{"id":2151,"date":"2019-01-25T08:00:00","date_gmt":"2019-01-25T07:00:00","guid":{"rendered":"https:\/\/camilion.dms3labs.cat\/2019\/01\/25\/getting-ipv6-in-barcelona\/"},"modified":"2024-02-14T17:02:03","modified_gmt":"2024-02-14T16:02:03","slug":"getting-ipv6-in-barcelona","status":"publish","type":"post","link":"https:\/\/camilion.eu\/es\/2019\/01\/25\/getting-ipv6-in-barcelona\/","title":{"rendered":"Getting IPv6 in Barcelona"},"content":{"rendered":"<blockquote>\n<p>This blog post was published in coordination with the one on<br \/>\n<a href=\"https:\/\/ungleich.ch\/en-us\/cms\/blog\/2019\/01\/24\/bringing-ipv6-to-barcelona\/\" target=\"_blank\" rel=\"noopener\">ungleich&rsquo;s blog<\/a> about<br \/>\n<a href=\"https:\/\/ungleich.ch\/en-us\/cms\/blog\/2019\/01\/24\/bringing-ipv6-to-barcelona\/\" target=\"_blank\" rel=\"noopener\">bringing IPv6 to Barcelona<\/a>.<\/p>\n<\/blockquote>\n<h2 id=\"who-are-we-and-why-do-we-care-about-ipv6\">Who are we and why do we care about IPv6?<\/h2>\n<p>We, <a href=\"https:\/\/camilion.eu\/en\/about\/\">Camilion Consulting &amp; Development<\/a>, are a small company based<br \/>\nin Barcelona, and we provide <a href=\"https:\/\/camilion.eu\/en\/consulting\/\">consulting<\/a><br \/>\nservices in the Architecture, Engineering and Construction (AEC) world, while<br \/>\nalso <a href=\"https:\/\/camilion.eu\/en\/dev\/\">developing<\/a> <a href=\"https:\/\/camilion.eu\/en\/apps\/\">software<\/a> to help engineers<br \/>\nworldwide work better and faster, so that they free themselves from fighting<br \/>\nthe tools and keep doing wonderful things.<\/p>\n<p>So, we are not an Internet Service Provider (ISP) and we don&rsquo;t have a huge<br \/>\ninfrastructure (it keeps growing though).<\/p>\n<p>Basically, we don&rsquo;t <em>make<\/em> the internet, we are what you might call<br \/>\n<strong>advanced users<\/strong> of the Internet.<\/p>\n<h2 id=\"now-if-we-are-just-advanced-users-why-do-we-care-about-ipv6\">Now, if we are just advanced users, why do we care about IPv6?<\/h2>\n<p>Well, while not being a huge company or an ISP, we do have the will and<br \/>\nknowledge to self-host any services that are critical for our operations.<\/p>\n<p>Why a company would want to do that is a question better answered on a future<br \/>\npost, but the quintessence is that politics have an effect on the world and<br \/>\nwhat is a good\/free\/cheap service today, can either not be available to us or<br \/>\nbe a huge liability in the future.<\/p>\n<p>And, as it turns out, being a small company means that we cannot afford in<br \/>\ntime and effort changing providers for Operation-critical services every<br \/>\ncouple years and we cannot assume a sudden or huge downtime due to things<br \/>\nout of our control like services shutting down, changing terms and conditions,<br \/>\nor plain political instability.<\/p>\n<p>Running our own services is much easier and cheaper with IPv6,<br \/>\nnot only is <a href=\"https:\/\/ipv6onlyhosting.com\" target=\"_blank\" rel=\"noopener\">IPv6 Only Hosting<\/a> cheaper, it is<br \/>\nsomething we can do ourselves, on our own premises, without being an ISP.<\/p>\n<h2 id=\"what-is-the-state-of-ipv6-around-iberia\">What is the state of IPv6 around Iberia?<\/h2>\n<p>According to <a href=\"https:\/\/google.com\/ipv6\" target=\"_blank\" rel=\"noopener\">Google&rsquo;s IPv6 report<\/a>, Spain has an<br \/>\nIPv6 penetration of 2.16% (as of January 23rd 2019).