21
Actus Free / Free lance Free TV
« Dernier message par chad86 le Aujourd'hui à 07:38:42 »
mais tu ne vois pas que c'est une bille


Actus Free / Free lance Free TV

IPv6 / Support des adresses temporaires dans DHCPv61.1. Relationship to Previous DHCPv6 Standards (RFC 9915: Dynamic Host Configuration Protocol for IPv6 (DHCPv6))
[RFC8415] provided a unified, corrected, and cleaned-up definition of DHCPv6 that also covered all applicable errata filed against older RFCs at the time of its writing.
It also obsoleted a small number of mechanisms: delayed authentication, lifetime, and timer hints sent by a client.
This document obsoletes [RFC8415]. It applies verified errata reports and obsoletes two features that have not been widely implemented - the assignment of temporary
addresses using the IA_TA option and allowing clients to unicast some messages directly to the server if the server sent the Server Unicast option to a client in an early
exchange. It also clarifies the UDP ports used by clients, servers, and relay agents (Section 7.2). See Appendix A for a list of differences from [RFC8415].
4.5.1. Obtain Temporary Addresses (RFC 7844: Anonymity Profiles for DHCP clients)
[RFC3315] defines a special container (IA_TA, code 4) for requesting temporary addresses. This is a good mechanism in principle, but there are a number of issues
associated with it. First, this is not a widely used feature, so clients depending solely on temporary addresses may lock themselves out of service. Secondly, [RFC3315]
does not specify any lifetime or lease length for temporary addresses [voir remarque]. Therefore, support for renewing temporary addresses may vary between client
implementations, including no support at all. Finally, by requesting temporary addresses, a client reveals its desire for privacy and potentially risks countermeasures as
described in Section 2.5.
Because of these issues, clients interested in their privacy SHOULD NOT use IA_TA.
The addresses obtained according to Section 4.5 are meant to be non-temporary, but the anonymity profile uses them as temporary, and they will be discarded when
the link-layer address is changed. They thus meet most of the use cases of the temporary addresses defined in [RFC4941]. Clients interested in their privacy should
not publish their IPv6 addresses in the DNS or otherwise associate them with name services, and thus do not normally need two classes of addresses -- one public,
one temporary.
The use of mechanisms to allocate several IPv6 addresses to a client while preserving privacy is left for further study.
An IA_TA option does not include values for T1 and T2. A client MAY request that the valid lifetime on temporary addresses be extended by
including the addresses in an IA_TA option sent in a Renew or Rebind message to a server.
RFC 8415 : page 103
21.5. Identity Association for Temporary Addresses Option (RFC 8415 (obsolète): Dynamic Host Configuration Protocol for IPv6 (DHCPv6))
The client obtains new temporary addresses by sending an IA_TA option with a new IAID to a server. Requesting new temporary addresses from the server
is the equivalent of generating new temporary addresses as described in [RFC4941]. The server will generate new temporary addresses and return them
to the client. The client should request new temporary addresses before the lifetimes on the previously assigned addresses expire.
4.2.4. Address Generation Mechanisms (draft-rhl-dhc-dhcpv6-extensions-01: DHCPv6 Extension Practices and Considerations)
Currently, the DHCPv6 servers assign addresses, prefixes and other configuration options according to their configured policies. Generally, different networks
may prefer different address generation mechanisms. Several address generation mechanisms for SLAAC [RFC4862] (e.g., IEEE 64-bit EUI-64 [RFC2464],
Constant, semantically opaque [Microsoft], Temporary [RFC4941], and Stable, semantically opaque [RFC7217]) proposed for different requirements can be
utilized in DHCPv6 protocol as well. Note that [RFC7943] is the DHCPv6 version of Stable, semantically opaque [RFC7217]. The many types of IPv6 address
generation mechanisms available have brought about flexibility and diversity. Therefore, corresponding interfaces could be open and defined to allow other
address generation mechanisms to be configured.
[...]
For example, temporary addresses in [RFC4941] can be expressed as tempAddr(eui64, history) = Replace(Truncate(Hash(Concatenate(eui64, history)), 0, 63), 6, 6, 0),
where eui64 means the EUI-64 identifier defined in [RFC2464] and history means a history value defined in [RFC4941].
Technologie mobile 4G / 4G/4G+/4G++: Agrégation des porteuses
5G Home Orange / Perte de la connectivité IPv6 sur la Flybox 5G
Technologie mobile 4G / 4G/4G+/4G++: Agrégation des porteuses
Actus Free / Free lance Free TV
OVH FAI / Besoin d'aide : OVH FTTH + EdgeRouter + IPv6
Technologie mobile 4G / 4G/4G+/4G++: Agrégation des porteusesJe veux bien le nom de l'appli, svp.
Elle reste quand même utilisable sans root?
