Deploying IPv6

At one location I have a subnet that has both a SixXS tunnel (with 2001:/16 addresses) and 6to4 connectivity (with 2002::/16 addresses).

Today I was browsing www1.ietf.org, which has a 2610:… IPv6 address. This is closer to my 6to4 address than my SixXS tunnel address, so my machine selected the 6to4 address as the source address. However, the 6to4 interface is only used to route packets with a 6to4 destination, so the packet was actually sent over the SixXS tunnel. SixXS do ingress filtering, so they dropped the packet.

It turns out that /etc/rc.d/ip6addrctl on FreeBSD has a policy that is exactly suitable for this situation:

ip6addrctl_prefer_ipv6()
{
        ip6addrctl flush >/dev/null 2>&1
        ip6addrctl add ::1/128          50      0
        ip6addrctl add ::/0             40      1
        ip6addrctl add 2002::/16        30      2
        ip6addrctl add ::/96            20      3
        ip6addrctl add ::ffff:0:0/96    10      4
        checkyesno ip6addrctl_verbose && ip6addrctl
}

With this policy, my machine now prefers my 2001:/16 address, unless I’m speaking to a 6to4 host.