<\/p>\n<p>Taking into account that Google has pretty much a search monopoly in Spain,<br \/>\nthis means that their data, when it comes to IPv6 penetration, reflects<br \/>\nquite well the state of the market.<\/p>\n<p>As you can see, it is a pretty bad situation.<\/p>\n<p>It&rsquo;s not that it&rsquo;s not possible to get IPv6 at all, but the main ISPs in<br \/>\nthe state do not offer that service and in fact, based on our experience,<br \/>\nmany of their technicians and most of their support (even for companies)<br \/>\ndon&rsquo;t really know what IPv6 is.<\/p>\n<p>There are smaller, local ISPs like <a href=\"https:\/\/www.iguana.cat\" target=\"_blank\" rel=\"noopener\">Iguana<\/a> or<br \/>\n<a href=\"https:\/\/parlem.com\" target=\"_blank\" rel=\"noopener\">Parlem<\/a> that offer IPv6 connectivity, and some big ISPs<br \/>\nare starting to test waters but, like with many bottom-to-top changes, it will<br \/>\nlikely take some time. And, in case you wonder, we cannot currently use those.<\/p>\n<h2 id=\"we-need-ipv6-we-need-it-now-how-to-get-that\">We need IPv6, we need it now. How to get that?<\/h2>\n<p>We have a very good relationship with the people at ungleich and<br \/>\nIPv6 is one of their strengths, and a focus point of their on-going<br \/>\n<a href=\"https:\/\/ungleich.ch\/en-us\/cms\/blog\/2019\/02\/07\/day-after-crowdfunding\/\" target=\"_blank\" rel=\"noopener\">crowdfunding<\/a>, we decided to both help them out and<br \/>\nfinally solve our IPv6 needs once and for all by contracting their VPN for a<br \/>\n<code>\/48<\/code> block.<\/p>\n<blockquote>\n<p><strong>Update:<\/strong> their crowdfunding is over now, you can read about it<br \/>\n<a href=\"https:\/\/ungleich.ch\/en-us\/cms\/blog\/2019\/02\/07\/day-after-crowdfunding\/\" target=\"_blank\" rel=\"noopener\">here<\/a><br \/>\nand get the VPN on their new <a href=\"https:\/\/ipv6onlyhosting.com\/en-us\/cms\/ipv6-shop\/\" target=\"_blank\" rel=\"noopener\">IPv6 shop<\/a>.<\/p>\n<\/blockquote>\n<p>Since they needed to allocate the block and setup the routing, which<br \/>\ncoincidentally meant that they had to setup new servers, Nico,<br \/>\n<a href=\"https:\/\/ungleich.ch\" target=\"_blank\" rel=\"noopener\">ungleich<\/a>&rsquo;s CEO, proposed we gave <a href=\"https:\/\/wireguard.com\" target=\"_blank\" rel=\"noopener\">WireGuard<\/a> a go.<\/p>\n<p>This has a bunch of advantages server-side, which we already geeked out about<br \/>\nprivately, and will be published on a follow-up post by him.<br \/>\nA preview can already be found <a href=\"https:\/\/ungleich.ch\/en-us\/cms\/blog\/2019\/01\/23\/we-now-support-wireguard-encrypted-ipv6-vpns\/\" target=\"_blank\" rel=\"noopener\">here<\/a>.<\/p>\n<p>On the client side this meant:<\/p>\n<ul>\n<li>No fiddling with certificates and Certificate Authority files<\/li>\n<li>A one-time 10 minute setup<\/li>\n<li>Not having to consider IPv4 subnets in the tunnel and our routing<\/li>\n<\/ul>\n<h3 id=\"pre-requisites\">Pre-requisites<\/h3>\n<p>You will need a UNIX-based system, for multiple reasons our Operating System<br \/>\n(OS) of choice is <a href=\"https:\/\/devuan.org\" target=\"_blank\" rel=\"noopener\">Devuan<\/a>, but the instructions are just as<br \/>\napplicable to any <a href=\"https:\/\/debian.org\" target=\"_blank\" rel=\"noopener\">Debian<\/a>-derived system.