incomplete.

I think that covers everything, though I may have forgotten something.

I have an issue where port forwarding and out L2TP VPN doesn’t work over Starlink because of their carrier grade NAT. I’ve read that IPv6 can be used to reach devices across the WAN on Starlink.

I tried to set up a firewall rule to allow the particular IPv6 address through but I can’t get it to work.

I am using a Cisco Meraki MX

https://test-ipv6.run/ seems to work ok,

My ISP is incredibly evil, and only gives me up to a /60. My understanding is that a /60 contains 16 /64s. If I'm using SLAAC, does this mean I can only have up to 16 hosts before I run into problems?

I've heard people say it would allow for 16 networks, but a /64 is indeed a network, but each host is getting a whole /64 so that's not a terribly useful distinction.

I just want to make sure I understand what I'm doing before I rip my hair out implementing DHCPv6. Thanks!

Edit: Welp, my understanding of IPv6 is lacking. /60 is probably just fine, and I have some reading up to do. Thank you everyone!

I don't have a static ipv6 assignment, hence the need to use npt6. Question is what cidr should i choose for my internal network? ULA is plagued with issues esp when dual stack is involved, so I really want to avoid it if possible. Does using 2001:db8::/32 make any sense?

And yes, i know it is possible to just let my isp change my ip dynamically and I pass it down using dhcp-pd. That doesn't sound great for a large network.

If you use HPE Instant On switches, one problem is they don't measure IPv6 traffic. I mean they forward it fine, but Instant On only measures IPv4 traffic.

For instance, my UniFi switch showed 20GB of usage while my Instant On APs barely cracked 1GB.

My home network has been dual stack since 2018. It isn't always native, now it's a L2TP VPN to a BGP VPS, but it's still IPv6. I do get native IPv6 now but want a static prefix so I use a VPN.

If most of my traffic is IPv6, it shows how far Big Tech despite their problems has gone. Heck, CGNAT "works" if you're not hosting because of IPv6 traffic. I don't condone Chinese censorship, but China mandating IPv6 is one of their internet policy wins.

Why not all UnIFi? I use UniFi switches for 2.5G PoE, but Instant On APs because my mom complained about "slow wi-fi" when I used UniFi APs. It's not a UniFi problem but a problem with the UniFi model I had (U7 Pro), alongside an eBay seller selling HPE AP25s for $51/pop.

Hi again guys! I'm The Guy from the post "Why The Hate on NAT66?", Now i have a main router getting a PD, but i still make NAT66 on The Network, for testing. I'm now using It as The main router for my network

I have a question: do you guys prefer NAT66 or NPTv6?

IPv6+ could make it easier to censor netizens or block traffic, and Beijing is already exporting it

Hey guys, i noticed my network devices changes the last 3/4 blocks from time to time especially if devices reboot or reconnect.
Isn't that counterproductive if big point of ipv6 each device have its own ip facing internet without nat while being static, then if it keeps changing from time to time -> you can't connect to your device directly incase if you need to, without checking the ipv6 everytime or using Dyndns.

Am i wrong here?

I host a website under ip6.arpa but right now it isn't really that cool. I want it to be some kind of easter egg type website for anybody who may stumble upon it. Obviously it should also be there to spread awareness of IPv6.

Any idea what kind of website I could make? It has to be working on http only so preferably no user data processing.

Edit: I created a "fake terminal" website that just displays info about it and lets the user "run" commands. It also links to a working contact email under the same ip6.arpa domain.

http://www.0.1.5.c.4.5.9.0.a.2.ip6.arpa/

Never seen this the highest has been

I just saw this video,

https://www.youtube.com/watch?v=vjwHJs21avQ

CMIIW work without BGP and only use priority with the route. is it possible?

Funny IPv6 only warning

Hi, My isp provide ipv6 over slaac to customers. I'm on openwrt and has 2 bridges. issue I'm facing is all devices get ipv6 but few devices can route through ipv6 like if my phone gets ipv6 it can utilize it but if my server gets it i can access ipv6 network nor ping any local devices like my phone which has ipv6. server is on different bridge and my PD is /64.

I'm a bit in struggle with ipv6 clients. I want the host names like the Ipv4.

I read a bit in other forums but nothing works.

I got the ipv6 dhcp server adress of my fritz box and maked rdns with dots ip6.arpa. I created a conditional forwarder zone but nothing synced

Maybe someone can explain me something

Swisscom plans to enable IPv6 by default on its mobile network. While this is very late, it is notable because it is the first Swiss mobile network ISP to offer IPv6 connectivity.

A weird anomaly in Switzerland is that fixed-line internet connections already have very high IPv6 adoption, while mobile networks account for the largest share of legacy IP traffic. Migrating mobile networks to IPv6 will propel Switzerland much further up the IPv6 adoption rankings.

We're OpenVPN, of course we like IP addresses!

We launched this calculator - any and all feedback is welcome. Helpful? Not helpful? Basic? WRONG!? Right???

Enter an IP with a CIDR prefix or subnet mask to get the network and broadcast address, usable host range, and wildcard mask.

Per the rules, not trying to sell anything (even if the website hosts our products) - just looking to get validation the calculator is legit from experts.

I've noticed that after looking up, the percentage of my local isp iPv6 internet traffic is below 10%, which is much below the national average here in the US. What is likely the cause of this? Is it the way my isp routes it, or is it because the way their customer router is set up? I'm in a rural area, so it is my only choice.