It seems that other than Internode, no Australian ISP has any details at all about native IPv6 deployment. Locally I am on Optus HFC, which I believe has been sold to the NBN, who I believe have since discovered that it is not quite what they thought it was. i.e. I think they have more problems than rolling out IPv6 and I won't hold my breath.
So the only other option is to use a tunnel of some sort, and it seems there is really only one option with local presence via SixXS. There are other options, notably He.net, but they do not have Australian tunnel-servers. SixXS is the only one I could find with a tunnel in Sydney.
So first sign up for an account there. The process was rather painless and my tunnel was provided quickly.
After getting this, I got dd-wrt configured and working on my Netgear WNDR3700 V4. Here's my terse guide, cobbled together from other bits and pieces I found. I'm presuming you have a recent dd-wrt build that includes the aiccu tool to create the tunnel, and are pretty familiar with logging into it, etc.
Firstly, on dd-wrt make sure you have JFFS2 turned on for somewhere to install scripts. Go Administration, JFFS2 Support, Internal Flash Storage, Enabled.
Next, add the aiccu config file to /jffs/etc/aiccu.conf
# AICCU Configuration # Login information username USERNAME password PASSWORD # Protocol and server listed on your tunnel protocol tic server tic.sixxs.net # Interface names to use ipv6_interface sixxs # The tunnel_id to use # (only required when there are multiple tunnels in the list) #tunnel_id <your tunnel id> # Be verbose? verbose false # Daemonize? daemonize true # Require TLS? requiretls true # Set default route? defaultroute true
Now you can add a script to bring up the tunnel and interface to /jffs/config/sixxs.ipup (make sure you make it executable) where you replace your tunnel address in the ip commands.
# wait until time is synced
while [ `date +%Y` -eq 1970 ]; do
sleep 5
done
# check if aiccu is already running
if [ -n "`ps|grep etc/aiccu|grep -v grep`" ]; then
aiccu stop
sleep 1
killall aiccu
fi
# start aiccu
sleep 3
aiccu start /jffs/etc/aiccu.conf
sleep 3
ip -6 addr add 2001:....:....:....::/64 dev br0
ip -6 route add 2001:....:....:....::/64 dev br0
sleep 5
#### BEGIN FIREWALL RULES ####
WAN_IF=sixxs
LAN_IF=br0
#flush tables
ip6tables -F
#define policy
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT ACCEPT
# Input to the router
# Allow all loopback traffic
ip6tables -A INPUT -i lo -j ACCEPT
#Allow unrestricted access on internal network
ip6tables -A INPUT -i $LAN_IF -j ACCEPT
#Allow traffic related to outgoing connections
ip6tables -A INPUT -i $WAN_IF -m state --state RELATED,ESTABLISHED -j ACCEPT
# for multicast ping replies from link-local addresses (these don't have an
# associated connection and would otherwise be marked INVALID)
ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-reply -s fe80::/10 -j ACCEPT
# Allow some useful ICMPv6 messages
ip6tables -A INPUT -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
# Forwarding through from the internal network
# Allow unrestricted access out from the internal network
ip6tables -A FORWARD -i $LAN_IF -j ACCEPT
# Allow some useful ICMPv6 messages
ip6tables -A FORWARD -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
ip6tables -A FORWARD -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
ip6tables -A FORWARD -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
ip6tables -A FORWARD -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
ip6tables -A FORWARD -p icmpv6 --icmpv6-type echo-request -j ACCEPT
ip6tables -A FORWARD -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
#Allow traffic related to outgoing connections
ip6tables -A FORWARD -i $WAN_IF -m state --state RELATED,ESTABLISHED -j ACCEPT
Now you can reboot, or run the script, and it should bring the tunnel up and you should be correclty firewalled such that packets get out, but nobody can get in.
Back to the web-interface, you can now enable IPv6 with Setup, IPV6, Enable. You leave "IPv6 Type" as Native IPv6 from ISP. Then I enabled Radvd and added a custom config in the text-box to get DNS working with google DNS on hosts with:
interface br0
{
AdvSendAdvert on;
prefix 2001:....:....:....::/64
{
};
RDNSS 2001:4860:4860::8888 2001:4860:4860::8844
{
};
};
(again, replace the prefix with your own)
That is pretty much it; at this point, you should have an IPv6 network and it's most likely that all your network devices will "just work" with it. I got full scores on the IPv6 test sites on a range of devices.
Unfortunately, even a geographically close tunnel still really kills latency; compare these two traceroutes:
$ mtr -r -c 1 google.com Start: Fri Jan 15 14:51:18 2016 HOST: jj Loss% Snt Last Avg Best Wrst StDev 1. |-- 2001:....:....:....:: 0.0% 1 1.4 1.4 1.4 1.4 0.0 2. |-- gw-163.syd-01.au.sixxs.ne 0.0% 1 12.0 12.0 12.0 12.0 0.0 3. |-- ausyd01.sixxs.net 0.0% 1 13.5 13.5 13.5 13.5 0.0 4. |-- sixxs.sydn01.occaid.net 0.0% 1 13.7 13.7 13.7 13.7 0.0 5. |-- 15169.syd.equinix.com 0.0% 1 11.5 11.5 11.5 11.5 0.0 6. |-- 2001:4860::1:0:8613 0.0% 1 14.1 14.1 14.1 14.1 0.0 7. |-- 2001:4860::8:0:79a0 0.0% 1 115.1 115.1 115.1 115.1 0.0 8. |-- 2001:4860::8:0:8877 0.0% 1 183.6 183.6 183.6 183.6 0.0 9. |-- 2001:4860::1:0:66d6 0.0% 1 196.6 196.6 196.6 196.6 0.0 10.|-- 2001:4860:0:1::72d 0.0% 1 189.7 189.7 189.7 189.7 0.0 11.|-- kul01s07-in-x09.1e100.net 0.0% 1 194.9 194.9 194.9 194.9 0.0 $ mtr -4 -r -c 1 google.com Start: Fri Jan 15 14:51:46 2016 HOST: jj Loss% Snt Last Avg Best Wrst StDev 1.|-- gateway 0.0% 1 1.3 1.3 1.3 1.3 0.0 2.|-- 10.50.0.1 0.0% 1 11.0 11.0 11.0 11.0 0.0 3.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 4.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 5.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 6.|-- riv4-ge4-1.gw.optusnet.co 0.0% 1 12.1 12.1 12.1 12.1 0.0 7.|-- 198.142.187.20 0.0% 1 10.4 10.4 10.4 10.4 0.0
When you watch what is actually using ipv6 (the ipvfoo plugin for Chrome is pretty cool, it shows you what requests are going where), it's mostly all just traffic to really big sites (Google/Google Analytics, Facebook, Youtube, etc) who have figured out IPv6.
Since these are exactly the type of places that have made efforts to get caching as close as possible to you (Google's mirror servers are within Optus' network, for example) and so you're really shooting yourself in the foot going around it using an external tunnel. The other thing is that I'm often hitting IPv6 mirrors and downloading larger things for work stuff (distro updates, git clones, image downloads, etc) which is slower and wasting someone else's bandwith for really no benefit.
So while it's pretty cool to have an IPv6 address (and a fun experiment) I think I'm going to turn it off. One positive was that after running with it for about a month, nothing has broken -- which suggests that most consumer level gear in a typical house (phones, laptops, TVs, smart-watches, etc) is either ready or ignores it gracefully. Bring on native IPv6!