<\/p>\n<p>We have also been told that this setup works on<br \/>\n<a href=\"https:\/\/freebsd.org\" target=\"_blank\" rel=\"noopener\">FreeBSD<\/a>\/<a href=\"https:\/\/openbsd.org\" target=\"_blank\" rel=\"noopener\">OpenBSD<\/a>, which are also wonderful OS&rsquo;s, but were<br \/>\nnot used this time.<\/p>\n<h3 id=\"installing-wireguard\">Installing WireGuard<\/h3>\n<p>Turns out, <a href=\"https:\/\/www.wireguard.com\/install\/\" target=\"_blank\" rel=\"noopener\">installing WireGuard<\/a> is quite easy if you are<br \/>\nrunning a recent-enough system.<br \/>\nFor us, this meant <strong>Beowulf<\/strong>, <a href=\"https:\/\/devuan.org\" target=\"_blank\" rel=\"noopener\">Devuan<\/a>&rsquo;s current testing.<br \/>\nIn <a href=\"https:\/\/debian.org\" target=\"_blank\" rel=\"noopener\">Debian<\/a> that means Buster.<\/p>\n<p><a href=\"https:\/\/wireguard.com\" target=\"_blank\" rel=\"noopener\">WireGuard<\/a> is currently only available on <strong>unstable<\/strong>, which<br \/>\nmeans that we had to add that to the repositories.<\/p>\n<pre class=\"codehilite\"><code>$ echo &quot;deb https:\/\/deb.devuan.org\/merged unstable main&quot; &gt; \/etc\/apt\/sources.list.d\/devuan_unstable.list\n$ apt update\n<\/code><\/pre>\n<p>This, however, risks upgrading everything to <strong>unstable<\/strong>, which is not really<br \/>\nwhat we want.<\/p>\n<p>Desired state is: as long as the packages we need are not available on our<br \/>\ntarget release, we want to use those. But as soon as they are, those in our<br \/>\nrelease have priority.<\/p>\n<p>Luckily, this is quite easy with <strong>apt preferences<\/strong>:<\/p>\n<pre class=\"codehilite\"><code>$ tee \/etc\/apt\/preferences.d\/unstable.pref &lt;&lt; EOF\n\nExplanation: Only install packages from unstable if explicitly asked for or the package is pinned\nPackage: *\nPin: release a=unstable\nPin-Priority: -1\nEOF\n\n$ tee \/etc\/apt\/preferences.d\/wireguard.pref &lt;&lt; EOF\n\nExplanation: Install wireguard from unstable as long as it's not present in testing\nPackage: wireguard wireguard-dkms wireguard-tools\nPin: release a=unstable\nPin-Priority: 50\nEOF\n\n# Replace $arch with your architecture\n$ apt install linux-headers-$arch\n$ apt install wireguard\n# WireGuard runs as a kernel module, compile and install it\n$ dkms autoinstall wireguard\n<\/code><\/pre>\n<h3 id=\"setting-up-the-interface\">Setting up the interface<\/h3>\n<p><a href=\"https:\/\/wireguard.com\" target=\"_blank\" rel=\"noopener\">WireGuard<\/a>&rsquo;s man pages are wonderful, so check <code>man wg<\/code> and<br \/>\n<code>man wg-quick<\/code> to complement this.<\/p>\n<p>There is a very neat command called <code>wg-quick<\/code>, which takes care of creating<br \/>\nand setting up the interface for you.<br \/>\nIn order for it to work though, you&rsquo;ll have to create a<br \/>\n<code>\/etc\/wireguard\/INTERFACE.conf<\/code> file like this:<\/p>\n<pre class=\"codehilite\"><code>$ tee \/etc\/wireguard\/wg-ungleich.test.conf &lt;&lt; EOF\n[Interface]\nPrivateKey = $(wg genkey)\nAddress    = 2a0a:e5c1:XXXX::1\/48\n# PostUp   = \/etc\/wireguard\/wg-ungleich-up.sh\n# PreDown  = \/etc\/wireguard\/wg-ungleich-down.sh\n\n[Peer]\nPublicKey = hi60lGP+xEUQ+kVnqA7PlJAO1SVqTS1W36g0LhFP0xQ=\nEndpoint = vpn-2a0ae5c1.ungleich.ch:51820\nAllowedIPs = ::\/0\nPersistentKeepalive = 25\nEOF\n<\/code><\/pre>\n<p>Notice that you would need to adapt the <code>Address<\/code> in the <code>[Interface]<\/code> section<br \/>\nto the prefix they assign to you and maybe the <code>PublicKey<\/code> and <code>Endpoint<\/code> in<br \/>\nthe <code>[Peer]<\/code> section to the corresponding endpoint settings.