On Thu, 2015-05-07 at 15:09 +0200, Nikos Mavrogiannopoulos wrote: > Hello, > With this mail I bring up a discussion made on the irc channel here. > As it is now ocserv, for IPv6 provides an IP address from the > configured pool using a dummy prefix length, the same way as we do for > IPv4. However, since in IPv6 the number of addresses are pretty much > unlimited it makes sense to provide a real subnet to the client. That > will not have much impact on the clients which handle the provided > address as a point-to-point one, but will allow future clients to use > multiple addresses from the VPN. Do you see any issues with that > approach, or have an idea to improve it? No recollection of this. Did I respond? I'm trawling my list archive because I *know* someone sent me a patch to fix the Juniper multiple DNS search domain issue. I'd take a look at IPv6 Prefix Delegation as handled in PPP and DHCPv6. It hands out subnets to the client and the client can then run RA on its *other* interfaces (and hand them out further, perhaps). I think it's normally done as a *separate* configuration item to the main IPv6 address. Yes, there are plenty but there's no reason to be entirely profligate with them. You can have a /127 for the point-to -point link, and multiple /64s for the subnets you want to route to. -- dwmw2 -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 5691 bytes Desc: not available URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20150806/38767080/attachment.bin>
