Is it true that the fd00::/8 address range (ULA) in ipv6 is for machines that you NEVER want to speak with anything on the Internet?

Question

Is it true that the fd00::/8 address space (User Local Addresses) in ipv6 is for machines that you NEVER want to speak with anything on the Internet?

I was just reading that here and rather surprised to find that was the case.

Answer 1

IPv6 packets addressed in the IPv6 ULA address range, fc00::/7, can not be routed on the public Internet. Remember, though, that interfaces can have multiple IPv6 addresses, including Link-Local, Global, and ULA, and they can have several of each. Theoretically, there is no real limit to the number of IPv6 addresses you can assign to one interface, although the host OS will have a limit (usually no more than a couple of dozen, and the OS will need to create IPv6 Solicited-Node multicast addresses for each unicast or anycast IPv6 address, possibly only a single one if the last 24 bits of each address are the same).

For example, you could have a Link-Local address, a Global address, and a ULA address assigned to an interface on each of your hosts. Your hosts on your own network could communicate with the ULA addresses for any traffic that you never want to see on the public Internet, but the hosts could still communicate on the public Internet using any assigned Global addresses.

---

There are two parts to the ULA addresses:

1. The first half of the ULA address range, fc00::/8, is reserved for a future global authority to assign.
2. The second half of the ULA address range, fd00::/8, can be assigned locally, with restrictions. The next 40 bits must be randomly chosen, and you cannot assign prefixes in any particular order.

See RFC 4193, Unique Local IPv6 Unicast Addresses for the full information on assigning ULA addressing:

1. Introduction

This document defines an IPv6 unicast address format that is globally unique and is intended for local communications [IPV6]. These addresses are called Unique Local IPv6 Unicast Addresses and are abbreviated in this document as Local IPv6 addresses. They are not expected to be routable on the global Internet. They are routable inside of a more limited area such as a site. They may also be routed between a limited set of sites.

Local IPv6 unicast addresses have the following characteristics:

• Globally unique prefix (with high probability of uniqueness).

• Well-known prefix to allow for easy filtering at site boundaries.

• Allow sites to be combined or privately interconnected without creating any address conflicts or requiring renumbering of interfaces that use these prefixes.

• Internet Service Provider independent and can be used for communications inside of a site without having any permanent or intermittent Internet connectivity.

• If accidentally leaked outside of a site via routing or DNS, there is no conflict with any other addresses.

• In practice, applications may treat these addresses like global scoped addresses.

This document defines the format of Local IPv6 addresses, how to allocate them, and usage considerations including routing, site border routers, DNS, application support, VPN usage, and guidelines for how to use for local communication inside a site.

Answer 2

Is it true that the fd00::/8 address space (User Local Addresses) in IPv6 is for machines that you NEVER want to speak with anything on the Internet?

Not exactly.

The IPv6 proponent's idea was that you could/should run multiple addresses in parallel. So the same machine could have both one or more global addresses for communication with the outside world and one or more ULAs for communication within the organisation.

In this way you could change the IP addresses used for internet connectivity without affecting internal connectivity.

Unfortunately running multiple addresses in parallel is one of those ideas that works better in theory than in practice. If your machines have both global addresses and local addresses it is quite likely that in some cases the global addresses will end up being used for internal communications. If your machines have global addresses for multiple ISPs they may use the wrong one to source traffic.

So what are your options?

1. Use Provider Independent (PI) space only (or become a Local Internet Registry) this is clearly the better option for major sites of large organisations but it's problematic for small or distributed businesses. Most broadband providers won't do BGP and if everyone went for PI space we would have a routing table nightmare.
2. Use ISP allocated space only, hope to heck that you never have to change ISPs.
3. Use ISP allocated space alongside ULA space. Hope that you can keep the ISP allocated space out of internal stuff.
4. Give the IP purists the finger and deploy IPv6 NAT, at least as a contingency plan.

---

p.s., the article you linked also claims that "RFC 1918 address space was specifically set aside for the purpose of running NAT", I find this claim highly dubious. Neither RFC1918 or it's predecessor RFC1597 make any mention of NAT.

As far as I can tell, NAT has always made the Internet purists squirm; they grudgingly accepted it for IPv4.