<\/p>\n<p>This will generate a private key and the settings that you will need, I<br \/>\ncommented out the lines that enable you to run custom scripts as <code>PostUp<\/code> and<br \/>\n<code>PreDown<\/code> hooks<\/p>\n<p>However, your interface is not up yet, for that we use<br \/>\n<code>wg-quick up wg-ungleich<\/code>.<\/p>\n<p>And that&rsquo;s it!(*) Your interface is up! Check <code>ip addr show wg-ungleich<\/code> and<br \/>\nyou will see the interface has been created and your IPv6 prefix has been<br \/>\nassigned to it.<\/p>\n<p>In order to know how your tunnel is doing though, you want to run the <code>wg<\/code><br \/>\ncommand, which should show something like this:<\/p>\n<pre class=\"codehilite\"><code>$ wg\ninterface: wg-ungleich\n  public key: vwYkUOZdGA5akEA1VkPg\/sS7hvdcA0Lf8MxpTOQdcHE=\n  private key: (hidden)\n  listening port: 37834\n  fwmark: 0xca6d\n\npeer: hi60lGP+xEUQ+kVnqA7PlJAO1SVqTS1W36g0LhFP0xQ=\n  endpoint: [185.203.114.153]:51820\n  allowed ips: ::\/0\n  transfer: 0 B received, 296 B sent\n  persistent keepalive: every 25 seconds\n<\/code><\/pre>\n<p>(*) Well, that wasn&rsquo;t really it! Notice how we have not received any bytes?<br \/>\nAs easy as this is, we haven&rsquo;t told ungleich about our public key!<\/p>\n<p>Go do that and once they set it up, the connection will be fully established<br \/>\nand you will have full IPv6 connectivity.<\/p>\n<h2 id=\"conclusions\">Conclusions<\/h2>\n<p><a href=\"https:\/\/wireguard.com\" target=\"_blank\" rel=\"noopener\">WireGuard<\/a> is refreshingly neat and well documented, the tooling<br \/>\nworks just as expected (a very-good-thing-tm) and the tunnel is very stable.<\/p>\n<p>Right now, getting one of these VPNs at <a href=\"https:\/\/ungleich.ch\" target=\"_blank\" rel=\"noopener\">ungleich<\/a> requires human<br \/>\ninteraction, but this has the potential of being fully automated and I<br \/>\nwouldn&rsquo;t be surprised if they end up doing that.<\/p>\n<p>Also, human interaction is not all that terrible, in fact, in many cases it<br \/>\nis a feature because you get to learn and share, while having better support<br \/>\nthan fully automated systems.<\/p>\n<p>Maybe now it&rsquo;s time for you to check that <a href=\"https:\/\/ungleich.ch\/en-us\/cms\/blog\/2018\/04\/21\/ungleich-quiz-v6\/\" target=\"_blank\" rel=\"noopener\">ungleich quiz v6<\/a>.<\/p>\n<p>But right now for us at <a href=\"https:\/\/camilion.eu\/\">Camilion<\/a>, it&rsquo;s time to go back to growing<br \/>\nour infrastructure and polishing our <em>nearly-ready<\/em> upcoming<br \/>\nthat will join<br \/>\n<a href=\"https:\/\/camilion.eu\/en\/apps\/\">those we already offer<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<blockquote>\n<p>This blog post was published in coordination with the one on<br \/>\n<a href=\"https:\/\/ungleich.ch\/en-us\/cms\/blog\/2019\/01\/24\/bringing-ipv6-to-barcelona\/\">ungleich&rsquo;s blog<\/a> about<br \/>\n<a href=\"https:\/\/ungleich.ch\/en-us\/cms\/blog\/2019\/01\/24\/bringing-ipv6-to-barcelona\/\">bringing IPv6 to Barcelona<\/a>.