Actus Free / Free lance Free TV
OVH FAI / Besoin d'aide : OVH FTTH + EdgeRouter + IPv6firewall {
all-ping enable
broadcast-ping disable
ipv6-name WAN6_IN {
default-action drop
description "WANv6 inbound traffic forwarded to LAN"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 30 {
action accept
description "Allow ICMPv6"
protocol icmpv6
}
}
ipv6-name WAN6_LOCAL {
default-action drop
description "WANv6 inbound traffic to the router"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 30 {
action accept
description "Allow ICMPv6"
protocol icmpv6
}
rule 40 {
action accept
description "Allow DHCPv6"
destination {
port 546
}
protocol udp
source {
port 547
}
}
}
ipv6-name WAN6_OUT {
default-action accept
description "WANv6 outbound traffic"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action reject
description "Reject invalid state"
state {
invalid enable
}
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name WAN_IN {
default-action drop
description "packets from Internet to LAN & WLAN"
rule 10 {
action accept
description "allow established/related sessions"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "drop invalid state"
state {
invalid enable
}
}
}
name WAN_LOCAL {
default-action drop
description "packets from Internet to the router"
rule 10 {
action accept
description "allow established/related session to the router"
state {
established enable
related enable
}
}
rule 70 {
action accept
description "Allow Ping"
destination {
group {
address-group ADDRv4_eth0
}
}
limit {
burst 1
rate 50/minute
}
log enable
protocol icmp
}
rule 80 {
action drop
description "drop invalid state"
log disable
state {
invalid enable
}
}
}
name WAN_OUT {
default-action accept
description "wan outbound traffic"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Restrict Internet access for IP/MAC"
source {
mac-address xx:xx:xx:xx:xx:xx
}
state {
new enable
}
}
rule 90 {
action drop
description "drop invalid state"
state {
invalid enable
}
}
}
options {
mss-clamp {
interface-type pppoe
interface-type tun
interface-type pptp
mss 1412
}
mss-clamp6 {
interface-type pppoe
mss 1432
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
ethernet eth0 {
address 192.168.2.1/24
description "eth0 LOCAL LAN SWITCH"
duplex auto
firewall {
out {
name WAN_OUT
ipv6-name WAN6_OUT
}
}
ipv6 {
dup-addr-detect-transmits 1
router-advert {
cur-hop-limit 64
link-mtu 0
managed-flag false
max-interval 600
other-config-flag false
prefix ::/64 {
autonomous-flag true
on-link-flag true
preferred-lifetime 14400
valid-lifetime 18000
}
reachable-time 0
retrans-timer 0
send-advert true
}
}
speed auto
}
ethernet eth1 {
description "Eth1 KOSC ONT FTTH"
duplex auto
pppoe 0 {
default-route auto
dhcpv6-pd {
pd 0 {
interface eth0 {
host-address ::1
prefix-id ::1
service dhcpv6-stateless
}
interface eth2 {
host-address ::1
prefix-id ::1
service dhcpv6-stateless
}
prefix-length 56
}
rapid-commit enable
}
firewall {
in {
ipv6-name WAN6_IN
name WAN_IN
}
local {
ipv6-name WAN6_LOCAL
name WAN_LOCAL
}
out {
ipv6-name WAN6_OUT
name WAN_OUT
}
}
ipv6 {
address {
autoconf
}
dup-addr-detect-transmits 1
enable {
}
}
mtu 1492
name-server auto
password xxxxxxx
user-id xxxxxxxxxxxxxxx@ovh.kosc
}
speed auto
}
ethernet eth2 {
description "eth2 LOCAL LAN SWITCH"
disable
duplex auto
speed auto
}
loopback lo {
}
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name LAN {
authoritative enable
subnet 192.168.2.0/24 {
default-router 192.168.2.1
dns-server 192.168.2.1
domain-name ********
lease 86400
ntp-server 192.168.2.1
start 192.168.2.2 {
stop 192.168.2.254
}
}
}
static-arp disable
use-dnsmasq disable
}
dns {
forwarding {
cache-size 1024
listen-on eth2
listen-on eth0
listen-on lo
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 5010 {
description "Masquerade for WAN"
log disable
outbound-interface pppoe0
protocol all
type masquerade
}
}
ssh {
listen-address 192.168.2.1
port *******
protocol-version v2
}
ubnt-discover {
disable
}
unms {
disable
}
upnp2 {
acl {
rule 100 {
action deny
description IPSEC-NAT-T
external-port 4500
local-port 0-65535
subnet 0.0.0.0/0
}
rule 200 {
action allow
description ALLOW
external-port 1024-65535
local-port 0-65535
subnet 0.0.0.0/0
}
rule 9000 {
action deny
description DENY
external-port 0-65535
local-port 0-65535
subnet 0.0.0.0/0
}
}
listen-on eth0
listen-on eth2
nat-pmp enable
secure-mode enable
wan pppoe0
}
}
system {
analytics-handler {
send-analytics-report false
}
config-management {
commit-revisions 5
}
crash-handler {
send-crash-report false
}
domain-name *******
host-name ubntbureau
login {
user ubnt {
authentication {
encrypted-password *******************
plaintext-password ""
}
level admin
}
}
name-server 2a07:e340::2
name-server 80.67.169.12
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
offload {
hwnat disable
ipsec enable
ipv4 {
forwarding enable
pppoe enable
table-size 65536
vlan enable
}
ipv6 {
forwarding enable
table-size 65536
pppoe enable
}
}
syslog {
global {
archive {
files 2
size 1024
}
facility all {
level err
}
facility protocols {
level err
}
}
}
time-zone Europe/Paris
traffic-analysis {
dpi enable
export enable
}
}
/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:suspend@1:system@5:ubnt-l2tp@1:ubnt-pptp@1:ubnt-udapi-server@1:ubnt-unms@2:ubnt-util@1:vrrp@1:vyatta-netflow@1:webgui@1:webproxy@1:zone-policy@1" === */
/* Release version: v2.0.9-hotfix.7.5622762.230615.1131 */