<\/p>\n<\/blockquote>\n<h2 id=\"who-are-we-and-why-do-we-care-about-ipv6\">Who are we and why do we care about IPv6?<\/h2>\n<p>We, <a href=\"https:\/\/camilion.eu\/en\/about\/\">Camilion Consulting &amp; Development<\/a>, are a small company based<br \/>\nin Barcelona, and we provide <a href=\"https:\/\/camilion.eu\/en\/consulting\/\">consulting<\/a><br \/>\nservices in the Architecture, Engineering and Construction (AEC) world, while<br \/>\nalso <a href=\"https:\/\/camilion.eu\/en\/dev\/\">developing<\/a> <a href=\"https:\/\/camilion.eu\/en\/apps\/\">software<\/a> to help engineers<br \/>\nworldwide work better and faster, so that they free themselves from fighting<br \/>\nthe tools and keep doing wonderful things.<\/p>\n<p>So, we are not an Internet Service Provider (ISP) and we don&rsquo;t have a huge<br \/>\ninfrastructure (it keeps growing though).<\/p>\n<p>Basically, we don&rsquo;t <em>make<\/em> the internet, we are what you might call<br \/>\n<strong>advanced users<\/strong> of the Internet.<\/p>\n<h2 id=\"now-if-we-are-just-advanced-users-why-do-we-care-about-ipv6\">Now, if we are just advanced users, why do we care about IPv6?<\/h2>\n<p>Well, while not being a huge company or an ISP, we do have the will and<br \/>\nknowledge to self-host any services that are critical for our operations.<\/p>\n<p>Why a company would want to do that is a question better answered on a future<br \/>\npost, but the quintessence is that politics have an effect on the world and<br \/>\nwhat is a good\/free\/cheap service today, can either not be available to us or<br \/>\nbe a huge liability in the future.<\/p>\n<p>And, as it turns out, being a small company means that we cannot afford in<br \/>\ntime and effort changing providers for Operation-critical services every<br \/>\ncouple years and we cannot assume a sudden or huge downtime due to things<br \/>\nout of our control like services shutting down, changing terms and conditions,<br \/>\nor plain political instability.<\/p>\n<p>Running our own services is much easier and cheaper with IPv6,<br \/>\nnot only is <a href=\"https:\/\/ipv6onlyhosting.com\">IPv6 Only Hosting<\/a> cheaper, it is<br \/>\nsomething we can do ourselves, on our own premises, without being an ISP.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[2],"tags":[],"dipi_cpt_category":[],"class_list":["post-2151","post","type-post","status-publish","format-standard","hentry","category-sin-categorizar"],"acf":[],"_links":{"self":[{"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/posts\/2151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/comments?post=2151"}],"version-history":[{"count":1,"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/posts\/2151\/revisions"}],"predecessor-version":[{"id":2212,"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/posts\/2151\/revisions\/2212"}],"wp:attachment":[{"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/media?parent=2151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/categories?post=2151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/tags?post=2151"},{"taxonomy":"dipi_cpt_category","embeddable":true,"href":"https:\/\/camilion.eu\/es\/wp-json\/wp\/v2\/dipi_cpt_category?post=2151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}